From 5f1752dfd6b876791486570a5e86d5c957a972ef Mon Sep 17 00:00:00 2001
From: Jaime Polop <117489620+JaimePolop@users.noreply.github.com>
Date: Fri, 10 Jan 2025 11:01:45 +0100
Subject: [PATCH 1/8] Add files via upload
---
.../azure-security/az-services/az-cosmosDB.md | 360 ++++++++++++++++++
.../azure-security/az-services/az-mysql.md | 194 ++++++++++
.../az-services/az-postgresql.md | 173 +++++++++
3 files changed, 727 insertions(+)
create mode 100644 src/pentesting-cloud/azure-security/az-services/az-cosmosDB.md
create mode 100644 src/pentesting-cloud/azure-security/az-services/az-mysql.md
create mode 100644 src/pentesting-cloud/azure-security/az-services/az-postgresql.md
diff --git a/src/pentesting-cloud/azure-security/az-services/az-cosmosDB.md b/src/pentesting-cloud/azure-security/az-services/az-cosmosDB.md
new file mode 100644
index 0000000000..08e5e2fe6e
--- /dev/null
+++ b/src/pentesting-cloud/azure-security/az-services/az-cosmosDB.md
@@ -0,0 +1,360 @@
+# Az - CosmosDB
+
+{% hint style="success" %}
+Learn & practice AWS Hacking: (1) (1) (1).png)
[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
+Learn & practice GCP Hacking:  (1).png)
[**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
+
+
+
+Support HackTricks
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** π¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** π¦ [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+
+{% endhint %}
+
+## Azure CosmosDB
+
+**Azure Cosmos DB** is a fully **managed NoSQL, relational, and vector database** offering single-digit millisecond response times, automatic scalability, and SLA-backed availability with enterprise-grade security. It enables faster app development through turnkey multi-region data distribution, open-source APIs, SDKs for popular languages, and AI database features like integrated vector support and seamless Azure AI integration.
+
+Azure Cosmos DB provides multiple database APIs to model real-world data using documents, relational, key-value, graph, and column-family data models, being this APIs NoSQL, MongoDB, PostgreSQL, Cassandra, Gremlin and Table.
+
+One key aspect of CosmosDB is Azure Cosmos Account. **Azure Cosmos Account**, acts as the entry point to the databases. The account determines key settings such as global distribution, consistency levels, and the specific API to be used, such as NoSQL. Through the account, you can configure global replication to ensure data is available across multiple regions for low-latency access. Additionally, you can choose a consistency level that balances between performance and data accuracy, with options ranging from Strong to Eventual consistency.
+
+### NoSQL (sql)
+The Azure Cosmos DB NoSQL API is a document-based API that uses JSON as its data format. It provides a SQL-like query syntax for querying JSON objects, making it suitable for working with structured and semi-structured data. The endpoint of the service is:
+
+{% code overflow="wrap" %}
+```bash
+https://.documents.azure.com:443/
+```
+{% endcode %}
+
+#### Databases
+Within an account, you can create one or more databases, which serve as logical groupings of containers. A database acts as a boundary for resource management and user permissions. Databases can either share provisioned throughput across their containers or allocate dedicated throughput to individual containers.
+
+#### Containers
+The core unit of data storage is the container, which holds JSON documents and is automatically indexed for efficient querying. Containers are elastically scalable and distributed across partitions, which are determined by a user-defined partition key. The partition key is critical for ensuring optimal performance and even data distribution. For example, a container might store customer data, with "customerId" as the partition key.
+
+
+#### Enumeration
+
+{% tabs %}
+{% tab title="az cli" %}
+{% code overflow="wrap" %}
+```bash
+# CosmoDB Account
+## List Azure Cosmos DB database accounts.
+az cosmosdb list --resource-group
+az cosmosdb show --resource-group --name
+
+## Lists the virtual network accounts associated with a Cosmos DB account
+az cosmosdb network-rule list --resource-group --name
+## List the access keys or connection strings for a Azure Cosmos DB
+az cosmosdb keys list --name --resource-group
+## List all the database accounts that can be restored.
