Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Abusing Azure Hybrid Workers for Privilege Escalation – Part 2: An Azure PrivEsc Story

netspi.com | vulnerability | #cloud | #privilege-escalation | #azure | #rbac | #cloud-pentesting | #automation-accounts | #hybrid-workers

Summary

Discover how an Azure user with the Subscription Reader role can compromise credentials or certificates from Automation Accounts and escalate to a Contributor level role.
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
Abusing Azure Hybrid Workers for Privilege Escalation – Part 1
Azure Hybrid Workers using Automation Account 'Run as' certificates expose Contributor credentials to local admins, enabling privilege escalation from multiple Azure RBAC roles.
blog · netspi.com
Using Azure Automation Accounts to Access Key Vaults
Karl Fosaaen shows how Contributor access to Azure Automation Accounts can be abused by modifying runbooks to dump secrets from Key Vaults, enabling attackers to read vault data without Owner rights.
blog · netspi.com
Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence
Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.
blog · netspi.com
Running PowerShell on Azure VMs at Scale
Karl Fosaaen shows how Azure Contributor rights enable VM command execution as SYSTEM via Invoke-AzureRmVMRunCommand without opening firewall ports, scaling PowerShell across subscription VMs.
blog · netspi.com
Anonymously Enumerating Azure Services
Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.
blog · netspi.com
Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions
Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.
back