凸面 - CONVEX是一组独立的CTF ，

项目说明

CONVEX

Cloud Open-source Network Exploitation eXperience (CONVEX) spins up Capture The Flag en in your Azure tenant for participants to play through. The CTFs themselves are organized into independent modules that contain a create and teardown script to setup the en programmatically. Modules also include a walkthough for each module, in case participants get stuck.

---

Getting Started

Identities In

There are two identities to keep in mind when deploying, the administrator and the participant(s).

- The administrator identity is the one running convex.ps1 and deploying the modules. They must ha permissions to create resources, groups, users, and service principals. The administrator is also responsible for giving participants their login credentials.
- The participant(s) identities are the ones playing the CTFs. They ha identites pro to them by the administrator.

Prerequisites

#### For Administrators

The installation and running should be done with PowerShell running as Administrator. In addition, in order to run the script, the ExecutionPolicy must be set to Unrestricted. To change this, you can run this command

Azure PowerShell modules installed. It is important to ha and not AzureRM or both because AzureRM creates conflicts with the new Azure PowerShell Module.

Azure Acti Module installed.

Azure CLI installed.

Azure Function Core Tools installed

- This installation can be completed in two steps from PowerShell, first installing Chocolatey and then Azure Function Core Tools through Chocolatey. These installations must be done from an *administrati*.

- An empty Azure tenant with at least two subscriptions. Do NOT run CTF exercises in a production en. Modules use start and end subscriptions, where start refers to where participants begin and end refers to where the flag is located.

#### For Participants

Stormspotter installed. Stormspotter is an open-source tool from Azure Red Team used to create an attack graph of Azure subscriptions.

Postman installed. Postman is a free API de tool that lets you easily craft HTTP requests. This is useful when using REST API is simpler than PowerShell.

## Running CONVEX
1. Clone the CONVEX Repo

2. Run convex.ps1

- The script will begin by having you sign in to the Azure and AzureAD PowerShell modules as well as Azure CLI. It is important to sign in with the same identity and that the identity has the appropriate levels of access.
- convex.ps1 handles both creating and tearing down the modules, it is the only script you as a user need to call. It will create/teardown all a modules.
- The amount of users that are created is per module. I.e. inputting 5 users and creating modules 1, 2, and 3 simultaneously will create 15 users, 5 for each module.

3. Allow the resources to deploy.

## Playing the CTFs
### Administrators
Administrators will have the responsibility of giving participants their participant account and password. The username can be found either in Azure Acti or in the User Key Vault found in the Resource Group of the starting subscription for each module. The User Key Vault also contains the user's password.

### Participants
Participants will recei username and password from the administrator. They can then log on to the Azure portal with those credentials to enter the CTF en and begin.

## Notes
Tearing down a module will delete the en as well as removing the participant accounts and that module's specific security group from the Azure tenant.

---

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
the rights to use your contribution. For details, visit

When you submit a pull request, a CLA bot will automatically determine whether you need to provide
a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct.
For more information see the Code of Conduct FAQ or
contact with any additional questions or comments.

项目信息

开发语言：PowerShell

Star 数：139

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CONVEX is a group of CTFs that are independently deployable into participant Azure environments.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。