+az cosmosdb restorable-database-account list --account-name
+## Show the identities for a Azure Cosmos DB database account.
+az cosmosdb identity show --resource-group --name
+
+
+# CosmoDB (NoSQL)
+## List the SQL databases under an Azure Cosmos DB account.
+az cosmosdb sql database list --resource-group --account-name
+## List the SQL containers under an Azure Cosmos DB SQL database.
+az cosmosdb sql container list --account-name --database-name --resource-group
+
+## List all SQL role assignments under an Azure Cosmos DB
+az cosmosdb sql role assignment list --resource-group --account-name
+## List all SQL role definitions under an Azure Cosmos DB
+az cosmosdb sql role definition list --resource-group --account-name
+
+## List the SQL stored procedures under an Azure Cosmos DB
+az cosmosdb sql stored-procedure list --account-name --container-name --database-name --resource-group
+## List the SQL triggers under an Azure Cosmos DB SQL container.
+az cosmosdb sql trigger list --account-name --container-name --database-name --resource-group
+## List the SQL user defined functions under an Azure Cosmos DB SQL container
+az cosmosdb sql user-defined-function list --account-name --container-name --database-name --resource-group
+
+```
+{% endcode %}
+{% endtab %}
+
+{% tab title="Az PowerShell" %}
+{% code overflow="wrap" %}
+```powershell
+Get-Command -Module Az.CosmosD
+
+# List all Cosmos DB accounts in a specified resource group.
+Get-AzCosmosDBAccount -ResourceGroupName ""
+
+# Get the access keys for a specific Cosmos DB account.
+Get-AzCosmosDBAccountKey -ResourceGroupName "" -Name ""
+
+# Retrieve the client encryption keys for a specific Cosmos DB account.
+Get-AzCosmosDbClientEncryptionKey -ResourceGroupName "" -AccountName "" -DatabaseName ""
+
+# List all SQL containers in a specific Cosmos DB SQL database.
+Get-AzCosmosDBSqlContainer -ResourceGroupName "" -AccountName "" -DatabaseName ""
+
+# Get backup information for a specific Cosmos DB SQL container.
+Get-AzCosmosDBSqlContainerBackupInformation -ResourceGroupName "" -AccountName "" -DatabaseName "" -Name "" -Location ""
+
+# Get the throughput (RU/s) settings for a specific Cosmos DB SQL container.
+Get-AzCosmosDBSqlContainerThroughput -ResourceGroupName "" -AccountName "" -DatabaseName "" -Name ""
+
+# List all SQL databases under a specific Cosmos DB account.
+Get-AzCosmosDBSqlDatabase -ResourceGroupName "" -AccountName ""
+
+# Get the throughput (RU/s) settings for a specific Cosmos DB SQL database.
+Get-AzCosmosDBSqlDatabaseThroughput -ResourceGroupName "" -AccountName "" -Name ""
+
+# List all SQL role assignments for a specific Cosmos DB account.
+Get-AzCosmosDBSqlRoleAssignment -ResourceGroupName "" -AccountName ""
+
+# List all SQL role definitions for a specific Cosmos DB account.
+Get-AzCosmosDBSqlRoleDefinition -ResourceGroupName "" -AccountName ""
+
+# List all stored procedures in a specific Cosmos DB SQL container.
+Get-AzCosmosDBSqlStoredProcedure -ResourceGroupName "" -AccountName "" -DatabaseName "" -ContainerName ""
+
+# List all triggers in a specific Cosmos DB SQL container.
+Get-AzCosmosDBSqlTrigger -ResourceGroupName "" -AccountName "" -DatabaseName "" -ContainerName ""
+
+# List all user-defined functions (UDFs) in a specific Cosmos DB SQL container.
+Get-AzCosmosDBSqlUserDefinedFunction -ResourceGroupName "" -AccountName "" -DatabaseName "" -ContainerName ""
+```
+{% endcode %}
+{% endtab %}
+{% endtabs %}
+
+#### Connection
+
+To connect the azure-cosmosDB (pip install azure-cosmos) library is needed. Additionally the endpoint and the key are crutial components to make the connection.
