The article explains how Azure VM extension abuse can be used to execute code by deploying the legitimate Salt Minion extension and pointing it to a rogue Salt Master. It shows how an attacker can run commands as root, steal a managed identity token, and evade detection by blending in with normal administrative activity. #SaltMinion #Salt #AzureVM
Keypoints
- Abusing the Salt Minion third-party Azure VM extension can provide arbitrary code execution on Linux and Windows virtual machines.
- The attack requires Microsoft.Compute/virtualMachines/extensions/write permission, which is available to several common and lesser-known Azure roles.
- A rogue Salt Master can accept a minion key and push malicious states or direct commands to the target VM.
- The demonstration shows theft of an Azure Managed Identity access token via the instance metadata service and exfiltration to an out-of-band server.
- On Linux, Salt logs, auditd, and process-tree monitoring can reveal cmd.run execution and root-level child processes spawned by Salt Minion.
- On Windows, process events can show Salt Minion spawning cmd.exe and creating files or running commands.
- Azure Activity Log monitoring for extension write events is a key detection method for this abuse path.
MITRE Techniques
- [T1105] Ingress Tool Transfer – The rogue server setup downloads and installs Salt components needed to stage the malicious master (‘download the salt-master utility’).
- [T1219] Remote Access Software – The attacker abuses the Salt Minion extension and a rogue Salt Master to remotely execute commands on the VM (‘push arbitrary states to the target VM as root’).
- [T1059.004] Command and Scripting Interpreter: Unix Shell – A shell command is executed through Salt state and direct cmd.run execution (‘curl -s … | curl -s -X POST …’ and ‘whoami && id’).
- [T1078.004] Valid Accounts: Cloud Accounts – The attacker uses legitimate Azure permissions and managed identity access to operate through trusted identity and admin pathways (‘An attacker with Microsoft.Compute/virtualMachines/extensions/write could deploy these legitimate extensions’).
- [T1552.005] Unsecured Credentials: Cloud Instance Metadata API – The malicious state queries the Azure instance metadata service to obtain a managed identity token (‘http://169.254.169.254/metadata/identity/oauth2/token’).
- [T1021] Remote Services – The Salt minion connects back to the master over network ports 4505/4506 to receive commands (‘the minion connects outbound to the master over ZeroMQ (4505/4506)’).
- [T1106] Native API – The extension and Salt agent are used as built-in/legitimate mechanisms to execute actions on the VM (‘legitimate third-party extensions’).
Indicators of Compromise
- [Domains ] Exfiltration and OAST callback destination – ptmhkh6nu50o5rtsgqkhbu908rei28qx.oastify.com
- [IP address ] Azure instance metadata service used to retrieve a token – 169.254.169.254
- [File names ] Salt state files used by the attack – netspi.sls, top.sls
- [Azure resource names ] Malicious extension names used during deployment – salt-minion.linux, salt-minion.windows
- [Process/command names ] Commands observed during execution – cmd.run, whoami, id, curl