ADOKit: Azure DevOps Services Attack Toolkit

by ddos · February 25, 2025

ADOKit

Azure DevOps Services Attack Toolkit – ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials (API key or stolen authentication cookie) for the respective Azure DevOps Services instance. The attack modules supported include reconnaissance, privilege escalation, and persistence. ADOKit was built in a modular approach so that new modules can be added in the future by the information security community.

Full details on the techniques used by ADOKit are in the X-Force Red whitepaper.

Command Modules

Recon
- check – Check whether organization uses Azure DevOps and if credentials are valid
- whoami – List the current user and its group memberships
- listrepo – List all repositories
- searchrepo – Search for given repository
- listproject – List all projects
- searchproject – Search for given project
- searchcode – Search for code containing a search term
- searchfile – Search for file based on a search term
- listuser – List users
- searchuser – Search for a given user
- listgroup – List groups
- searchgroup – Search for a given group
- getgroupmembers – List all group members for a given group
- getpermissions – Get the permissions for who has access to a given project
Persistence
- createpat – Create personal access token for user
- listpat – List personal access tokens for user
- removepat – Remove personal access token for user
- createsshkey – Create public SSH key for user
- listsshkey – List public SSH keys for user
- removesshkey – Remove public SSH key for user
Privilege Escalation
- addprojectadmin – Add a user to the “Project Administrators” for a given project
- removeprojectadmin – Remove a user from the “Project Administrators” group for a given project
- addbuildadmin – Add a user to the “Build Administrators” group for a given project
- removebuildadmin – Remove a user from the “Build Administrators” group for a given project
- addcollectionadmin – Add a user to the “Project Collection Administrators” group
- removecollectionadmin – Remove a user from the “Project Collection Administrators” group
- addcollectionbuildadmin – Add a user to the “Project Collection Build Administrators” group
- removecollectionbuildadmin – Remove a user from the “Project Collection Build Administrators” group
- addcollectionbuildsvc – Add a user to the “Project Collection Build Service Accounts” group
- removecollectionbuildsvc – Remove a user from the “Project Collection Build Service Accounts” group
- addcollectionsvc – Add a user to the “Project Collection Service Accounts” group
- removecollectionsvc – Remove a user from the “Project Collection Service Accounts” group
- getpipelinevars – Retrieve any pipeline variables used for a given project.
- getpipelinesecrets – Retrieve the names of any pipeline secrets used for a given project.
- getserviceconnections – Retrieve the service connections used for a given project.

Arguments/Options

/credential: – credential for authentication (PAT or Cookie). Applicable to all modules.
/url: – Azure DevOps URL. Applicable to all modules.
/search: – Keyword to search for. Not applicable to all modules.
/project: – Project to perform an action for. Not applicable to all modules.
/user: – Perform an action against a specific user. Not applicable to all modules.
/id: – Used with persistence modules to perform an action against a specific token ID. Not applicable to all modules.
/group: – Perform an action against a specific group. Not applicable to all modules.

Authentication Options

Below are the authentication options you have with ADOKit when authenticating to an Azure DevOps instance.

Stolen Cookie – This will be the UserAuthentication cookie on a user’s machine for the .dev.azure.com domain.
- /credential:UserAuthentication=ABC123
Personal Access Token (PAT) – This will be an access token/API key that will be a single string.
- /credential:apiToken