ADOKit

Description

Azure DevOps Services Attack Toolkit - ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials (API key or stolen authentication cookie) for the respective Azure DevOps Services instance. The attack modules supported include reconnaissance, privilege escalation and persistence. ADOKit was built in a modular approach, so that new modules can be added in the future by the information security community.

Full details on the techniques used by ADOKit are in the X-Force Red whitepaper.

Black Hat USA Arsenal 2024

Presentation slides and demos are included in BHUSA Arsenal 2024 folder in this repository.

Release

• Version 1.4.1 of ADOKit can be found in Releases

Table of Contents

• ADOKit
• Table of Contents
• Installation/Building
  • Libraries Used
  • Pre-Compiled
  • Building Yourself
• Command Modules
• Arguments/Options
• Authentication Options
• Module Details Table
• Examples
  • Recon
    • Validate Azure DevOps Access
    • Whoami
    • List Orgs
    • List Repos
    • Search Repos
    • List Projects
    • Search Projects
    • Search Code
    • Search Files
    • List Users
    • Search User
    • List Teams
    • Search Team
    • Get Team Members
    • List Groups
    • Search Groups
    • Get Group Members
    • Get Project Permissions
    • Creds Search
    • Get Build Logs
    • List Build Logs
    • Search Build Logs
  • Persistence
    • Create PAT
    • List PATs
    • Remove PAT
    • Create SSH Key
    • List SSH Keys
    • Remove SSH Key
  • Privilege Escalation
    • Add Project Admin
    • Remove Project Admin
    • Add Build Admin
    • Remove Build Admin
    • Add Collection Admin
    • Remove Collection Admin
    • Add Collection Build Admin
    • Remove Collection Build Admin
    • Add Collection Build Service Account
    • Remove Collection Build Service Account
    • Add Collection Service Account
    • Remove Collection Service Account
    • Get Pipeline Variables
    • Get Pipeline Secrets
    • Get Variable Groups
    • Get Service Connections
• Detection
• Roadmap
• References

Installation/Building

Libraries Used

The below 3rd party libraries are used in this project.

Library	URL	License
Fody	https://github.com/Fody/Fody	MIT License
Newtonsoft.Json	https://github.com/JamesNK/Newtonsoft.Json	MIT License

Pre-Compiled

• Use the pre-compiled binary in Releases

Building Yourself

Take the below steps to setup Visual Studio in order to compile the project yourself. This requires two .NET libraries that can be installed from the NuGet package manager.

• Load the Visual Studio project up and go to "Tools" --> "NuGet Package Manager" --> "Package Manager Settings"
• Go to "NuGet Package Manager" --> "Package Sources"
• Add a package source with the URL https://api.nuget.org/v3/index.json
• Install the Costura.Fody NuGet package.
  • Install-Package Costura.Fody -Version 3.3.3
• Install the Newtonsoft.Json package
  • Install-Package Newtonsoft.Json
• You can now build the project yourself!

Command Modules