+{% code overflow="wrap" %}
+```python
+from azure.cosmos import CosmosClient, PartitionKey
+
+# Connection details
+endpoint = ""
+key = ""
+
+# Initialize Cosmos Client
+client = CosmosClient(endpoint, key)
+
+# Access existing database and container
+database_name = ''
+container_name = ''
+database = client.get_database_client(database_name)
+container = database.get_container_client(container_name)
+
+# Insert multiple documents
+items_to_insert = [
+ {"id": "1", "name": "Sample Item", "description": "This is a sample document."},
+ {"id": "2", "name": "Another Sample Item", "description": "This is another sample document."},
+ {"id": "3", "name": "Sample Item", "description": "This is a duplicate name sample document."},
+]
+
+for item in items_to_insert:
+ container.upsert_item(item)
+
+# Query all documents
+query = "SELECT * FROM c"
+all_items = list(container.query_items(
+ query=query,
+ enable_cross_partition_query=True
+))
+
+# Print all queried items
+print("All items in the container:")
+for item in all_items:
+ print(item)
+```
+{% endcode %}
+
+Another way of stablishing a connection is to use the **DefaultAzureCredential()**. Just need to login (az login) with the account that has the permissions and execute it. For this case a role assigment must be done, giving the necesary permissions (see for mor)
+
+{% code overflow="wrap" %}
+```python
+from azure.identity import DefaultAzureCredential
+from azure.cosmos import CosmosClient
+
+# Use Azure AD for authentication
+credential = DefaultAzureCredential()
+endpoint = ""
+client = CosmosClient(endpoint, credential)
+
+# Access database and container
+database_name = ""
+container_name = ""
+database = client.get_database_client(database_name)
+container = database.get_container_client(container_name)
+
+# Insert a document
+item = {
+ "id": "1",
+ "name": "Sample Item",
+ "description": "This is a test item."
+}
+container.create_item(item)
+print("Document inserted.")
+```
+{% endcode %}
+
+### MongoDB
+The MongoDB NoSQL API is a document-based API that uses JSON-like BSON (Binary JSON) as its data format. It provides a query language with aggregation capabilities, making it suitable for working with structured, semi-structured, and unstructured data. The endpoint of the service typically follows this format:
+
+{% code overflow="wrap" %}
+```bash
+mongodb://:/
+```
+{% endcode %}
+
+#### Databases
+In MongoDB, you can create one or more databases within an instance. Each database serves as a logical grouping of collections and provides a boundary for resource organization and management. Databases help separate and manage data logically, such as for different applications or projects.
+
+#### Collections
+The core unit of data storage in MongoDB is the collection, which holds documents and is designed for efficient querying and flexible schema design. Collections are elastically scalable and can support high-throughput operations across multiple nodes in a distributed setup.
+
+#### Enumeration
+
+{% tabs %}
+{% tab title="az cli" %}
+{% code overflow="wrap" %}
+```bash
+# CosmoDB Account
+## List Azure Cosmos DB database accounts.
+az cosmosdb list --resource-group
+az cosmosdb show --resource-group --name
+
+## Lists the virtual network accounts associated with a Cosmos DB account
+az cosmosdb network-rule list --resource-group --name
+## List the access keys or connection strings for a Azure Cosmos DB
+az cosmosdb keys list --name --resource-group
+## List all the database accounts that can be restored.
+az cosmosdb restorable-database-account list --account-name
+## Show the identities for a Azure Cosmos DB database account.
+az cosmosdb identity show --resource-group --name
+
+```
+{% endcode %}
+{% endtab %}
+
+{% tab title="Az PowerShell" %}
+{% code overflow="wrap" %}
+```powershell
+Get-Command -Module Az.CosmosDB
+
+# List all Cosmos DB accounts in a specified resource group.
+Get-AzCosmosDBAccount -ResourceGroupName ""
+
+# Get the access keys for a specific Cosmos DB account.
+Get-AzCosmosDBAccountKey -ResourceGroupName "" -Name ""
+
+# Retrieve the client encryption keys for a specific Cosmos DB account.
