Skip to content

Commit 792d7d1

Browse files
teamssixteamssix
authored
Merge pull request #28 from teamssix/main
feat: add azure container blob traversal scenario
2 parents fca688c + e40ba01 commit 792d7d1

10 files changed

Lines changed: 172 additions & 3 deletions

File tree

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@ Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei C
3838
| 24 | Google Cloud Platform | Object Storage | [Unrestricted File Upload](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/unrestricted_file_upload) |
3939
| 25 | Google Cloud Platform | Elastic Computing Service | [VM Command Execution](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/elastic_computing_service/vm_command_execution) |
4040
| 26 | Microsoft Azure | Object Storage | [Blob Public Access](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/blob_public_access/) |
41-
| 27 | Microsoft Azure | Elastic Computing Service | [VM Command Execution](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/elastic_computing_service/vm_command_execution) |
41+
| 27 | Microsoft Azure | Object Storage | [Container_Blob Traversal](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/container_blob_traversal/) |
42+
| 28 | Microsoft Azure | Elastic Computing Service | [VM Command Execution](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/elastic_computing_service/vm_command_execution) |
4243

4344
## :dizzy: Install
4445

‎README_CN.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Cloud Platform、Microsoft Azure 六个云厂商的云场景漏洞搭建。
1313
| :--: | :--------------------: | :----------: | :----------------------------------------------------------: |
1414
| 1 | 腾讯云 | 对象存储 | [Bucket 对象遍历](https://github.com/HuoCorp/TerraformGoat/tree/main/tencentcloud/object_storage_service/bucket_object_traversal) |
1515
| 2 | 腾讯云 | 对象存储 | [任意文件上传](https://github.com/HuoCorp/TerraformGoat/tree/main/tencentcloud/object_storage_service/unrestricted_file_upload) |
16-
| 2 | 腾讯云 | 对象存储 | [Bucket ACL 可写](https://github.com/HuoCorp/TerraformGoat/tree/main/tencentcloud/object_storage_service/bucket_acl_writable) |
16+
| 3 | 腾讯云 | 对象存储 | [Bucket ACL 可写](https://github.com/HuoCorp/TerraformGoat/tree/main/tencentcloud/object_storage_service/bucket_acl_writable) |
1717
| 4 | 腾讯云 | 弹性计算服务 | [CVM SSRF 漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/tencentcloud/elastic_computing_service/cvm_ssrf) |
1818
| 5 | 阿里云 | 对象存储 | [Bucket 对象遍历](https://github.com/HuoCorp/TerraformGoat/tree/main/aliyun/object_storage_service/bucket_object_traversal) |
1919
| 6 | 阿里云 | 对象存储 | [Object ACL 可写](https://github.com/HuoCorp/TerraformGoat/tree/main/aliyun/object_storage_service/object_acl_writable) |
@@ -37,7 +37,8 @@ Cloud Platform、Microsoft Azure 六个云厂商的云场景漏洞搭建。
3737
| 24 | Google Cloud Platform | 对象存储 | [任意文件上传](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/unrestricted_file_upload) |
3838
| 25 | Google Cloud Platform | 弹性计算服务 | [VM 命令执行漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/elastic_computing_service/vm_command_execution) |
3939
| 26 | Microsoft Azure | 对象存储 | [Blob 公开访问](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/blob_public_access/) |
40-
| 27 | Microsoft Azure | 弹性计算服务 | [VM 命令执行漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/elastic_computing_service/vm_command_execution) |
40+
| 27 | Microsoft Azure | 对象存储 | [Container Blob 遍历](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/container_blob_traversal/) |
41+
| 28 | Microsoft Azure | 弹性计算服务 | [VM 命令执行漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/elastic_computing_service/vm_command_execution) |
4142

4243
## :dizzy: 安装
4344

‎azure/object_storage_service/container_blob_traversal/README.md‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Microsoft Azure storage blob traversal vulnerability environment
2+
3+
English | [中文](./README_CN.md)
4+
5+
## Description
6+
7+
This is a vulnerability environment scenario for building traversal to Microsoft cloud storage blobs.
8+
9+
After you build an environment with Terraform, the blobs in the container can be traversed.
10+
11+
## Deployment Environment
12+
13+
Execute the following command in the container
14+
15+
```shell
16+
cd /TerraformGoat/azure/object_storage_service/container_blob_traversal/
17+
```
18+
19+
Use the `az login` command for Azure identity authentication, and follow the prompts to authenticate.
20+
21+
```shell
22+
az login
23+
```
24+
25+
Deploy Vulnerable Environment
26+
27+
```shell
28+
terraform init
29+
terraform apply
30+
```
31+
32+
> When the terminal prompts `Enter a value:`, enter `yes`
33+
34+
After the environment is set up, You can see the access address of the container at Outputs.
35+
36+
## Vulnerability Utilization
37+
38+
access container address, traverse blobs
39+
40+
```shell
41+
https://hxxxxxx.blob.core.windows.net/hxxxxxx?restype=contriner&comp=list
42+
```
43+
44+
![image](../../../images/1652413278.png)
45+
46+
find the flag file
47+
48+
```shell
49+
https://hxxxxxx.blob.core.windows.net/hxxxxxx/flag1650859
50+
```
51+
52+
![image](../../../images/1652413373.png)
53+
54+
## Destroy the environment
55+
56+
```shell
57+
terraform destroy
58+
```

