Merge pull request #118 from JaimePolop/master

Update Service Bus
HackTricks-wiki · Dec 5, 2024 · 7db3ca2 · 7db3ca2
2 parents b2956ac + bf3a1b4
commit 7db3ca2
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 4 deletions.
diff --git a/...ng-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md b/...ng-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md
@@ -128,8 +128,12 @@ Take a look here:
 * https://learn.microsoft.com/en-us/cli/azure/servicebus/namespace?view=azure-cli-latest
 * https://learn.microsoft.com/en-us/cli/azure/servicebus/queue?view=azure-cli-latest
 
+<details>
+
+<summary>Support HackTricks</summary>
+
 * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
 * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
 
 </details>

diff --git a/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md b/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md
@@ -147,6 +147,16 @@ print("Message Receiving Completed")
 print("----------------------------")
 ```
 
+### `Microsoft.ServiceBus/namespaces/authorizationRules/write` & `Microsoft.ServiceBus/namespaces/authorizationRules/write`
+If you have these permissions, you can escalate privileges by reading or creating shared access keys. These keys allow full control over the Service Bus namespace, including managing queues, topics, and sending/receiving messages, potentially bypassing role-based access controls (RBAC).
+
+```bash
+az servicebus namespace authorization-rule update \
+    --resource-group <MyResourceGroup> \
+    --namespace-name <MyNamespace> \
+    --name RootManageSharedAccessKey \
+    --rights Manage Listen Send
+```
 
 ## References
 
@@ -156,9 +166,12 @@ print("----------------------------")
 * https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless
 * https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus
 
+<details>
+
+<summary>Support HackTricks</summary>
+
 * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
 * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
-
 </details>
 {% endhint %}
diff --git a/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md b/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md
@@ -111,8 +111,12 @@ az servicebus namespace authorization-rule keys list --resource-group <MyResourc
 * https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-messaging-overview
 * https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-quickstart-cli
 
+<details>
+
+<summary>Support HackTricks</summary>
+
 * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
 * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
 
 </details>