Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

A walkthrough of MicroBurst's Get-AzPasswords, which harvests credentials from Azure Key Vaults, App Services, Automation Accounts, Storage Accounts, and container registries using Az PowerShell.

Karl Fosaaen shows how Contributor access to Azure Automation Accounts can be abused by modifying runbooks to dump secrets from Key Vaults, enabling attackers to read vault data without Owner rights.

Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.

From command execution on an Azure App Services host, attackers can inspect the environment, reach storage and Azure SQL, and abuse Managed Identity tokens to access Key Vaults and escalate.

Stolen Azure Container Registry admin credentials enable Docker login, image and tag enumeration via Registry REST APIs, and pulling containers to hunt secrets; MicroBurst's Get-AzACR automates it.