Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence

netspi.com | blog | #cloud | #automation | #azure | #credentials | #cloud-pentesting | #persistence | #microburst | #runas-certificates

Summary

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions
Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.
blog · netspi.com
A Beginners Guide to Gathering Azure Passwords
A walkthrough of MicroBurst's Get-AzPasswords, which harvests credentials from Azure Key Vaults, App Services, Automation Accounts, Storage Accounts, and container registries using Az PowerShell.
blog · netspi.com
Anonymously Enumerating Azure Services
Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.
blog · netspi.com
Azure Persistence with Desired State Configurations
Azure pentesting technique: abuse the Desired State Configuration (DSC) VM extension to run arbitrary commands with built-in recurrence, giving Contributor-role attackers stealthy persistence.
blog · netspi.com
Attacking Azure Container Registries with Compromised Credentials
Stolen Azure Container Registry admin credentials enable Docker login, image and tag enumeration via Registry REST APIs, and pulling containers to hunt secrets; MicroBurst's Get-AzACR automates it.
blog · netspi.com
Maintaining Azure Persistence via Automation Accounts
NetSPI shows how attackers can persist in Azure after privilege escalation using Automation Accounts, privileged runbooks, and webhook triggers that restore Owner access with a single POST request.
back