Reviewing the Contributor RBAC role
As we mentioned briefly in the first chapter of this book, the built-in Contributor RBAC role grants full access to manage all resources at the scope of assignment (management group, subscription, or resource group), but it is restricted from assigning permissions to other users or identities.
Given this role's level of access, our focus will not only be on using the permissions but also on how to leverage them to exploit user misconfigurations, with the goals of escalating privileges and moving laterally. We will achieve this by exploiting Azure platform features that can be used to run operating system-level commands/scripts on IaaS workloads such as VMs and virtual machine scale sets (VMSSes).
Important note
For those with more experience in on-premises Windows environments, Contributor access is similar to having a domain account with a local administrator on most of the systems. You have rights to manage infrastructure and make...
