# Abusing Azure Hybrid Workers for Privilege Escalation – Part 2: An Azure PrivSec Story

Azure Automation Reader role could read AA keys, letting an attacker register their own VM as a Hybrid Worker and dump stored credentials/certificates for Contributor escalation.

- Payout: $10,000
- Severity: high
- Program: Microsoft
- Credited: Josh Magri
- Disclosed: 2022-04-14
- Write-up quality: 7/10
- Original: https://www.netspi.com/blog/technical/cloud-penetration-testing/abusing-azure-hybrid-workers-part-2/
- Library page: https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2
- Tags: domain:cloud impact:data-leak impact:privesc kind:bounty platform:blog sev:high tech:azure technique:chained technique:reverse-engineering technique:source-review vuln:access-control vuln:secrets-leak

**Target:** Azure Automation Account / Hybrid Worker Group JRDS endpoints
**Root cause:** The Reader role retained ListKeys on Automation Accounts, and the AA key alone was sufficient to register an arbitrary Hybrid Worker node that could then poll JRDS endpoints for credentials and certificates.
**Steps:**
1. As Reader, read the victim Automation Account key via ListKeys.
2. Generate a self-signed certificate; build a registration payload with HWG name, IP, cert thumbprint.
3. Sign the payload with the AA key and `PUT` it to the AA to register an attacker-controlled VM as a Hybrid Worker node (arbitrary group name auto-created).
4. Poll the JRDS `/sandboxes` endpoint to grab jobs and obtain MSISecret / MI tokens.
5. Request credential and certificate endpoints on JRDS using the node's JWT to dump stored secrets.
**How found:** Started from a registered Hybrid Worker node, inspected the Orchestrator.Sandbox command line and JRDS URL, reversed the binary to find MSISecret/token request paths, then grepped decompiled binary for other credential endpoints; later reused Microsoft DSC registration scripts to register a rogue node using only the AA key.
**Exploitation:** Attacker with only Reader reads the AA key, registers their own VM in their own tenant as a Hybrid Worker, then polls JRDS to retrieve MSI tokens, credentials, and Run As certificates, authenticating as the victim's Service Principal for Contributor-level access.
**Escalation:** Chained key-read (Reader) with HWG registration to reach credential/certificate dump, escalating Reader to Subscription Contributor when Run As accounts were used.
**Insight:** Low-privilege roles like Reader can retain ListKeys on resources whose keys are themselves authentication material; check whether any key readable at Reader grants node/agent registration that unlocks a credential-retrieval API.