+Get-AzCosmosDbClientEncryptionKey -ResourceGroupName "" -AccountName "" -DatabaseName ""
+
+# List all MongoDB collections in a specific database.
+Get-AzCosmosDBMongoDBCollection -AccountName -ResourceGroupName -DatabaseName
+
+# Retrieve backup information for a specific MongoDB collection in a database.
+Get-AzCosmosDBMongoDBCollectionBackupInformation -AccountName -ResourceGroupName -DatabaseName -Name -Location
+
+# Get the throughput (RU/s) of a specific MongoDB collection in a database.
+Get-AzCosmosDBMongoDBCollectionThroughput -AccountName -ResourceGroupName -DatabaseName -Name
+
+# List all MongoDB databases in a specified Cosmos DB account.
+Get-AzCosmosDBMongoDBDatabase -AccountName -ResourceGroupName
+
+# Get the throughput (RU/s) of a specific MongoDB database.
+Get-AzCosmosDBMongoDBDatabaseThroughput -AccountName -ResourceGroupName -DatabaseName
+
+# Retrieve the role definitions for MongoDB users in a specified Cosmos DB account.
+Get-AzCosmosDBMongoDBRoleDefinition -AccountName -ResourceGroupName
+
+```
+{% endcode %}
+{% endtab %}
+{% endtabs %}
+
+#### Connection
+
+Here the password you can find them with the keys or with the method decribed in the privesc section.
+{% code overflow="wrap" %}
+```python
+from pymongo import MongoClient
+
+# Updated connection string with retryWrites=false
+connection_string = "mongodb://.mongo.cosmos.azure.com:10255/?ssl=true&replicaSet=globaldb&retryWrites=false"
+
+# Create the client
+client = MongoClient(connection_string, username="", password="")
+
+# Access the database
+db = client['']
+
+# Access a collection
+collection = db['']
+
+# Insert a single document
+document = {
+ "name": "John Doe",
+ "email": "johndoe@example.com",
+ "age": 30,
+ "address": {
+ "street": "123 Main St",
+ "city": "Somewhere",
+ "state": "CA",
+ "zip": "90210"
+ }
+}
+
+# Insert document
+result = collection.insert_one(document)
+print(f"Inserted document with ID: {result.inserted_id}")
+```
+{% endcode %}
+
+## References
+
+* [https://learn.microsoft.com/en-us/azure/cosmos-db/choose-api](https://learn.microsoft.com/en-us/azure/cosmos-db/choose-api)
+* [https://learn.microsoft.com/en-us/azure/cosmos-db/](https://learn.microsoft.com/en-us/azure/cosmos-db/)
+* [https://learn.microsoft.com/en-us/azure/cosmos-db/introduction](https://learn.microsoft.com/en-us/azure/cosmos-db/introduction)
+* [https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/security/how-to-grant-data-plane-role-based-access?tabs=built-in-definition%2Ccsharp&pivots=azure-interface-cli](https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/security/how-to-grant-data-plane-role-based-access?tabs=built-in-definition%2Ccsharp&pivots=azure-interface-cli)
+
+## Privilege Escalation
+
+{% content-ref url="../az-privilege-escalation/az-sql-privesc.md" %}
+[az-sql-privesc.md](../az-privilege-escalation/az-sql-privesc.md)
+{% endcontent-ref %}
+
+## Post Exploitation
+
+{% content-ref url="../az-post-exploitation/az-sql-post-exploitation.md" %}
+[az-sql-post-exploitation.md](../az-post-exploitation/az-sql-post-exploitation.md)
+{% endcontent-ref %}
+
+## ToDo
+
+* The rest of the DB here, tables, cassandra, gremlin...
+* Take a look to the post exploitation "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write" && "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/read" and role definitions cause here might be a privesc
+* Take a look to restores
+
+
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
+Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
+
+
+
+Support HackTricks
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** π¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** π¦ [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+
+{% endhint %}
diff --git a/src/pentesting-cloud/azure-security/az-services/az-mysql.md b/src/pentesting-cloud/azure-security/az-services/az-mysql.md
new file mode 100644
index 0000000000..f36154a372
--- /dev/null
+++ b/src/pentesting-cloud/azure-security/az-services/az-mysql.md
@@ -0,0 +1,194 @@
+# Az - MySQL Databases
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
+Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
+
+
+
+Support HackTricks
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** π¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** π¦ [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+
+{% endhint %}
+
+## Azure MySQL
+Azure Database for MySQL is a fully managed relational database service based on the MySQL Community Edition, designed to provide scalability, security, and flexibility for various application needs. It has two different deployment models:
+
+* **Single Server** (is on the retirement path):
+ - Optimized for cost-effective and easy-to-manage MySQL deployments.
+ - Features include automated backups, high availability, and basic monitoring.
+ - Ideal for applications with predictable workloads.
+* **Flexible Server**:
+ - Provides more control over database management and configuration.
+ - Supports high availability (same-zone and zone-redundant).
+ - Features elastic scaling, patch management, and workload optimization.
+ - Offers stop/start functionality for cost savings.
+
+### Key Features
+* **Server Management**: The **ad-admin** feature allows managing Azure Active Directory (AAD) administrators for MySQL servers, providing control over administrative access via AAD credentials, while the **identity** feature enables the assignment and management of Azure Managed Identities, offering secure, credential-free authentication for accessing Azure resources.
+* **Lifecycle Management**: options to start or stop a server, delete a flexible server instance, restart a server to quickly apply configuration changes, and wait to ensure a server meets specific conditions before proceeding with automation scripts.
+* **Security and Networking**: can manage server firewall rules for secure database access and detach virtual network configurations as needed.
+* **Data Protection and Backup**: includes options to manage flexible server backups for data recovery, perform geo-restore to recover a server in a different region, export server backups for external use (in Preview), and restore a server from backup to a specific point in time.
+
+### Enumeration
+
+{% tabs %}
+{% tab title="az cli" %}
+{% code overflow="wrap" %}
+```bash
+# List all flexible-servers
+az mysql flexible-server db list --resource-group
+# List databases in a flexible-server
+az mysql flexible-server db list --resource-group --server-name
+# Show specific details of a MySQL database
+az mysql flexible-server db show --resource-group --server-name --database-name
+
+# List firewall rules of the a server
+az mysql flexible-server firewall-rule list --resource-group --name
+
+# List all ad-admin in a server
+az mysql flexible-server ad-admin list --resource-group --server-name
+# List all user assigned managed identities from the server
+az mysql flexible-server identity list --resource-group --server-name
+
+# List the server backups
+az mysql flexible-server backup list --resource-group --name
+# List all read replicas for a given server
+az mysql flexible-server replica list --resource-group --name
+
+# Get the server's advanced threat protection setting
+az mysql flexible-server advanced-threat-protection-setting show --resource-group --name
+# List all of the maintenances of a flexible server
+az mysql flexible-server maintenance list --resource-group --server-name
+# List log files for a server.
+az mysql flexible-server server-logs list --resource-group --server-name
+
+```
+{% endcode %}
+{% endtab %}
+
+{% tab title="Az PowerShell" %}
+{% code overflow="wrap" %}
+```powershell
+Get-Command -Module Az.MySql
+
+# Get all flexible servers in a resource group
+Get-AzMySqlFlexibleServer -ResourceGroupName
+
+# List databases in a specific flexible server
+Get-AzMySqlFlexibleServerDatabase -ResourceGroupName -ServerName
+
+# Get details of a specific database in a flexible server
+Get-AzMySqlFlexibleServerDatabase -ResourceGroupName -ServerName -DatabaseName
+
+# List all firewall rules for a flexible server
+Get-AzMySqlFlexibleServerFirewallRule -ResourceGroupName -ServerName
+
+# Get the identity information of a flexible server
+Get-AzMySqlFlexibleServerIdentity -ResourceGroupName -ServerName
+
+# Get the server's advanced threat protection setting
+Get-AzMySqlFlexibleServerAdvancedThreatProtection -ResourceGroupName -ServerName
+
+# List configuration settings of a flexible server
+Get-AzMySqlFlexibleServerConfiguration -ResourceGroupName -ServerName
+# Get the connection string for a flexible server
+Get-AzMySqlFlexibleServerConnectionString -ResourceGroupName -ServerName -Client
+
+# List all read replicas for a given server
+Get-AzMySqlFlexibleServerReplica -ResourceGroupName -ServerName
+
+# Get the maintenance window details for a flexible server
+Get-AzMySqlFlexibleServerMaintenanceWindow -ResourceGroupName -ServerName
+
+# List log files for a server
+Get-AzMySqlFlexibleServerLog -ResourceGroupName -ServerName
+```
+{% endcode %}
+{% endtab %}
+{% endtabs %}
+
+### Connection
+
+With the extension rdbms-connect you can access the database with:
+
+{% code overflow="wrap" %}
+```bash
+az mysql flexible-server connect -n -u -p --interactive
+
+#or execute commands
+az mysql flexible-server execute \
+ -n \
+ -u \
+ -p "" \
+ -d \
+ --querytext "SELECT * FROM ;"
+
+```
+{% endcode %}
+
+Or with the MySQL native extension plugin
+{% code overflow="wrap" %}
+```bash
+mysql -h .mysql.database.azure.com -P 3306 -u -p
+```
+{% endcode %}
+
+Also you can execute queries with github but the password and user are also needed. You need to set up a sql file with the query to run and then:
+{% code overflow="wrap" %}
+```bash
+# Setup
+az mysql flexible-server deploy setup \
+ -s \
+ -g \
+ -u \
+ -p "" \
+ --sql-file \
+ --repo \
+ --branch \
+ --action-name \
+ --allow-push
+
+# Run it
+az mysql flexible-server deploy run \
+ --action-name \
+ --branch
+```
+{% endcode %}
+
+## Privilege Escalation
+
+{% content-ref url="../az-privilege-escalation/az-mysql-privesc.md" %}
+[az-mysql-privesc.md](../az-privilege-escalation/az-mysql-privesc.md)
+{% endcontent-ref %}
+
+## Post Exploitation
+
+{% content-ref url="../az-post-exploitation/az-mysql-post-exploitation.md" %}
+[az-sql-mysql-exploitation.md](../az-post-exploitation/az-mysql-post-exploitation.md)
+{% endcontent-ref %}
+
+## ToDo
+
+* Look a way to access with mysql flexible-server ad-admin to verify its a privesc method
+
+
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
+Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
+
+
+
+Support HackTricks
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** π¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** π¦ [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+
+{% endhint %}
diff --git a/src/pentesting-cloud/azure-security/az-services/az-postgresql.md b/src/pentesting-cloud/azure-security/az-services/az-postgresql.md
new file mode 100644
index 0000000000..701ed0bf8d
--- /dev/null
+++ b/src/pentesting-cloud/azure-security/az-services/az-postgresql.md
@@ -0,0 +1,173 @@
+# Az - PostgreSQL Databases
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
+Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
+
+
+
+Support HackTricks
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** π¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** π¦ [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+
+{% endhint %}
+
+## Azure PostgreSQL
+**Azure Database for PostgreSQL** is a fully managed **relational database service based on the PostgreSQL** Community Edition. It is designed to provide scalability, security, and flexibility for diverse application needs. Similar to Azure MySQL, PostgreSQL offers two deployment models:
+
+* **Single Server** (on the retirement path):
+ - Optimized for straightforward, cost-effective PostgreSQL deployments.
+ - Features automated backups, basic monitoring, and high availability.
+ - Ideal for applications with predictable workloads.
+* **Flexible Server**:
+ - Provides greater control over database management and configuration.
+ - Supports high availability, both in the same zone and across zones.
+ - Features elastic scaling, automated maintenance, and cost-saving functionality.
+ - Allows starting and stopping the server to optimize costs.
+
+### Key Features
+
+* **Custom Maintenance Windows**: Schedule updates to minimize disruption.
+* **Active Monitoring**: Access detailed metrics and logs to track and improve database performance.
+* **Stop/Start Server**: Users can stop and start the server.
+* **Automatic Backups**: Built-in daily backups with retention periods configurable up to 35 days.
