There are two very interesting new cmdlets in this release:
Invoke-AzureVMUserDataCommand and Invoke-AzureVMUserDataAgent.
In this thread I'll offer my thoughts on how these can be used for extremely hard-to-detect #Azure c2:
Invoke-AzureVMUserDataCommand and Invoke-AzureVMUserDataAgent.
In this thread I'll offer my thoughts on how these can be used for extremely hard-to-detect #Azure c2:
https://twitter.com/Haus3c/status/1473332599401631752
This c2 technique is based on Azure IMDS: docs.microsoft.com/en-us/azure/vi….
This service is accessible to every VM in Azure. As far as I know, there's no reason to ever disable this service for a VM, so it should always be accessible to every Azure VM.
This service is accessible to every VM in Azure. As far as I know, there's no reason to ever disable this service for a VM, so it should always be accessible to every Azure VM.
IMDS's REST API is available to each VM at the non-routable, local IP of 169.254.169.254.
In April of this year, Microsoft introduced an IMDS feature called "User Data": azure.microsoft.com/en-us/updates/…
In April of this year, Microsoft introduced an IMDS feature called "User Data": azure.microsoft.com/en-us/updates/…
This feature allows anyone with write access to the VM object to write to a property called userData. This property must be base64 encoded text, limited to 87,384 characters (which is 65 kilobytes plus the base64 overhead).
The VM itself can read this property, but can't write to it by default. With enough privilege you can grant the VM or anyone else write access to the VM object and therefore the userData property.
Ok. Why is this interesting? This is interesting to me because the IMDS API is *always* available to the Azure VM, regardless of whatever firewall rules you have set up for the VM, the VPC, etc.
Even if the VM is "100% isolated", you can still talk to it through this property.
Even if the VM is "100% isolated", you can still talk to it through this property.
The Azure substrate and the various services involved will carry your c2 messages for you regardless of firewall rules. C2 traffic is yellow, authentication traffic is in purple: 
This c2 method might be very difficult to detect if you are only relying on network telemetry, as I don't believe you can get between the Azure VM and IMDS. Maybe yo can set up a "span" port in the VPC to collect this traffic? Not sure. Anyone know?
At the host level, @Haus3c has some good info at the bottom of this post, which covers much of the same stuff I just said in this thread: hausec.com/2021/12/03/abu…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
