azrte-Fudgedotdotdot

src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md

@@ -357,12 +357,40 @@ Then, you can access with these **basic auth credentials to the SCM URL** of you
 curl -u '<username>:<password>' \
     https://<app-name>.scm.azurewebsites.net/api/settings -v
 
-# Deploy code to the funciton
-zip function_app.zip function_app.py # Your code in function_app.py
-curl -u '<username>:<password>' -X POST --data-binary "@<zip_file_path>" \
-    https://<app-name>.scm.azurewebsites.net/api/zipdeploy
 ```
 
+You can download, modify and upload new function code :
+
+
+```bash
+# download
+curl -u '<username>:<password>'  -X GET \
+  https://<app-name>.scm.azurewebsites.net/api/zip/site/wwwroot/ \
+  -o current_function_code.zip
+
+unzip current_function_code.zip -d updated_code/
+cd updated_code/
+#... modify the function code 
+zip -r ../updated_function_app.zip .
+cd ../
+
+# upload
+curl -u '<username>:<password>' https://<app-name>.scm.azurewebsites.net/api/zipdeploy -X POST --data-binary @updated_function_app.zip -v
+```
+
+You can even upload a specific file :
+
+```bash
+curl -u '<username>:<password>' \
+  -X PUT \
+  -H "Content-Type: application/javascript" \
+  -H "If-Match: *" \
+  --data-binary "@./my_local_payload.js" \
+  "https://<app-name>.scm.azurewebsites.net/api/vfs/site/wwwroot/hello-world/index.js" # example NodeJS file
+```
+
+
+
 _Note that the **SCM username** is usually the char "$" followed by the name of the app, so: `$<app-name>`._
 
 You can also access the web page from `https://<app-name>.scm.azurewebsites.net/BasicAuth`