oscp/Necronomicon/Cloud/Azure/Reader Permissions/Azure Container Registry.md

• Reader permissions can pull container images
  • Authenticate as Reader
    • az login -u readeruser@<DOMAIN> -p myPassword123
  • List container registries - note the name
    • az acr list -o table
  • Generate a Docker login and connect to the registry
    • acr=ACR_NAME
    • loginserver=$(az acr login -n $acr --expose-token --query loginServer -o tsv)
    • accesstoken=$(az acr login -n $acr --expose-token --query accessToken -o tsv)
    • docker login $loginserver -u 00000000-0000-0000-0000-000000000000 -p $accesstoken
  • List images in the container registry
    • az acr repository list -n $acr
  • Enumerate versions by listing tags for an image
    • az acr repository show-tags -n $acr --repository nodeapp-web
  • Note registry credentials in session
    • echo $loginserver
    • echo $accesstoken
  • Open a PowerShell console as Administrator and set variables (if necessary based on Windows version)
    • $loginserver="<LOGIN_SERVER>"
    • $accesstoken="<ACCESS_TOKEN>"
  • Login to Docker from PowerShell
    • docker login $loginserver -u 00000000-0000-0000-0000-000000000000 -p $accesstoken
  • Pull the image
    • docker pull $loginserver/nodeapp-web:v1
  • Examine the image for sensitive information (list env vars)
    • docker container run --rm $loginserver/nodeapp-web:v1 env
  • Login with found credentials via Azure CLI
    • az login --service-principal --username APP_ID --password SECRET_KEY --tenant TENANT_ID
  • Check role assignment and scope
    • az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'