Azure arc module

[Vladifidchuk18]

New AzureArc Module

Description

Enumerates Azure Arc presence on Windows targets and, when present, retrieves a Managed Identity access token from the local Arc IMDS endpoint using the documented 401 challenge → .key file → second request flow.

• Protocol: SMB (requires local administrator privileges)
• Primary use case: Rapidly map Arc deployment and obtain a cloud-scoped token for Azure control-plane enumeration during red team engagements.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Setup guide for the review

actually just add the new module file at:
nxc/modules/azurearc.py

Screenshots (if appropriate):

Tested locally and remotely as well:
<img width="1201" height="450" alt="2025-10-05_16h20_40" src="https://github.com/user-attachments/assets/3210f986-bd19-45bd-

bbad-5f68fc3d7e85" />

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

• I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• New and existing e2e tests pass locally with my changes
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[NeffIsBack]

Thanks for the PR! Very interesting!

Can you add a guide for setting up the machine to test the module on? To be specific, it helps a lot if there is some kind of guide what i have to install etc. so that necessary services/files etc are available so the module actually does something.

[Vladifidchuk18]

Of course, for the service to run properly, you’ll need to run a PowerShell script provided by Azure when onboarding your machine (it must be an on-premises machine, not an Azure VM) to your tenant in Azure.
To do this, follow these steps:

1. Search for 'Azure Arc' in the searching bar in Azure Portal

2. Add a machine

3. Add a single server

4. Fill in the details of the resource group where the deployed machine will be located, then click “Download and run script"

5. Download/Copy the content of the provided "OnboardingScript.ps1" script:

6. Run the script in PowerShell with local administrator permissions. During the installation, an agent package will be downloaded and installed from Azure.com. You’ll then be prompted to authenticate at login.microsoftonline.com using an Azure account with the appropriate permissions to perform this action:

7. Once the machine successfully added, you can run the new NetExec AzureArc Module

[NeffIsBack]

Thanks for the detailed explanation! I'll test it when i have the time.