‎azure/object_storage_service/container_blob_traversal/README_CN.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# MicroSoft Azure storage blob 遍历漏洞环境
2+
3+
[English](./README.md) | 中文
4+
5+
## 描述信息
6+
7+
这是一个用于构建微软云存储 blob 遍历的漏洞环境靶场。
8+
9+
使用 Terraform 构建环境后，用户可以遍历到 container 中的 blob
10+
11+
## 环境搭建
12+
13+
在容器中执行以下命令
14+
15+
```shell
16+
cd /TerraformGoat/azure/object_storage_service/container_blob_traversal/
17+
```
18+
19+
通过 `az login` 命令进行 Azure 身份认证，根据提示进行认证即可。
20+
21+
```shell
22+
az login
23+
```
24+
25+
部署靶场
26+
27+
```shell
28+
terraform init
29+
terraform apply
30+
```
31+
32+
> 在终端提示 `Enter a value:` 时，输入 `yes` 即可
33+
34+
当命令执行完后，在 Outputs 处可以看到 container 的访问地址。
35+
36+
## 漏洞利用
37+
38+
访问 container 地址，可以遍历 blob
39+
40+
```shell
41+
https://hxxxxxx.blob.core.windows.net/hxxxxxx?restype=contriner&comp=list
42+
```
43+
44+
![image](../../../images/1652413278.png)
45+
46+
发现 flag 文件
47+
48+
```shell
49+
https://hxxxxxx.blob.core.windows.net/hxxxxxx/flag1650859
50+
```
51+
52+
![image](../../../images/1652413373.png)
53+
54+
成功获得 flag
55+
56+
## 销毁环境
57+
58+
```shell
59+
terraform destroy
60+
```

‎azure/object_storage_service/container_blob_traversal/flag1650859‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{Congratulations on getting flag}

‎azure/object_storage_service/container_blob_traversal/main.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
provider "azurerm" {
2+
features {}
3+
}
4+
5+
resource "azurerm_resource_group" "hxexample" {
6+
name = "hx${random_string.random_suffix.result}"
7+
location = "West Europe"
8+
}
9+
10+
resource "azurerm_storage_account" "hxexample" {
11+
name = "hx${random_string.random_suffix.result}"
12+
resource_group_name = azurerm_resource_group.hxexample.name
13+
location = azurerm_resource_group.hxexample.location
14+
account_tier = "Standard"
15+
account_replication_type = "LRS"
16+
}
17+
18+
resource "azurerm_storage_container" "hxexample" {
19+
name = "hx${random_string.random_suffix.result}"
20+
storage_account_name = azurerm_storage_account.hxexample.name
21+
container_access_type = "container"
22+
}
23+
24+
resource "azurerm_storage_blob" "hxexample" {
25+
name = "flag1650859"
26+
storage_account_name = azurerm_storage_account.hxexample.name
27+
storage_container_name = azurerm_storage_container.hxexample.name
28+
type = "Block"
29+
source = "flag1650859"
30+
}
31+
32+
resource "random_string" "random_suffix" {
33+
length = 5
34+
special = false
35+
upper = false
36+
}

‎azure/object_storage_service/container_blob_traversal/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "azurerm_storage_container_url" {
2+
value = "https://${azurerm_resource_group.hxexample.name}.blob.core.windows.net/${azurerm_resource_group.hxexample.name}?restype=contriner&comp=list"
3+
description = "This is the bucket name of azurerm storage container url"
4+
}

‎azure/object_storage_service/container_blob_traversal/versions.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
terraform {
2+
required_providers {
3+
azurerm = {
4+
source = "hashicorp/azurerm"
5+
version = "3.3.0"
6+
}
7+
}
8+
}

‎images/1652413278.png‎

111 KB
Loading

‎images/1652413373.png‎

33.6 KB
Loading

0 commit comments

Comments
 (0)