Abusing Azure Salt Minion Extensions to Execute Commands on Virtual Machines
Summary
A cloud-pentesting walkthrough shows how an attacker with permission to write Azure VM extensions could deploy Salt Minion, connect a VM to a rogue master, and execute commands as root, with guidance on detection and limiting role assignments.
Key points
- An identity with Microsoft.Compute/virtualMachines/extensions/write can deploy a Salt Minion extension configured to connect to an attacker-controlled Salt master.
- After the minion key is accepted, the master can push Salt states or run commands directly on the VM; the demonstration executes commands as root.
- The example state retrieves the VM’s managed identity access token and sends it to an external endpoint.
- The minion connects outbound to the master over ZeroMQ ports 4505 and 4506.
- Monitor Azure Activity Logs for VM extension-write operations, especially installations of the Salt Minion extension.
- On Linux, Salt minion logs, process monitoring, and auditd can help identify commands executed by the service; on Windows, process-event monitoring can show the minion spawning command processes.
- Restrict extension-write permissions, including less-obvious built-in roles with that capability, and apply stronger controls to sensitive VMs.
Article Details
- Topic
- Abusing the Salt Minion Azure VM extension to execute commands as root and exfiltrate a managed identity access token
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//ptmhkh6nu50o5rtsgqkhbu908rei28qx[.]oastify[.]com | Out-of-band interaction endpoint used in the demonstrated payload to receive an exfiltrated managed identity access token. |