Az - PostgreSQL Privesc

Reading time: 4 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

PostgreSQL Privesc

Kwa maelezo zaidi kuhusu SQL Database angalia:

Az - PostgreSQL

Microsoft.DBforPostgreSQL/flexibleServers/read && Microsoft.DBforPostgreSQL/flexibleServers/write

Kwa ruhusa hii, unaweza kuunda, kusasisha, au kufuta mifano ya PostgreSQL Flexible Server kwenye Azure. Hii inajumuisha kutoa seva mpya, kubadilisha mipangilio ya seva zilizopo, au kufunga seva.

bash
az postgres flexible-server create \
--name <ServerName> \
--resource-group <ResourceGroupName> \
--location <Location> \
--admin-user <AdminUsername> \
--admin-password <AdminPassword> \
--sku-name <SkuName> \
--storage-size <StorageSizeInGB> \
--tier <PricingTier> \
--version <PostgreSQLVersion>

Kwa mfano, ruhusa hizi zinaruhusu kubadilisha nenosiri la PostgreSQL, muhimu bila shaka endapo uthibitishaji wa PostgreSQL umewezeshwa.

bash
az postgres flexible-server update \
--resource-group <resource_group_name> \
--name <server_name> \
--admin-password <password_to_update>

Zaidi ya hayo, kwa ruhusa unaweza kuwezesha kitambulisho kilichotolewa, na kufanya kazi na kitambulisho kinachosimamiwa kilichounganishwa na seva. Hapa unaweza kupata nyongeza zote ambazo Azure PostgreSQL flexible server inasaidia https://learn.microsoft.com/en-us/azure/cosmos-db/postgresql/reference-extensions. Ili kuweza kutumia nyongeza hizi, baadhi ya vigezo vya seva (azure.extensions) vinahitaji kubadilishwa. Kwa mfano hapa na kitambulisho kinachosimamiwa ambacho kinaweza kufikia Azure Storage:

Kwanza tunabadilisha vigezo na kuhakikisha kitambulisho kilichotolewa kimewezeshwa:

bash
az postgres flexible-server parameter set \
--resource-group <YourResourceGroupName> \
--server-name <YourServerName> \
--name azure.extensions \
--value "AZURE_STORAGE"

az postgres flexible-server identity update \
--resource-group <YourResourceGroupName> \
--server-name <YourServerName> \
--system-assigned Enabled
sql 

CREATE EXTENSION IF NOT EXISTS azure_storage;

CREATE EXTERNAL DATA SOURCE ManagedIdentity

SELECT azure_storage.account_add('<storage-account>', '<storage-key>');

SELECT *
FROM azure_storage.blob_get(
'<storage-account>',
'<container>',
'message.txt',
decoder := 'text'
) AS t(content text)
LIMIT 1;

Zaidi ya hayo, ni muhimu kuwa na ufikiaji wa umma ulioanzishwa ikiwa unataka kufikia kutoka kwa kiunganishi kisichokuwa cha kibinafsi, ili kuuwezesha:

bash
az postgres flexible-server update --resource-group <resource_group_name> --server-name <server_name> --public-access Enabled

Microsoft.DBforPostgreSQL/flexibleServers/read, Microsoft.DBforPostgreSQL/flexibleServers/write, Microsoft.DBforPostgreSQL/flexibleServers/backups/read, Microsoft.ManagedIdentity/userAssignedIdentities/assign/action

Kwa ruhusa hizi unaweza kurejesha seva kutoka kwa nakala ya akiba kwa:

bash
az postgres flexible-server restore \
--resource-group <RESOURCE_GROUP> \
--name <NEW_SERVER_NAME> \
--source-server <SOURCE_SERVER_NAME> \
--restore-time "<ISO8601_TIMESTAMP>" \
--yes

Microsoft.DBforPostgreSQL/flexibleServers/read, Microsoft.DBforPostgreSQL/flexibleServers/write, Microsoft.ManagedIdentity/userAssignedIdentities/assign/action, Microsoft.DBforPostgreSQL/flexibleServers/administrators/write && Microsoft.DBforPostgreSQL/flexibleServers/administrators/read

Kwa ruhusa hii, unaweza kuunda wasimamizi wa Azure Active Directory (AD) kwa seva ya PostgreSQL Flexible. Hii inaweza kutumiwa kwa kuweka mwenyewe au akaunti nyingine kama msimamizi wa AD, ikitoa udhibiti kamili wa usimamizi juu ya seva ya PostgreSQL. Kusasisha mkuu aliye tayari hakusaidiwi bado hivyo ikiwa kuna mmoja aliyeundwa lazima uifute kwanza.

Ni muhimu kwamba seva ya flexible-server iwe na utambulisho wa usimamizi uliotolewa kwa mtumiaji ili kuitumia.

bash
az postgres flexible-server ad-admin create \
--resource-group <ResourceGroupName> \
--server-name <ServerName> \
--display-name <ADAdminDisplayName> \
--identity <IdentityNameOrID> \
--object-id <ObjectID>

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks