Storage Accounts Enumeration

Get Storage accounts

az storage account list

az storage container list --account-name $STORAGE_ACCOUNT --auth-mode login

Blob Storage

List containers

az storage container list --account-name $STORAGE_ACCOUNT

Check if public access is allowed

az storage container show-permission \
   --account-name $STORAGE_ACCOUNT \
   -n $CONTAINER_NAME

Make a container public

az storage container set-permission \
--public-access container \
--account-name $STORAGE_ACCOUNT \
-n <container-name>

List blobs in a container

az storage blob list \
   --container-name <container name> \
   --account-name $STORAGE_ACCOUNT

Enum blobs with permissions

az storage blob list \
   --container-name <container name> \
   --account-name $STORAGE_ACCOUNT \
   --auth-mode login

Download blob

az storage blob download \
   --account-name $STORAGE_ACCOUNT \
   --container-name <container name> \
   --name <blob name> \
   --file </path/to/local/file>

Create container policy

az storage container policy create \
  --account-name $STORAGE_ACCOUNT \
  --container-name mycontainer \
  --name fullaccesspolicy \
  --permissions racwdl \
  --start 2023-11-22T00:00Z \
  --expiry 2024-11-22T00:00Z

Access Keys

Enumerate Access Keys

az storage account keys list --account-name $STORAGE_ACCOUNT

Check key policies

az storage account show -n <name> --query "{KeyPolicy:keyPolicy}"

Once having the key, it’s possible to use it with the argument –account-key

### Enum containers with account key

az storage container list \
   --account-name $STORAGE_ACCOUNT \
   --account-key "ZrF40pkVKvWPUr[...]v7LZw=="

Enum blobs with account key

az storage blob list \
   --container-name <container name> \
   --account-name $STORAGE_ACCOUNT \
   --account-key "ZrF40pkVKvWPUr[...]v7LZw=="

Download a file using an account key

az storage blob download \
  --account-name <account name> \
  --account-key "ZrF40pkVKvWPUr[...]v7LZw==" \
  --container-name <container name> \
  --name <blob name> \
  --file </path/to/local/file>

Upload a file using an account key

az storage blob upload \
  --account-name <account name> \
  --account-key "ZrF40pkVKvWPUr[...]v7LZw==" \
  --container-name <container name> \
  --file </path/to/local/file>

SAS

List access policies

az storage <container|queue|share|table> policy list \
  --account-name $STORAGE_ACCOUNT \
  --container-name <container name>

Generate SAS with all permissions using an access key

az storage <container|queue|share|table|blob> generate-sas \
  --permissions acdefilmrtwxy \
  --expiry 2024-12-31T23:59:00Z \
  --account-name $STORAGE_ACCOUNT \
  -n <container-name>

Generate SAS with all permissions using via user delegation

az storage <container|queue|share|table|blob> generate-sas \
  --permissions acdefilmrtwxy \
  --expiry 2024-12-31T23:59:00Z \
  --account-name $STORAGE_ACCOUNT \
  --as-user --auth-mode login \
  -n <container-name>

Generate account SAS

az storage account generate-sas \
--expiry 2024-12-31T23:59:00Z \
--account-name $STORAGE_ACCOUNT \
--services qt \
--resource-types sco \
--permissions acdfilrtuwxy

Use the returned SAS key with the param –sas-token

az storage blob show \
  --account-name $STORAGE_ACCOUNT \
  --container-name <container name> \
  --sas-token 'se=2024-12-31T23%3A59%3A00Z&sp=racwdxyltfmei&sv=2022-11-02&sr=c&sig=ym%2Bu%2BQp5qqrPotIK5/rrm7EMMxZRwF/hMWLfK1VWy6E%3D' \
  --name 'asd.txt'

Enum users

List users

az storage account local-user list \
  --account-name $STORAGE_ACCOUNT \
  --resource-group $RESOURCE_GROUP

Get user

az storage account local-user show \
  --account-name <storage-account-name> \
  --resource-group <resource-group-name> \
  --name <local-user-name>

List keys

az storage account local-user list \
  --account-name <storage-account-name> \
  --resource-group <resource-group-name>