从 Windows 机器或 Cloudshell 拉取以攻击环境的 Azure 工具集合。
如果你希望通过 powershell 自动拉取所有内容的最新版本，需要安装 Git for Windows。
要拉取所有模块，你可以运行以下命令来拉取子模块：
git clone --recurse-submodules https://github.com/ZephrFish/AzureAttackKit
注意，如果你需要快速获取，这里有一个所有子模块的压缩版本，名为 AZ-AttackKit.zip。
Setup.ps1 包含以下命令，用于安装访问 Azure 及各种相关模块所需的模块。如果脚本被禁用，你可能需要执行 powershell -ep bypass。
Install-Module Az -Force -Confirm:$false -AllowClobber -Scope CurrentUser
Install-Module AzureAD -Force -Confirm:$false -AllowClobber -Scope CurrentUser
Install-Module Microsoft.Graph -Force -Confirm:$false -AllowClobber -Scope CurrentUser
Install-Module MSOnline -Force -Confirm:$false -AllowClobber -Scope CurrentUser
Install-Module AzureADPreview -Force -Confirm:$false -AllowClobber -Scope CurrentUser
Install-Module AADInternals -Force -Confirm:$false -AllowClobber -Scope CurrentUser
Import-Module Az
Import-Module AzureAD
Import-Module AADInternals
Import-Module .\MicroBurst-master\MicroBurst.psm1
Import-Module .\AzureRT-master\AzureRT.ps1
Import-Module .\PowerZure\PowerZure.psm1
Import-Module AADInternals
模块安装完成后，你需要使用以下三个命令连接 Azure 帐户（如果你在 Cloudshell 上，请使用 Connect-AzAccount -UseDeviceAuthentication）：
. .\Setup.ps1
Connect-ADandAZ
如果上述操作失败，请运行以下命令：
Connect-AzAccount
Connect-AzureAD
Connect-MSolService
拉取你有权访问的所有订阅，然后遍历它们，将 Get-ARTAccess（使用 AzureRT）替换为你想要跨订阅运行的任何工具。
$enabledSubs = Get-AzSubscription | Where-Object{$_.State -eq "Enabled"} | select Id
foreach ($SubName in $enabledSubs) {
$IDOut = $SubName.id
Get-ARTAccess -SubscriptionID $IDOut | Out-File "$IDOut.txt"
}
使用 PowerZure 拉取每个订阅的 runbook 内容：
$enabledSubs = Get-AzSubscription | Where-Object{$_.State -eq "Enabled"} | select Id
foreach ($SubName in $enabledSubs) {
$IDOut = $SubName.id
Set-AzContext -Subscription "$IDOut"
Get-AzureRunbookContent -All
}
有关其他快速制胜的方法，请参阅 Commands 文件。工具说明 还提供了一些有用的工具提示，除了本仓库中链接的工具外，还可以查看这些工具。
description = "Azure Service Principal Client Secret"
regex = '''(?i)(secret|key|password)\s*:?=?\s*['\"][0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['\"]'''
[[rules]]
description = "Azure DevOps Personal Access Token"
regex = '''(?i)(pat|token)\s*:?=?\s*['\"](https://github.com/zephrfish/azureattackkit/blob/main/%5Ba-z0-9%5D%7B52%7D)['\"]'''
[[rules]]
description = "Azure Account Key"
regex = '''(?i)(secret|key)\s*:?=?\s*['\"](https://github.com/zephrfish/azureattackkit/blob/main/%5Ba-zA-Z0-9%21%40#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]{88})['\"]'''
tags = ["Azure Storage Account", "Azure Cosmos DB"]
[[rules]]
description = "Azure Storage Connection String"
regex = '''DefaultEndpointsProtocol=https;AccountName=[a-z0-9]{3,24};AccountKey=[a-zA-Z0-9!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]{88};EndpointSuffix=.+'''
[[rules]]
description = "Azure Cosmos DB Connection String"
regex = '''AccountEndpoint=https:\/\/.+:443\/;AccountKey=[a-zA-Z0-9!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]{88};'''
[[rules]]
description = "Generic Secret"
regex = '''(?i)secret\s*:?=?\s*['\"][0-9a-zA-Z-_/]{8,40}['\"]'''
# rules from trufflehog
[[rules]]
description = "Amazon MWS Auth Token"
regex = '''amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'''
[[rules]]
description = "AWS AppSync GraphQL Key"
regex = '''da2-[a-z0-9]{26}'''
[[rules]]
description = "Google OAuth"
regex = '''[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com'''
tags = ["Cloud Platform", "Drive", "Gmail", "YouTube"]
[[rules]]
description = "Google API Key"
regex = '''AIza[0-9A-Za-z\\-_]{35}'''
tags = ["Cloud Platform", "Drive", "Gmail", "YouTube"]
[[rules]]
description = "Google OAuth Access Token"
regex = '''ya29\\.[0-9A-Za-z\\-_]+'''
[[rules]]
description = "MailChimp API Key"
regex = '''[0-9a-f]{32}-us[0-9]{1,2}'''
[[rules]]
description = "Mailgun API Key"
regex = '''key-[0-9a-zA-Z]{32}'''
[[rules]]
description = "Square Access Token"
regex = '''sq0atp-[0-9A-Za-z\\-_]{22}'''
[[rules]]
description = "Square OAuth Secret"
regex = '''sq0csp-[0-9A-Za-z\\-_]{43}'''
[[rules]]
description = "Telegram Bot API Key"
regex = '''[0-9]+:AA[0-9A-Za-z\\-_]{33}'''
用于使用 clientID 和相关凭据信息进行连接的模板
$tenantid = "<INSET TENANT ID>"
$clientid = "<INSERT CLIENT ID/USERNAME>"
$clientsecret = "<INSERT CLIENT SECRET/PASSWORD"
$subscription = "<INSERT SUBCRIPTION>"
$mycred = New-Object System.Management.Automation.PSCredential($clientid,(ConvertTo-SecureString $clientsecret -AsPlainText -Force))
Connect-AzAccount -Credential $mycred -Tenant $tenantid -ServicePrincipal -Subscription $subscription
# Below is if you need to also authenticate to Az as well
az login --service-principal -u $clientid -p $clientsecret --tenant $tenantid