Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Azure Privilege Escalation via Cloud Shell

netspi.com | vulnerability | #cloud | #cloud-security | #privilege-escalation | #azure | #pentest | #storage | #cloud-shell

Summary

Shows that Azure subscription Contributors can read and modify other users' Cloud Shell files, downloading EXT2 home directory images to harvest secrets or injecting commands for cross-user execution.
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
Azure Privilege Escalation Using Managed Identities
Shows how Azure VM managed identities with excessive permissions enable privilege escalation: anyone with command execution on a VM can request its token and act with the identity's assigned roles.
blog · netspi.com
Gathering Bearer Tokens from Azure Services
A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.
blog · netspi.com
Attacking Azure with Custom Script Extensions
Shows how Azure's Custom Script Extension and Run Command let a Virtual Machine Contributor run code as LocalSystem on any VM, even with RDP or SSH closed, enabling footholds and escalation.
blog · netspi.com
Utilizing Azure Services for Red Team Engagements
Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.
blog · netspi.com
Illogical Apps – Exploring and Exploiting Azure Logic Apps
Azure pentesting research on Logic Apps: a Reader-role user can dump credentials embedded in Logic App definitions, while a Contributor can identify and abuse API Connection hijack scenarios.
blog · netspi.com
Overcome Cloud Security Challenges with Purpose-Built Cloud Penetration Testing
Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.
back