Decrypting VM Extension Settings with Azure WireServer

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.

A walkthrough of MicroBurst's Get-AzPasswords, which harvests credentials from Azure Key Vaults, App Services, Automation Accounts, Storage Accounts, and container registries using Az PowerShell.

Stolen Azure Container Registry admin credentials enable Docker login, image and tag enumeration via Registry REST APIs, and pulling containers to hunt secrets; MicroBurst's Get-AzACR automates it.

The Get-AzureVMExtensionSettings PowerShell script decrypts Azure VM extension settings stored on disk, potentially exposing sensitive parameters, storage account keys, and admin credentials.

Shows how Azure's Custom Script Extension and Run Command let a Virtual Machine Contributor run code as LocalSystem on any VM, even with RDP or SSH closed, enabling footholds and escalation.