红蓝攻防
点击放大
AzureRT - AzureRT - A Powershell module implementing various
项目说明
AzureRT
Powershell module implementing cmdlets to interact with Azure and Azure AD from an offensi.
Helpful utilities dealing with access token based authentication, switching from Az to AzureAD and az cli interfaces, easy to use pre-made attacks such as Runbook-based command execution and more.
---
The Most Cmdlets
This toolkit brings lots of cmdlets. This section highlights the most important & useful ones.
Typical Red Team / audit workflow starting with stolen credentials can be summarised as follows:
The below cmdlets are precisely suited to help you follow this sequence:
1. Connect-ART - Offers means to authenticate to Azure - credentials, PSCredential, token
2. Connect-ARTAD - Offers means to authenticate to Azure AD - credentials, PSCredential, token
3. Get-ARTWhoami - When you authenticate - run this to check _whoami_ and your access
4. Get-ARTAccess - Then, when you know you ha - find out what you can do & what's possible by performing Azure situational awareness
5. Get-ARTADAccess - Similarly you can find out what you can do scoped to Azure AD.
---
Use Cases
Cmdlets implemented in this module came helpful in following use & attack scenarios:
Az to AzureAD and back again.Az, AzureAD, Microsoft.Graph and az cli at the same time---
Installation
This module depends on Powershell Az and AzureAD modules pre-installed. Microsoft.Graph and az cli are optional but nonetheless really useful.
Before one starts crafting around Azure, following commands may be used to prepare one's offensi:
E only first two modules are required by AzureRT, its good to ha pre-installed too.
Then to load this module, simply type:
And you're good to go.
Or you can let AzureRT to install and import all the dependencies:
---
Batteries Included
The module will be gradually receiving next tools and utilities, naturally categorised onto subsequent kill chain phases.
Every cmdlet has a nice help message detailing parameters, description and example usage:
Currently, following utilities are included:
Authentication & Token mechanics
Get-ARTWhoami - Displays _and our authentication context on Azure, AzureAD, Microsoft.Graph and on AZ CLI interfaces.Connect-ART - Invokes Connect-AzAccount to authenticate current session to the Azure Portal Access Token or credentials. Skips the burden of pro Tenant ID and Account ID by automatically extracting those from provided Token.Connect-ARTAD - Invokes Connect-AzureAD (and optionally Connect-MgGraph) to authenticate current session to the Azure Acti Access Token or credentials. Skips the burden of pro Tenant ID and Account ID by automatically extracting those from provided Token.Connect-ARTADSer - Invokes Connect-AzAccount to authenticate current session to the Azure Portal Access Token or credentials. Skips the burden of pro Tenant ID and Account ID by automatically extracting those from provided Token. Then it creates self-signed PFX certificate and associates it with Service Principal for authentication. Afterwards, authenticates as that Service Principal to AzureAD and deassociates that certificate to cleanupGet-ARTAccessTokenAzCli - Acquires access token from az cli, via az account get-access-tokenGet-ARTAccessTokenAz - Acquires access token from Az module, via Get-AzAccessToken .Get-ARTAccessTokenAzureAD - Gets an access token from Azure Acti. Authored by Simon Wahlin, Get-ARTAccessTokenAzureADCached - Attempts to retrie cached AzureAD access token (), stored after Connect-AzureAD occurred.Remoy - Performs cleanup actions after running Connect-ARTADSerRecon & Situational Awareness
