了解 如何安装 az cli、AzureAD 和 Az PowerShell,请参阅 Az - AzureAD 部分。
您需要知道的第一件事是 您是谁(您处于哪个环境中):
azaccountlistazaccounttenantlist# Current tenant infoazaccountsubscriptionlist# Current subscription infoazadsigned-in-usershow# Current signed-in userazadsigned-in-userlist-owned-objects# Get owned objects by current userazaccountmanagement-grouplist#Not allowed by default
#Get the current session stateGet-AzureADCurrentSessionInfo#Get details of the current tenantGet-AzureADTenantDetail
Azure PowerShell 是一个用于管理 Azure 资源的命令行工具。通过 Az PowerShell,您可以轻松地创建、更新和删除 Azure 资源。
# Get the information about the current context (Account, Tenant, Subscription etc.)Get-AzContext# List all available contextsGet-AzContext-ListAvailable# Enumerate subscriptions accessible by the current userGet-AzSubscription#Get Resource groupGet-AzResourceGroup# Enumerate all resources visible to the current userGet-AzResource# Enumerate all Azure RBAC role assignmentsGet-AzRoleAssignment# For all usersGet-AzRoleAssignment-SignInName test@corp.onmicrosoft.com # For current user
在 Azure 中枚举最重要的命令之一是 Get-AzResource,它来自 Az PowerShell,因为它让你 知道当前用户可以查看的资源。
Import-Module monkey365Get-HelpInvoke-Monkey365Get-HelpInvoke-Monkey365-DetailedInvoke-Monkey365-IncludeAzureActiveDirectory -ExportTo HTML -Verbose -Debug -InformationAction ContinueInvoke-Monkey365- Instance Azure -Analysis All -ExportTo HTML
# Start Backendcd stormspotter\backend\pipenv shellpython ssbackend.pyz# Start Front-endcd stormspotter\frontend\dist\spa\quasar.cmd serve -p 9091--history# Run Stormcollectorcd stormspotter\stormcollector\pipenv shellaz login -u test@corp.onmicrosoft.com -p Welcome2022!python stormspotter\stormcollector\sscollector.pyz cli# This will generate a .zip file to upload in the frontend (127.0.0.1:9091)
# You need to use the Az PowerShell and Azure AD modules:$passwd =ConvertTo-SecureString"Welcome2022!"-AsPlainText -Force$creds =New-Object System.Management.Automation.PSCredential ("test@corp.onmicrosoft.com", $passwd)Connect-AzAccount-Credential $credsImport-Module AzureAD\AzureAD.psd1Connect-AzureAD-Credential $creds# Launch AzureHound. AzureHound\AzureHound.ps1Invoke-AzureHound-Verbose# Simple queries## All Azure UsersMATCH (n:AZUser) return n.name## All Azure ApplicationsMATCH (n:AZApp) return n.objectid## All Azure DevicesMATCH (n:AZDevice) return n.name## All Azure GroupsMATCH (n:AZGroup) return n.name## All Azure Key VaultsMATCH (n:AZKeyVault) return n.name## All Azure Resource GroupsMATCH (n:AZResourceGroup) return n.name## All Azure Service PrincipalsMATCH (n:AZServicePrincipal) return n.objectid## All Azure Virtual MachinesMATCH (n:AZVM) return n.name## All Principals with the ‘Contributor’ roleMATCH p = (n)-[r:AZContributor]->(g) RETURN p# Advanced queries## Get Global AdminsMATCH p =(n)-[r:AZGlobalAdmin*1..]->(m) RETURN p## Owners of Azure GroupsMATCH p = (n)-[r:AZOwns]->(g:AZGroup) RETURN p## All Azure Users and their GroupsMATCH p=(m:AZUser)-[r:MemberOf]->(n) WHERE NOT m.objectid CONTAINS 'S-1-5'RETURN p## Privileged Service PrincipalsMATCH p = (g:AZServicePrincipal)-[r]->(n) RETURN p## Owners of Azure ApplicationsMATCH p = (n)-[r:AZOwns]->(g:AZApp) RETURN p## Paths to VMsMATCH p = (n)-[r]->(g: AZVM) RETURN p## Paths to KeyVaultMATCH p = (n)-[r]->(g:AZKeyVault) RETURN p## Paths to Azure Resource GroupMATCH p = (n)-[r]->(g:AZResourceGroup) RETURN p## On-Prem users with edges to AzureMATCH p=(m:User)-[r:AZResetPassword|AZOwns|AZUserAccessAdministrator|AZContributor|AZAddMembers|AZGlobalAdmin|AZVMContributor|AZOwnsAZAvereContributor]->(n) WHERE m.objectid CONTAINS 'S-1-5-21' RETURN p
## All Azure AD Groups that are synchronized with On-Premise ADMATCH (n:Group) WHERE n.objectid CONTAINS 'S-1-5' AND n.azsyncid IS NOT NULL RETURN n
# You should use an account with at least read-permission on the assets you want to accessgitclonehttps://github.com/nccgroup/azucar.gitPS> Get-ChildItem-Recursec:\Azucar_V10|Unblock-FilePS> .\Azucar.ps1-AuthModeUseCachedCredentials-Verbose-WriteLog-Debug-ExportToPRINTPS> .\Azucar.ps1 -ExportTo CSV,JSON,XML,EXCEL -AuthMode Certificate_Credentials -Certificate C:\AzucarTest\server.pfx -ApplicationId 00000000-0000-0000-0000-000000000000 -TenantID 00000000-0000-0000-0000-000000000000
PS> .\Azucar.ps1 -ExportTo CSV,JSON,XML,EXCEL -AuthMode Certificate_Credentials -Certificate C:\AzucarTest\server.pfx -CertFilePassword MySuperP@ssw0rd! -ApplicationId 00000000-0000-0000-0000-000000000000 -TenantID 00000000-0000-0000-0000-000000000000
# resolve the TenantID for an specific usernamePS> .\Azucar.ps1-ResolveTenantUserNameuser@company.com