云Azure

NoorQureshi2026-10-25查看 888复制 1877

> 攻击Azure / Entra ID——托管身份令牌窃取、Entra（Azure AD）角色滥用以及应用/存储配置错误。当目标在Azure上、你持有Azure凭据/令牌，或看到Entra/AAD/azurewebsites/blob.core.windows.net时加载。信号：169.254.169.254 IMDS、托管身份、az cli、Entra角色、服务主体。

Download (.md)

📘如何使用这个技能

1
复制技能内容·点击上方「Copy SKILL.md」复制全部内容，或 Download 下载到本地
2
打开你的 AI 客户端·支持 Claude Code、Trae、Cursor、ChatGPT、DeepSeek、Kimi 等任意 AI 助手
3
粘贴为系统提示/知识文件·Claude Code：放入 .claude/skills/ 目录；普通对话：作为首条消息发送并说「请严格按这份技能文档执行」
4
直接提出你的需求·AI 会按技能定义的工作流、格式和约束来处理，无需再解释背景

💡 提示：技能生效后，每次对话只需一句需求，AI 会按 SKILL.md 的流程执行。

SKILL.md2914 chars

---
name: cloud-azure
description: >
  Attack Azure / Entra ID — managed-identity token theft, Entra (Azure AD) role abuse, and app/
  storage misconfig. Load when the target is on Azure, you hold Azure creds/a token, or see
  Entra/AAD/azurewebsites/blob.core.windows.net. Signals: 169.254.169.254 IMDS, Managed Identity,
  az cli, Entra roles, service principals.
domain: cloud
type: technique
stability: learning
modes: [pentest, bugbounty]
severity: critical
owasp: [A01:2021-Broken-Access-Control, A05:2021-Security-Misconfiguration]
cwe: [CWE-269, CWE-732]
mitre: [T1078.004, T1552.005]
tools: [az, AzureHound, ScoutSuite, MicroBurst]
schema_version: 1
---

# Azure / Entra ID attacks

## When it applies
Target on Azure and you have some access — SSRF into a VM/App Service with a **Managed Identity**,
a leaked service-principal secret/cert, or a foothold. Goal: steal tokens, abuse Entra roles, reach resources.

## Why it works
Azure resources authenticate via **Managed Identities** and **service principals**; the IMDS hands
out OAuth tokens for them. Entra (Azure AD) roles and app permissions are widely over-assigned, and
several (adding credentials to a service principal, role assignment, Owner on a subscription) escalate to control.

## Method
1. **Managed Identity → token** (via SSRF, or on the host): `GET http://169.254.169.254/metadata/identity/
   oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/` with header
   `Metadata: true` (→ `cloud-imds-ssrf`). Also request tokens for Graph, Key Vault, Storage.
2. **Authenticate & enumerate**: `az login` with the SP or token; enumerate roles/resources; map
   Entra with **AzureHound** (BloodHound for Azure); ScoutSuite/MicroBurst for misconfig.
3. **Entra / IAM privesc**: add credentials to a service principal you can manage → auth as it;
   abusive Entra roles (Application/Cloud App Admin, Privileged Role Admin); role assignment
   (`Microsoft.Authorization/roleAssignments/write`) → grant yourself Owner; consent grants.
4. **Resources & secrets**: Key Vault (token for `vault.azure.net`), Storage blobs
   (→ storage misconfig), Automation Accounts / runbooks (RCE as their identity), App Service.
5. **Prove impact** read-only as the escalated principal; avoid persistent role changes.

## Gotchas
- Two planes: **ARM** (resources) and **Microsoft Graph / Entra** (identity) — get tokens for the right `resource`/audience.
- Managed-identity SSRF needs the `Metadata: true` header — header-less SSRF won't work (that's the mitigation).
- AzureHound reveals Entra attack paths you'd miss manually — run it early.

## Verify success
Escalated access proven — a token/role letting you act beyond your start (Key Vault secret read,
subscription role you granted, resource action as a managed identity).

## References
Azure IMDS & Managed Identity docs; AzureHound/BloodHound; MicroBurst; Entra privesc research.

来源：skillsdirectory

云Azure

📘如何使用这个技能

评论0