Question

During a cloud penetration test, you gain remote code execution on an Azure Linux VM through a vulnerable web application. You confirm the VM has a system-assigned managed identity attached. Your goal is to leverage this identity to move laterally and access other Azure resources. What is the MOST effective next step?

Accepted Answer

Query the Azure Instance Metadata Service endpoint at 169.254.169.254 to request an OAuth access token for the managed identity, then use it against the Azure Resource Manager API

Answer

Extract the VM's local Administrator NTLM hash from the SAM database and attempt pass-the-hash against the Azure AD tenant

Answer

Run a Kerberoasting attack against the Azure AD service principals to obtain crackable ticket hashes

Answer

Dump the /etc/shadow file and crack the root password to authenticate directly to the Azure portal