Exploiting Azure platform features with Contributor rights
With access to the Contributor role, we have a rich set of platform-level features that we can use to manage VMs in the environment. Since we are approaching these features as penetration testers, our use cases for these features may be slightly different than your average user.
Exploiting the password reset feature
The password reset feature for Azure VMs was intended to simplify the process of resetting the password of a local Azure VM user, using the VM agent that is installed on every Azure VM. However, this feature could be abused to create new local users with administrative privileges on both Windows and Linux VMs in Azure!
This feature can be used from the Azure portal (Figure 5.6) or from Azure command-line tools. Exploit tools such as Lava can also leverage this feature to reset VM passwords at scale. This feature can be utilized by a pentester to move laterally from the Azure platform to IaaS workloads...
