diff --git a/linPEAS/builder/linpeas_parts/3_cloud/9_DO_Droplet.sh b/linPEAS/builder/linpeas_parts/3_cloud/11_DO_Droplet.sh similarity index 100% rename from linPEAS/builder/linpeas_parts/3_cloud/9_DO_Droplet.sh rename to linPEAS/builder/linpeas_parts/3_cloud/11_DO_Droplet.sh diff --git a/linPEAS/builder/linpeas_parts/3_cloud/11_Ali_Cloud.sh b/linPEAS/builder/linpeas_parts/3_cloud/13_Ali_Cloud.sh similarity index 100% rename from linPEAS/builder/linpeas_parts/3_cloud/11_Ali_Cloud.sh rename to linPEAS/builder/linpeas_parts/3_cloud/13_Ali_Cloud.sh diff --git a/linPEAS/builder/linpeas_parts/3_cloud/10_IBM_Cloud.sh b/linPEAS/builder/linpeas_parts/3_cloud/14_IBM_Cloud.sh similarity index 100% rename from linPEAS/builder/linpeas_parts/3_cloud/10_IBM_Cloud.sh rename to linPEAS/builder/linpeas_parts/3_cloud/14_IBM_Cloud.sh diff --git a/linPEAS/builder/linpeas_parts/3_cloud/12_Tencent_Cloud.sh b/linPEAS/builder/linpeas_parts/3_cloud/15_Tencent_Cloud.sh similarity index 100% rename from linPEAS/builder/linpeas_parts/3_cloud/12_Tencent_Cloud.sh rename to linPEAS/builder/linpeas_parts/3_cloud/15_Tencent_Cloud.sh diff --git a/linPEAS/builder/linpeas_parts/3_cloud/1_Check_if_in_cloud.sh b/linPEAS/builder/linpeas_parts/3_cloud/1_Check_if_in_cloud.sh index bbf1712..570f2ec 100644 --- a/linPEAS/builder/linpeas_parts/3_cloud/1_Check_if_in_cloud.sh +++ b/linPEAS/builder/linpeas_parts/3_cloud/1_Check_if_in_cloud.sh @@ -5,8 +5,8 @@ # Description: Check if the current system is inside a cloud environment # License: GNU GPL # Version: 1.0 -# Functions Used: check_aws_codebuild, check_aws_ec2, check_aws_ecs, check_aws_lambda, check_az_app, check_az_vm, check_do, check_gcp, check_ibm_vm, check_tencent_cvm, print_list -# Global Variables: $is_aws_codebuild, $is_aws_ecs, $is_aws_ec2, , $is_aws_lambda, $is_az_app, $is_az_vm, $is_do, $is_gcp_vm, $is_gcp_function, $is_ibm_vm, $is_aws_ec2_beanstalk, $is_aliyun_ecs, $is_tencent_cvm +# Functions Used: check_aws_codebuild, check_aws_ec2, check_aws_ecs, check_aws_lambda, check_az_app, check_az_vm, check_az_automation_acc, check_do, check_gcp, check_ibm_vm, check_tencent_cvm, print_list +# Global Variables: $is_aws_codebuild, $is_aws_ecs, $is_aws_ec2, , $is_aws_lambda, $is_az_app, $is_az_automation_acc, $is_az_vm, $is_do, $is_gcp_vm, $is_gcp_function, $is_ibm_vm, $is_aws_ec2_beanstalk, $is_aliyun_ecs, $is_tencent_cvm # Initial Functions: check_gcp, check_aws_ecs, check_aws_ec2, check_aws_lambda, check_aws_codebuild, check_do, check_ibm_vm, check_az_vm, check_az_app, check_aliyun_ecs, check_tencent_cvm # Generated Global Variables: # Fat linpeas: 0 @@ -27,6 +27,7 @@ print_list "DO Droplet? .......................... $is_do\n"$NC | sed "s,Yes,${S print_list "IBM Cloud VM? ........................ $is_ibm_vm\n"$NC | sed "s,Yes,${SED_RED}," | sed "s,No,${SED_GREEN}," print_list "Azure VM? ............................ $is_az_vm\n"$NC | sed "s,Yes,${SED_RED}," | sed "s,No,${SED_GREEN}," print_list "Azure APP? ........................... $is_az_app\n"$NC | sed "s,Yes,${SED_RED}," | sed "s,No,${SED_GREEN}," +print_list "Azure Automation Account? ............ $is_az_automation_acc\n"$NC | sed "s,Yes,${SED_RED}," | sed "s,No,${SED_GREEN}," print_list "Aliyun ECS? .......................... $is_aliyun_ecs\n"$NC | sed "s,Yes,${SED_RED}," | sed "s,No,${SED_GREEN}," print_list "Tencent CVM? ......................... $is_tencent_cvm\n"$NC | sed "s,Yes,${SED_RED}," | sed "s,No,${SED_GREEN}," diff --git a/linPEAS/builder/linpeas_parts/3_cloud/6_Google_cloud_vm.sh b/linPEAS/builder/linpeas_parts/3_cloud/7_Google_cloud_vm.sh similarity index 100% rename from linPEAS/builder/linpeas_parts/3_cloud/6_Google_cloud_vm.sh rename to linPEAS/builder/linpeas_parts/3_cloud/7_Google_cloud_vm.sh diff --git a/linPEAS/builder/linpeas_parts/3_cloud/7_Azure_VM.sh b/linPEAS/builder/linpeas_parts/3_cloud/8_Azure_VM.sh similarity index 100% rename from linPEAS/builder/linpeas_parts/3_cloud/7_Azure_VM.sh rename to linPEAS/builder/linpeas_parts/3_cloud/8_Azure_VM.sh diff --git a/linPEAS/builder/linpeas_parts/3_cloud/8_Azure_app_service.sh b/linPEAS/builder/linpeas_parts/3_cloud/9_Azure_app_service.sh similarity index 100% rename from linPEAS/builder/linpeas_parts/3_cloud/8_Azure_app_service.sh rename to linPEAS/builder/linpeas_parts/3_cloud/9_Azure_app_service.sh diff --git a/linPEAS/builder/linpeas_parts/3_cloud/9_Azure_automation_account.sh b/linPEAS/builder/linpeas_parts/3_cloud/9_Azure_automation_account.sh new file mode 100644 index 0000000..463e0d3 --- /dev/null +++ b/linPEAS/builder/linpeas_parts/3_cloud/9_Azure_automation_account.sh @@ -0,0 +1,46 @@ +# Title: Cloud - Azure Automation Account +# ID: CL_Azure_automation_account +# Author: Carlos Polop +# Last Update: 22-08-2023 +# Description: Azure Automation Account Service Enumeration +# License: GNU GPL +# Version: 1.0 +# Functions Used: check_az_automation_acc, exec_with_jq, print_2title, print_3title +# Global Variables: $is_az_automation_acc, +# Initial Functions: check_az_automation_acc +# Generated Global Variables: $API_VERSION, $HEADER, $az_req +# Fat linpeas: 0 +# Small linpeas: 0 + + +API_VERSION="2019-08-01" #https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp + +if [ "$is_az_automation_acc" = "Yes" ]; then + print_2title "Azure Automation Account Service Enumeration" + + HEADER="X-IDENTITY-HEADER:$IDENTITY_HEADER" + + az_req="" + if [ "$(command -v curl || echo -n '')" ]; then + az_req="curl -s -f -L -H '$HEADER'" + elif [ "$(command -v wget || echo -n '')" ]; then + az_req="wget -q -O - -H '$HEADER'" + else + echo "Neither curl nor wget were found, I can't enumerate the metadata service :(" + fi + + if [ "$az_req" ]; then + print_3title "Management token" + exec_with_jq eval $az_req "$IDENTITY_ENDPOINT?api-version=$API_VERSION\&resource=https://management.azure.com/" + echo + print_3title "Graph token" + exec_with_jq eval $az_req "$IDENTITY_ENDPOINT?api-version=$API_VERSION\&resource=https://graph.microsoft.com/" + echo + print_3title "Vault token" + exec_with_jq eval $az_req "$IDENTITY_ENDPOINT?api-version=$API_VERSION\&resource=https://vault.azure.net/" + echo + print_3title "Storage token" + exec_with_jq eval $az_req "$IDENTITY_ENDPOINT?api-version=$API_VERSION\&resource=https://storage.azure.com/" + fi + echo "" +fi diff --git a/linPEAS/builder/linpeas_parts/functions/check_az_automation_acc.sh b/linPEAS/builder/linpeas_parts/functions/check_az_automation_acc.sh new file mode 100644 index 0000000..34a05a0 --- /dev/null +++ b/linPEAS/builder/linpeas_parts/functions/check_az_automation_acc.sh @@ -0,0 +1,22 @@ +# Title: Cloud - check_az_app +# ID: check_az_app +# Author: Carlos Polop +# Last Update: 22-08-2023 +# Description: Check if the script is running in Azure App Service +# License: GNU GPL +# Version: 1.0 +# Functions Used: +# Global Variables: +# Initial Functions: +# Generated Global Variables: $is_az_automation_acc +# Fat linpeas: 0 +# Small linpeas: 1 + + +check_az_automation_acc(){ + is_az_automation_acc="No" + + if env | grep -iq "azure" && env | grep -iq "AutomationServiceEndpoint"; then + is_az_automation_acc="Yes" + fi +} \ No newline at end of file