Get-ARTAccess - Performs Azure Situational Awareness.Get-ARTADAccess - Performs Azure AD Situational Awareness.Get-ARTTenants - List Tenants a for the currently authenticated user (or the one based on supplied Access Token)Get-ARTDangerousPermissions - Analyzes accessible Azure Resources and associated permissions user has on them to find all the Dangerous ones that could be abused by an attacker.Get-ARTResource - Authenticates to the using provided Access Token and pulls accessible resources and permissions that token Owner ha them.Get-ARTRoleAssignment - Displays a bit easier to read representation of assigned Azure RBAC roles to the currently used Principal.Get-ARTADRoleAssignment - Displays Azure AD Role assignments on a current user or on all Azure AD users.Get-ARTADScopedRoleAssignment - Displays Azure AD Scoped Role assignments on a current user or on all Azure AD users, associated with AdministratiGet-ARTRolePermissions - Displays all granted permissions on a specified Azure RBAC role.Get-ARTADRolePermissions - Displays all granted permissions on a specified Azure AD role.Get-ARTADDynamicGroups - Displays Azure AD Dynamic Groups along with their user Membership Rules, members count and current user membership statusGet-ARTApplication - Lists Azure AD Enterprise Applications that current user is owner of (or all existing when -All used) along with their owners and Service PrincipalsGet-ARTApplicationProxy - Lists Azure AD Enterprise Applications that ha Proxy setup.Get-ARTApplicationProxyPrincipals - Displays users and groups assigned to the specified Application Proxy application.Get-ARTStorageAccountKeys - Displays all the a Storage Account keys.Get-ARTKey - Lists all a Azure Key Vault secrets. This cmdlet assumes that requesting user connected to the Azure AD with Key (scoped to ) and has "Key Vault Secrets User" role assigned (or equi).Get-ARTAutomationCredentials - Lists all a Azure Automation Account credentials and attempts to pull their (unable to pull !).Get-ARTAutomationRunbookCode - Invokes REST API method to pull specified Runbook's source code.Get-ARTAz - Retrie IP addressGet-ARTResourceGroupDeploymentTemplate - Displays Resource Group Deployment Template JSON based on input parameters, or pulls all of them at once.Get-ARTAz - Retrie VM User Data from inside of a VM by reaching to Instance Metadata endpoint.Pri Escalation
Add-ARTADGuestUser - Sends Azure AD Guest user in e-mail, allowing to expand access to AAD tenant for the external attacker & returns Invite Redeem URL used to easily accept the in.Set-ARTADUserPassword - Abuses Authentication Administrator Role Assignment to reset other non-admin users password.Add-ARTUserToGroup - Adds a specified Azure AD User to the specified Azure AD Group.Add-ARTUserToRole - Adds a specified Azure AD User to the specified Azure AD Role.Add-ARTADAppSecret - Add client secret to the Azure AD Applications. Authored by Nikhil Mittal, Lateral Mo
Ink - Creates an Automation Runbook under specified Automation Account and against selected Worker Group. That Runbook will contain Powershell commands to be executed on all the affected Azure VMs.In - Abuses /runCommand permission against a specified Azure VM to run custom Powershell command.Update-ARTAz - Modifies Azure VM User Data script through a direct API in.Innsion - Creates new or modifies Azure Script Extension leading to remote code execution.Misc
Get-ARTTenantID - Retrie user's Tenant ID or Tenant ID based on Domain name supplied.Get-ARTPRTToken - Retrie user's PRT (Primary Refresh Token) value using Dirk-Jan Mollema's ROADtokenGet-ARTPRTNonce - Retrie user's PRT (Primary Refresh Token) nonce valueGet-ARTUserId - Acquires current user or user specified in parameter ObjectId via Az moduleGet-ARTSubscriptionId - Helper that collects current Subscription ID.Parse-JWTtokenRT - Parses input JWT token and prints it out nicely.In - Takes Access Token and invokes GET REST method API request against a specified URI. It also whether provided token has required audience set.Import-ARTModules - Installs & Imports required & optional Powershell modules for Azure Red Team acti---
☕ Show Support ☕
This and other projects are outcome of sleepless nights and plenty of hard work. If you like what I do and appreciate that I always give back to the community,
Consider buying me a coffee _(or better a beer)_ just to say thank you! 💪
---
项目信息
开发语言：PowerShell
Star 数：234
技术要点
该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AzureRT - A Powershell module implementing various Azure Red Team tactics展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。
| 资源标题 | AzureRT - AzureRT - A Powershell module implementing various |
| 所属分类 | 红蓝攻防 |
| 发布作者 | admin |
| 发布时间 | 2026-10-06 00:46:13 |
| 下载权限 | 免费下载 |
| 附件数量 | 2 个下载链接 |
| 浏览次数 | 238 |
| 讨论数量 | 0 |
| 主题状态 | 正常讨论中 |