Skip to content

Commit fa4bc9f

Browse files
author
Cody Martin
committed
Updating to v0.4.10 : Now able to query Azure (ARM) Subscriptions, Resource Groups, VMs. Able to query Azure AD (MS Graph) User Group Membership (transitive memberOf - includes nested group membership).
1 parent fe375c3 commit fa4bc9f

7 files changed

Lines changed: 1273 additions & 15 deletions

File tree

‎README.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,18 @@ Collection of offensive tools targeting Microsoft Azure written in Python to be
2727
- [`./Azure_AD/get_groups.py`](https://github.com/blacklanternsecurity/offensive-azure/tree/main/Azure_AD)
2828
- Takes in an access token or refresh token, outputs all groups in Azure AD and all available group properties in Microsoft Graph
2929
- Creates three data files, a condensed json file, a raw json file, and a BloodHound compatible azgroups file
30-
30+
- [`./Azure_AD/get_group_members.py`](https://github.com/blacklanternsecurity/offensive-azure/tree/main/Azure_AD)
31+
- Takes in an access token or refresh token, outputs all group memberships in Azure AD and all available group member properties in Microsoft Graph
32+
- Creates three data files, a condensed json file, a raw json file, and a BloodHound compatible azgroups file
33+
- [`./Azure_AD/get_subscriptions.py`](https://github.com/blacklanternsecurity/offensive-azure/tree/main/Azure_AD)
34+
- Takes in an ARM token or refresh token, outputs all subscriptions in Azure and all available subscription properties in Azure Resource Manager
35+
- Creates three data files, a condensed json file, a raw json file, and a BloodHound compatible azgroups file
36+
- [`./Azure_AD/get_resource_groups.py`](https://github.com/blacklanternsecurity/offensive-azure/tree/main/Azure_AD)
37+
- Takes in an ARM token or refresh token, outputs all resource groups in Azure and all available resource group properties in Azure Resource Manager
38+
- Creates two data files, a raw json file, and a BloodHound compatible azgroups file
39+
- [`./Azure_AD/get_vms.py`](https://github.com/blacklanternsecurity/offensive-azure/tree/main/Azure_AD)
40+
- Takes in an ARM token or refresh token, outputs all virtual machines in Azure and all available VM properties in Azure Resource Manager
41+
- Creates two data files, a raw json file, and a BloodHound compatible azgroups file
3142
# Installation
3243

3344
Offensive Azure can be installed in a number of ways or not at all.

‎offensive_azure/Azure_AD/README.md‎

Lines changed: 127 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,143 @@
22

33
This set of modules are meant for targetting Azure AD data. Each module will output a set of data files for further analysis. Support is provided for bloodhound compatible data files in each module. Microsoft is deprecating the use of the Azure AD Graph API on June 30 2022. So, these modules are not going to use any of the now deprecated API calls. Rather, they will be using other available APIs including the currently supported Microsoft Graph API.
44

5-
## get_groups.py
5+
## General Functionality
66

7-
This module uses the Microsoft Graph API to request all groups present within Azure AD. It requires an ms_graph token or a refresh token to be supplied as an argument, or a refresh token supplied as an environment variable `REFRESH_TOKEN`. This module will output a condensed set of results to stdout. Additionally, the module will create three data files. One condensed data json file, one raw json output file, and one file compatible for use with BloodHound.
7+
Each of these modules will output a set of files. All include a raw json response file and a bloodhound compatible json file. Some include a condensed json output file. Usage of these modules is flexible. You may supply the required access token, or a refresh token via script arguments. You may also define an envrionment variable that contains a refresh token. This is the recommended way, and each module will handle the token requests to get the appropriate access token type.
88

9-
## get_users.py
9+
## Installation
1010

11-
This module uses the Microsoft Graph API to request all users present within Azure AD. It requires an ms_graph token or a refresh token to be supplied as an argument, or a refresh token supplied as an environment varialbe `REFRESH_TOKEN`. This module will output a condensed set of results to stdout. Additionally, the module will create three data files. One condensed data json file, one raw json output file, and one file compatible for use with BloodHound.
11+
```bash
12+
git clone https://github.com/blacklanternsecurity/offensive-azure.git
13+
cd ./offensive-azure/Azure_AD/
14+
pipenv shell
15+
pip install -r requirements.txt
16+
```
1217

13-
The module attempts to pull all available properties as defined in the Microsoft Graph documentation, not just the default properties.
18+
## get_vms Usage
1419

15-
## get_tenant.py
20+
```bash
21+
usage: get_vms.py [-t|--arm_token <arm_token>] [-r|--refresh_token <refresh_token>]
1622

17-
This module uses a combination of access token and public endpoints to gather the tenant ID and tenant name (Federation Brand Name). It requires that an access token or a refresh token is supplied as arguments. If neither are supplied, the module will also check for the `REFRESH_TOKEN` variable and use it to request a valid access token.
23+
==========================================================
24+
# #
25+
# Uses Azure Resource Management API to pull a full #
26+
# list of virtual machines. #
27+
# #
28+
# If no ARM token or refresh_token is supplied, #
29+
# module will look in the REFRESH_TOKEN environment #
30+
# variable and request the ARM token #
31+
# #
32+
# Outputs a raw json output file, and a json file #
33+
# compatible with BloodHound #
34+
# #
35+
==========================================================
1836

19-
The module will output two data files. One text file containing the tenant ID and tenant name. Second a JSON file compatible for use with BloodHound.
37+
optional arguments:
38+
-h, --help show this help message and exit
39+
-t <arm_token>, --arm_token <arm_token>
40+
The ARM token you would like to use
41+
-r <refresh_token>, --refresh_token <refresh_token>
42+
The refresh token you would like to use
43+
-R <refresh_token_file>, --refresh_token_file <refresh_token_file>
44+
A JSON file saved from token_juggle.py containing the refresh token you would like to use.
45+
-o <path>, --outfile_path <path>
46+
The path of where you want the virtual machine data saved. If not supplied, module defaults to the current directory.
47+
```
2048

21-
## Installation
49+
## get_resource_groups Usage
2250

2351
```bash
24-
git clone https://github.com/blacklanternsecurity/offensive-azure.git
25-
cd ./offensive-azure/Azure_AD/
26-
pipenv shell
27-
pip install -r requirements.txt
52+
usage: get_resource_groups.py [-t|--arm_token <arm_token>] [-r|--refresh_token <refresh_token>]
53+
54+
==========================================================
55+
# #
56+
# Uses Azure Resource Management API to pull a full #
57+
# list of resource groups. #
58+
# #
59+
# If no ARM token or refresh_token is supplied, #
60+
# module will look in the REFRESH_TOKEN environment #
61+
# variable and request the ARM token #
62+
# #
63+
# Outputs a raw json output file, and a json file #
64+
# compatible with BloodHound #
65+
# #
66+
==========================================================
67+
68+
optional arguments:
69+
-h, --help show this help message and exit
70+
-t <arm_token>, --arm_token <arm_token>
71+
The ARM token you would like to use
72+
-r <refresh_token>, --refresh_token <refresh_token>
73+
The refresh token you would like to use
74+
-R <refresh_token_file>, --refresh_token_file <refresh_token_file>
75+
A JSON file saved from token_juggle.py containing the refresh token you would like to use.
76+
-o <path>, --outfile_path <path>
77+
The path of where you want the resource group data saved. If not supplied, module defaults to the current directory.
78+
```
79+
80+
## get_subscriptions Usage
81+
82+
```bash
83+
usage: get_subscriptions.py [-t|--arm_token <arm_token>] [-r|--refresh_token <refresh_token>]
84+
85+
==========================================================
86+
# #
87+
# Uses Azure Resource Management API to pull a full #
88+
# list of subscriptions. #
89+
# #
90+
# If no ARM token or refresh_token is supplied, #
91+
# module will look in the REFRESH_TOKEN environment #
92+
# variable and request the ARM token #
93+
# #
94+
# Outputs condensed results in a text file, a raw json #
95+
# output file, and a json file compatible with #
96+
# BloodHound #
97+
# #
98+
==========================================================
99+
100+
optional arguments:
101+
-h, --help show this help message and exit
102+
-t <arm_token>, --arm_token <arm_token>
103+
The ARM token you would like to use
104+
-r <refresh_token>, --refresh_token <refresh_token>
105+
The refresh token you would like to use
106+
-R <refresh_token_file>, --refresh_token_file <refresh_token_file>
107+
A JSON file saved from token_juggle.py containing the refresh token you would like to use.
108+
-o <path>, --outfile_path <path>
109+
The path of where you want the subscription data saved. If not supplied, module defaults to the current directory.
110+
```
111+
112+
## get_group_members Usage
113+
114+
```bash
115+
usage: get_group_members.py [-t|--graph_token <graph_token>] [-r|--refresh_token <refresh_token>]
116+
117+
==========================================================
118+
# #
119+
# Uses the Microsoft Graph API to pull a full list of #
120+
# user group membership details. #
121+
# #
122+
# If no ms_graph token or refresh_token is supplied, #
123+
# module will look in the REFRESH_TOKEN environment #
124+
# variable and request the ms_graph token #
125+
# #
126+
# Outputs condensed results in a text file, a raw json #
127+
# output file, and a json file compatible with #
128+
# BloodHound #
129+
# #
130+
==========================================================
131+
132+
optional arguments:
133+
-h, --help show this help message and exit
134+
-t <graph_token>, --graph_token <graph_token>
135+
The ms_graph token you would like to use
136+
-r <refresh_token>, --refresh_token <refresh_token>
137+
The refresh token you would like to use
138+
-R <refresh_token_file>, --refresh_token_file <refresh_token_file>
139+
A JSON file saved from token_juggle.py containing the refresh token you would like to use.
140+
-o <path>, --outfile_path <path>
141+
The path of where you want the group membership data saved. If not supplied, module defaults to the current directory.
28142
```
29143

30144
## get_groups Usage

0 commit comments

Comments
 (0)