Azure Privilege Escalation Using Managed Identities

Shows that Azure subscription Contributors can read and modify other users' Cloud Shell files, downloading EXT2 home directory images to harvest secrets or injecting commands for cross-user execution.

A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.

Shows how Azure's Custom Script Extension and Run Command let a Virtual Machine Contributor run code as LocalSystem on any VM, even with RDP or SSH closed, enabling footholds and escalation.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

Azure pentesting research on Logic Apps: a Reader-role user can dump credentials embedded in Logic App definitions, while a Contributor can identify and abuse API Connection hijack scenarios.

Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.