7 Ways to Execute Command on Azure Virtual Machines & Virtual Machine Scale Sets

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Karl Fosaaen shows how Azure Contributor rights enable VM command execution as SYSTEM via Invoke-AzureRmVMRunCommand without opening firewall ports, scaling PowerShell across subscription VMs.

Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.

Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.

Karl Fosaaen explores anonymous enumeration of Azure blob storage, explaining container access policies and releasing tooling to find publicly exposed blobs holding configs, backups, and credentials.

Scott Sutherland releases SQLC2, a PowerShell PoC using SQL Server, including Azure SQL, as both controller and agent for C2, blending into permitted *.database.windows.net traffic on port 1433.