Skip to content

2. Virtual Machine Pivot

Refresh the Cirro collection

Authenticate Cirro with the account that now satisfies the dynamic group rule, then follow the refresh workflow in Using Cirro and CirroDash: collect, inspect the SQLite artifact, copy it to defcon-reader.db, ingest it, and refresh CirroDash.

Use a preconfigured virtual-machine table or the generic CirroDash search card to locate vm-cocoaman-diagnostics. Open the result, inspect its properties, and follow the subscription's management-plane relationships one edge at a time.

Determine the following from the collected resource data:

  1. The virtual machine's public IP address.
  2. The network security group associated with its subnet.
  3. Which inbound rule permits access to the application.
  4. The non-standard TCP port exposed by that rule.

Extend the resource graph

Do not stop at the virtual machine node. Inspect its child resources and configuration, including the VM extension used to deploy the diagnostics application. A VM extension is an ARM child resource, not a data-plane object, but its settings can still reveal relationships to commands, scripts, URLs, storage objects, and execution on the VM.

Also inspect the storage accounts visible to your identity. Identify which data services and child objects the collected evidence exposes, such as blob containers or file shares. You do not need to access unrelated content to complete this exercise.

Add the useful relationships to your investigation notes using explicit verbs, for example:

Virtual Machine --HAS_EXTENSION--> VM Extension
VM Extension --DOWNLOADS--> Script or Blob
Storage Account --CONTAINS--> Container, Share, or File
Configuration --REFERENCES--> Resource or Identity

Resource details extend paths

Parent resources are often only entry points. Child resources, configuration, and data-plane objects explain what the resource contains, executes, references, or can authenticate as.

Investigate the application

Open the application at http://<public-ip>:3434 and examine the network diagnostics feature. Test how the hostname value is processed and determine whether input can change the command executed by the server.

Workshop environment only

Interact only with the virtual machine provisioned for this workshop. Do not reuse these techniques against systems you do not have permission to assess.

Access the managed identity

Use the command-injection flaw to make a request from the virtual machine to Azure Instance Metadata Service. Request an access token for the Azure Resource Manager audience using the virtual machine's system-assigned managed identity.

Keep the token inside your workshop environment. Decode only its claims while investigating; do not paste it into the workshop notes or another external service.

Checkpoint

You have completed this section when you have retrieved a valid access token for the virtual machine's managed identity and can identify the principal represented by that token. Your notes should also include at least one resource-detail relationship that extends beyond a parent ARM resource.