+* **Role-Based Access**: Control user permissions and administrative access through Azure Active Directory.
+* **Security and Networking**: can manage server firewall rules for secure database access and detach virtual network configurations as needed.
+
+### Enumeration
+
+{% tabs %}
+{% tab title="az cli" %}
+{% code overflow="wrap" %}
+```bash
+# List servers in a resource group
+az postgres flexible-server list --resource-group
+# List databases in a flexible-server
+az postgres flexible-server db list --resource-group --server-name
+# Show specific details of a Postgre database
+az postgres flexible-server db show --resource-group --server-name --database-name
+
+# List firewall rules of the a server
+az postgres flexible-server firewall-rule list --resource-group --name
+# List parameter values for a felxible server
+az postgres flexible-server parameter list --resource-group --server-name
+# List private link
+az postgres flexible-server private-link-resource list --resource-group --server-name
+
+# List all ad-admin in a server
+az postgres flexible-server ad-admin list --resource-group --server-name
+# List all user assigned managed identities from the server
+az postgres flexible-server identity list --resource-group --server-name
+
+# List the server backups
+az postgres flexible-server backup list --resource-group --name
+# List all read replicas for a given server
+az postgres flexible-server replica list --resource-group --name
+# List migrations
+az postgres flexible-server migration list --resource-group --name
+
+# Get the server's advanced threat protection setting
+az postgres flexible-server advanced-threat-protection-setting show --resource-group --name
+# List all of the maintenances of a flexible server
+az postgres flexible-server maintenance list --resource-group --server-name
+# List log files for a server.
+az postgres flexible-server server-logs list --resource-group --server-name
+
+```
+{% endcode %}
+{% endtab %}
+
+{% tab title="Az PowerShell" %}
+{% code overflow="wrap" %}
+```powershell
+Get-Command -Module Az.PostgreSql
+
+# List flexible-servers in a resource group
+Get-AzPostgreSqlFlexibleServer -ResourceGroupName
+# List databases in a flexible-server
+Get-AzPostgreSqlFlexibleServerDatabase -ResourceGroupName -ServerName
+
+# List firewall rules of the a flexible-server
+Get-AzPostgreSqlFlexibleServerFirewallRule -ResourceGroupName -ServerName
+
+# List configuration settings of a flexible server
+Get-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName -ServerName
+# Get the connection string for a flexible server
+Get-AzPostgreSqlFlexibleServerConnectionString -ResourceGroupName -ServerName -Client
+
+Get-AzPostgreSqlFlexibleServerLocationBasedCapability -Location
+
+# List servers in a resource group
+Get-AzPostgreSqlServer -ResourceGroupName
+
+```
+{% endcode %}
+{% endtab %}
+{% endtabs %}
+
+### Connection
+
+With the extension rdbms-connect you can access the database with:
+
+{% code overflow="wrap" %}
+```bash
+az postgres flexible-server connect -n -u -p --interactive
+
+#or execute commands
+az postgres flexible-server execute \
+ -n \
+ -u \
+ -p "" \
+ -d \
+ --querytext "SELECT * FROM ;"
+
+```
+{% endcode %}
+
+Or
+{% code overflow="wrap" %}
+```bash
+psql -h testpostgresserver1994.postgres.database.azure.com -p 5432 -U adminuser
+```
+{% endcode %}
+
+## References
+
+* [https://learn.microsoft.com/en-us/azure/postgresql/](https://learn.microsoft.com/en-us/azure/postgresql/)
+* [https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/service-overview](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/service-overview)
+* [https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/overview](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/overview)
+
+## Privilege Escalation
+
+{% content-ref url="../az-privilege-escalation/az-postgresql-privesc.md" %}
+[az-postgresql-privesc.md](../az-privilege-escalation/az-postgresql-privesc.md)
+{% endcontent-ref %}
+
+## Post Exploitation
+
+{% content-ref url="../az-post-exploitation/az-postgresql-post-exploitation.md" %}
+[az-postgresql-post-exploitation.md](../az-post-exploitation/az-postgresql-post-exploitation.md)
+{% endcontent-ref %}
+
+## ToDo
+
+* Look a way to access with ad-admin to verify its a privesc method
+
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
+Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
+
+
+
+Support HackTricks
