This post investigates how Azure manages its blob storage, and how to create manage and list blob containers and attempt file enumeration and retrieval.
Like Google Storage, Azure Blobs are secure by default; a container and any blobs within it may only be accessed by the owner of the storage account. To give anonymous users read permissions to a container and its blobs, you can set the container permissions to allow public access. Anonymous users can read blobs within a publicly accessible container without authenticating the request.
You can configure a container with the following permissions:
- No public read access: The container and its blobs are private and can only be accessed by the storage account owner. This is the default for all new containers.
- Public read access for blobs only: Blobs within the container can be read by any anonymous Internet user. But container data is not available. Anonymous clients cannot enumerate the blobs within the container.
- Full public read access: All container and blob data can be read by anonymous Internet user. Clients can enumerate blobs within the container by anonymous request, but cannot enumerate containers within the storage account.
Creating a Blob Storage Area
First create a storage account:
Next Choose an appropriate Container
Using Azure Powershell
List Storage Accounts
> Get-AzureRMStorageAccount | Select StorageAccountName, Location
There are additional StorageAccounts depicted, first is for a web-shell interface in Azure, the last one is to gather diagnostics from a test virtual machine.
Using an existing Storage Account
> $resourceGroup = “test” > $storageAccountName = “netscyllatest” > $storageAccount = Get-AzureRmStorageAccount -ResourceGroupName $resourceGroup -Name $storageAccountName
Delete a Storage Account
> Remove-AzureRmStorageAccount -ResourceGroup $resourceGroup -AccountName $storageAccountName
List Blobs in a Container
Or list files (blobs) within a container
> $ctx = storageAccount.Context >Get-AzureStorageBlob -Container $ContainerName -Context $ctx | select Name
Above you can see three containers:
test-blob = public blobs, private container test-cont = public blobs, public container * test-priv = private blobs, private container *=container data should be available but cannot be enumerated.
Test private blob access
To verify that you have no access to the blobs in that container, construct the URL to one of the blobs without a shared access signature and try to view the blob. Using the HTTPS protocol, the URL will be in the following format:
Attacking Azure blob containers is much more difficult than attacking AWS S3, and Google Storage as containers are not easily enumerated. Also to succeed in an attack; the attacker needs to know the specific name of the blob stored in the container.