Leveraging web apps for lateral movement and escalation
Azure web apps are commonly used in subscriptions to host web applications and APIs. While we have previously mentioned abusing managed identities, we have not covered how the applications are typically managed.
Application code can be applied to App Service hosts in multiple different ways. The Deployment Center can integrate with a number of different code repository solutions to synchronize with CI/CD pipelines, or code can be pushed through manual deployments.
Figure 6.48 – App Service Deployment Center
Application code can be manually copied to systems by using credentials stored in the publish profile. This profile contains the following credential options:
- Web Deploy
- FTP
- ReadOnly FTP
- Zip Deploy
- Database Connection Strings
As an attacker with the Contributor role on the App Service application, we can access this publish profile to gain access to the credentials...