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** π¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** π¦ [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+
+{% endhint %}
From d01c2aefe4c211de54524f7f8ced37bc370ea427 Mon Sep 17 00:00:00 2001
From: Jaime Polop <117489620+JaimePolop@users.noreply.github.com>
Date: Fri, 10 Jan 2025 11:02:38 +0100
Subject: [PATCH 2/8] Add files via upload
---
.../az-cosmosDB-post-exploitation.md | 243 ++++++++++++++++++
.../az-mysql-post-exploitation.md | 167 ++++++++++++
.../az-postgresql-post-exploitation.md | 155 +++++++++++
3 files changed, 565 insertions(+)
create mode 100644 src/pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md
create mode 100644 src/pentesting-cloud/azure-security/az-post-exploitation/az-mysql-post-exploitation.md
create mode 100644 src/pentesting-cloud/azure-security/az-post-exploitation/az-postgresql-post-exploitation.md
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md
new file mode 100644
index 0000000000..e2cefc834c
--- /dev/null
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md
@@ -0,0 +1,243 @@
+# Az - CosmosDB Post Exploitation
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
+Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
+
+
+
+Support HackTricks
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** π¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** π¦ [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+
+{% endhint %}
+
+## CosmosDB Post Exploitation
+For more information about SQL Database check:
+
+{% content-ref url="../az-services/az-postgresql.md" %}
+[az-postgresql.md](../az-services/az-postgresql.md)
+{% endcontent-ref %}
+
+
+### "Microsoft.DocumentDB/databaseAccounts/read" && "Microsoft.DocumentDB/databaseAccounts/write"
+With this permission, you can create or update Azure Cosmos DB accounts. This includes modifying account-level settings, adding or removing regions, changing consistency levels, and enabling or disabling features like multi-region writes.
+
+{% code overflow="wrap" %}
+```bash
+az cosmosdb update \
+ --name \
+ --resource-group \
+ --public-network-access ENABLED
+```
+{% endcode %}
+
+### "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/read" && "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/write"
+With this permission, you can create or modify containers (collections) within a SQL database of an Azure Cosmos DB account. Containers are used to store data, and changes to them can impact the database's structure and access patterns.
+
+{% code overflow="wrap" %}
+```bash
+# Create
+az cosmosdb sql container create \
+ --account-name \
+ --resource-group \
+ --database-name \
+ --name \
+ --partition-key-path
+
+#Update
+az cosmosdb sql container update \
+ --account-name \
+ --resource-group \
+ --database-name \
+ --name \
+ --ttl 3600
+```
+{% endcode %}
+
+### "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/write" && "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read"
+With this permission, you can create or modify SQL databases within an Azure Cosmos DB account. This allows for managing the database structure and adding new databases to the account. While this permission enables database creation, improper or unauthorized use could result in unnecessary resource consumption, increased costs, or operational inefficiencies.
+
+{% code overflow="wrap" %}
+```bash
+az cosmosdb sql database create \
+ --account-name \
+ --resource-group \
+ --name
+```
+{% endcode %}
+
+### "Microsoft.DocumentDB/databaseAccounts/failoverPriorityChange/action"
+
+With this permission, you can change the failover priority of regions for an Azure Cosmos DB database account. This action determines the order in which regions become primary during a failover event. Improper use of this permission can disrupt the high availability of the database or lead to unintended operational impacts.
+
+{% code overflow="wrap" %}
+```bash
+az cosmosdb failover-priority-change \
+ --name \
+ --resource-group \
+ --failover-policies
+
+```
+{% endcode %}
+
+### "Microsoft.DocumentDB/databaseAccounts/regenerateKey/action"
+With this permission, you can regenerate the primary or secondary keys for an Azure Cosmos DB account. This is typically used to enhance security by replacing old keys, but it can disrupt access for services or applications that rely on the current keys.
+
+{% code overflow="wrap" %}
+```bash
+az cosmosdb keys regenerate \
+ --name