Az - VMs Persistence

Reading time: 2 minutes

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

VMs persistence

For more information about VMs check:

Az - Virtual Machines & Network

Backdoor VM applications, VM Extensions & Images

An attacker identifies applications, extensions or images being frequently used in the Azure account, he could insert his code in VM applications and extensions so every time they get installed the backdoor is executed.

Backdoor Instances

An attacker could get access to the instances and backdoor them:

  • Using a traditional rootkit for example
  • Adding a new public SSH key (check EC2 privesc options)
  • Backdooring the User Data

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks