Attacking Azure Container Registries with Compromised Credentials

A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.

A walkthrough of MicroBurst's Get-AzPasswords, which harvests credentials from Azure Key Vaults, App Services, Automation Accounts, Storage Accounts, and container registries using Az PowerShell.

The Get-AzureVMExtensionSettings PowerShell script decrypts Azure VM extension settings stored on disk, potentially exposing sensitive parameters, storage account keys, and admin credentials.

Converts compromised AWS API keys, whether permanent AKIA or temporary ASIA credentials, into browser console access via the federation endpoint, easing recon compared with wrangling CLI syntax.