az-vms-persistence.md

Az - VMs Persistence

{{#include ../../../banners/hacktricks-training.md}}

VMs persistence

For more information about VMs check:

{{#ref}} ../az-services/vms/ {{#endref}}

Backdoor VM applications, VM Extensions & Images

An attacker identifies applications, extensions or images being frequently used in the Azure account, he could insert his code in VM applications and extensions so every time they get installed the backdoor is executed.

Backdoor Instances

An attacker could get access to the instances and backdoor them:

• Using a traditional rootkit for example
• Adding a new public SSH key (check EC2 privesc options)
• Backdooring the User Data

{{#include ../../../banners/hacktricks-training.md}}