NetSPI Blog

Karl Fosaaen
February 20th, 2020

Azure Privilege Escalation Using Managed Identities

Azure Managed Identities are Azure AD objects that allow Azure virtual machines to act as users in an Azure subscription. While this may sound like a bad idea, AWS utilizes IAM instance profiles for EC2 and Lambda execution roles to accomplish very similar results, so it’s not an uncommon practice across cloud providers. In my […]

Jake Karnes
February 13th, 2020

Attacking Azure with Custom Script Extensions

PowerShell and Bash scripts are excellent tools for automating simple or repetitive tasks. Azure values this and provides several mechanisms for remotely running scripts and commands in virtual machines (VMs). While there are many practical, safe uses of these Azure features, they can also be used maliciously. In this post we’ll explore how the Custom […]

Karl Fosaaen
December 10th, 2019

Azure Privilege Escalation via Cloud Shell

TLDR; By default, Azure Subscription Contributors have access to all storage accounts in a subscription. These storage accounts can contain Azure Cloud Shell storage files (Linux home directories) that can contain sensitive information. By modifying these Cloud Shell files, an attacker can execute commands in the Cloud Shell sessions of other users. This can lead […]

Scott Sutherland
November 18th, 2019

Analyzing DNS TXT Records to Fingerprint Online Service Providers

In this blog I’ll share a process/script that can be used to identify online service providers used by a target company through domain validation tokens stored in DNS TXT records.

Scott Sutherland
November 11th, 2019

Exploiting SQL Server Global Temporary Table Race Conditions

This blog will walk through how to find and exploit SQL Server global temporary table race conditions to gain unauthorized access to data and execute code.

Karl Fosaaen
September 12th, 2019

Maintaining Azure Persistence via Automation Accounts

In every penetration test that involves Azure, we want to escalate our privileges up to a global administrator of the tenant. Once we’ve escalated our privileges in an Azure tenant, we want to have the ability to maintain our access to each subscription and the tenant as a whole. Aside from the benefits of controlling […]

Kevin Robertson
August 29th, 2019

MachineAccountQuota Transitive Quota: 110 Accounts and Beyond

Background If you aren’t familiar with MachineAccountQuota (MAQ), I recommend skimming my previous blog post on the subject. TLDR Active Directory (AD) tracks transitive accounts created through MAQ to limit the number of accounts that can be added from a single unprivileged source account. AD calculates the maximum using a formula of Q * (Q […]

Josh Weber
July 9th, 2019

Collecting Contacts from

For our client engagements, we are constantly searching for new methods of open source intelligence (OSINT) gathering. This post will specifically focus on targeting client contact collection from a site we have found to be very useful ( and will describe some of the hurdles we needed to overcome to write automation around site scraping. […]