NetSPI Blog

Jake Karnes
March 30th, 2020

Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings

TL;DR If you’re a local admin on an Azure VM, run the Get-AzureVMExtensionSettings script from MicroBurst to decrypt VM extension settings and potentially view sensitive parameters, storage account keys and local Administrator username and password. Overview The Azure infrastructure needs a mechanism to communicate with and control virtual machines. All Azure Marketplace images have the […]

Scott Sutherland
March 27th, 2020

Linux Hacking Case Studies Part 5: Building a Vulnerable Linux Server

This blog will share how to configure your own vulnerable Linux server so you can practice building and breaking at home.

Scott Sutherland
March 26th, 2020

Linux Hacking Case Studies Part 4: Sudo Horror Stories

This blog will cover different ways to approach SSH password guessing and attacking sudo applications to gain a root shell on a Linux system.

Scott Sutherland
March 25th, 2020

Linux Hacking Case Studies Part 3: phpMyAdmin

This blog will walkthrough how to attack insecure phpMyAdmin configurations and world writable files to gain a root shell on a Linux system.

Scott Sutherland
March 24th, 2020

Linux Hacking Case Studies Part 2: NFS

This blog will walk through how to attack insecure NFS exports and setuid configurations in order to gain a root shell on a Linux system.

Scott Sutherland
March 23rd, 2020

Linux Hacking Case Studies Part 1: Rsync

This blog will walk through how to attack insecure Rsync configurations in order to gain a root shell on a Linux system.

Ian Williams
March 18th, 2020

Gaining AWS Console Access via API Keys

For adversarial scenarios, AWS console access is better than the APIs. We’ll walk you through our research process here, and release a new tool we’ve built! When there’s a will… We’re frequently asked by clients to test applications, networks and/or infrastructure hosted on Amazon Web Services (AWS). As a part of these assessments, we’ll oftentimes […]

Karl Fosaaen
February 20th, 2020

Azure Privilege Escalation Using Managed Identities

Azure Managed Identities are Azure AD objects that allow Azure virtual machines to act as users in an Azure subscription. While this may sound like a bad idea, AWS utilizes IAM instance profiles for EC2 and Lambda execution roles to accomplish very similar results, so it’s not an uncommon practice across cloud providers. In my […]

Jake Karnes
February 13th, 2020

Attacking Azure with Custom Script Extensions

PowerShell and Bash scripts are excellent tools for automating simple or repetitive tasks. Azure values this and provides several mechanisms for remotely running scripts and commands in virtual machines (VMs). While there are many practical, safe uses of these Azure features, they can also be used maliciously. In this post we’ll explore how the Custom […]