Attacking Azure with Custom Script Extensions

A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.

The Get-AzureVMExtensionSettings PowerShell script decrypts Azure VM extension settings stored on disk, potentially exposing sensitive parameters, storage account keys, and admin credentials.

Karl Fosaaen shows how Azure Contributor rights enable VM command execution as SYSTEM via Invoke-AzureRmVMRunCommand without opening firewall ports, scaling PowerShell across subscription VMs.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

Shows how Azure VM managed identities with excessive permissions enable privilege escalation: anyone with command execution on a VM can request its token and act with the identity's assigned roles.

Shows that Azure subscription Contributors can read and modify other users' Cloud Shell files, downloading EXT2 home directory images to harvest secrets or injecting commands for cross-user execution.