Hacking Articles Tips Tricks Videos Tutorials

cription and example usage: PS C:\> Get-Help Connect-ART Currently, following utilities are included: Authentication & Token mechanics* Get-ARTWhoami- Displays and validates our authentication context on Azure, AzureAD, Microsoft.Graphand on AZ CLIinterfaces.…

igned to the specified Application Proxy application.

* Get-ARTStorageAccountKeys- Displays all the available Storage Account keys.

* Get-ARTKeyVaultSecrets- Lists all available Azure Key Vault secrets. This cmdlet assumes that requesting user connected to the Azure AD with KeyVaultAccessToken (scoped to https://vault.azure.net) and has "Key Vault Secrets User" role assigned (or equivalent).

* Get-ARTAutomationCredentials- Lists all available Azure Automation Account credentials and attempts to pull their values (unable to pull values!).

* Get-ARTAutomationRunbookCode- Invokes REST API method to pull specified Runbook's source code.

* Get-ARTAzVMPublicIP- Retrieves Azure VM Public IP address

* Get-ARTResourceGroupDeploymentTemplate- Displays Resource Group Deployment Template JSON based on input parameters, or pulls all of them at once.

* Get-ARTAzVMUserDataFromInside- Retrieves Azure VM User Data from inside of a VM by reaching to Instance Metadata endpoint. Privilege Escalation* Add-ARTADGuestUser- Sends Azure AD Guest user invitation e-mail, allowing to expand access to AAD tenant for the external attacker & returns Invite Redeem URL used to easily accept the invitation.

* Set-ARTADUserPassword- Abuses Authentication AdministratorRole Assignment to reset other non-admin users password.

* Add-ARTUserToGroup- Adds a specified Azure AD User to the specified Azure AD Group.

* Add-ARTUserToRole- Adds a specified Azure AD User to the specified Azure AD Role.

* Add-ARTADAppSecret- Add client secret to the Azure AD Applications. Authored by Nikhil Mittal, @nikhil_mitt Lateral Movement* Invoke-ARTAutomationRunbook- Creates an Automation Runbook under specified Automation Account and against selected Worker Group. That Runbook will contain Powershell commands to be executed on all the affected Azure VMs.

* Invoke-ARTRunCommand- Abuses virtualMachines/runCommandpermission against a specified Azure VM to run custom Powershell command.

* Update-ARTAzVMUserData- Modifies Azure VM User Data script through a direct API invocation.

* Invoke-ARTCustomScriptExtension- Creates new or modifies Azure VM Custom Script Extension leading to remote code execution. Misc* Get-ARTTenantID- Retrieves Current user's Tenant ID or Tenant ID based on Domain name supplied.

* Get-ARTPRTToken- Retrieves Current user's PRT (Primary Refresh Token) value using Dirk-Jan Mollema's ROADtoken

* Get-ARTPRTNonce- Retrieves Current user's PRT (Primary Refresh Token) nonce value

* Get-ARTUserId- Acquires current user or user specified in parameter ObjectId via Azmodule

* Get-ARTSubscriptionId- Helper that collects current Subscription ID.

* Parse-JWTtokenRT- Parses input JWT token and prints it out nicely.

* Invoke-ARTGETRequest- Takes Access Token and invokes GET REST method API request against a specified URI. It also verifies whether provided token has required audience set.

* Import-ARTModules- Installs & Imports required & optional Powershell modules for Azure Red Team activities Show SupportThis and other projects are outcome of sleepless nights and plenty of hard work. If you like what I do and appreciate that I always give back to the community, Consider buying me a coffee (or better a beer) just to say thank you!

