AADOutsider-py

소개

이 도구는 AADInternals의 외부자(outsider) 관점 정찰(recon) 부분을 재작성한 것입니다.

AADInternals의 다음 킬체인(killchain) 함수들과 그 모든 하위 메서드를 재구현합니다:

Invoke-AADIntReconAsOutsider
Invoke-AADIntUserEnumerationAsOutsider

설치

pip3 install git+https://github.com/synacktiv/AADOutsider-py

또는

python3 -m venv venv
source venv/bin/activate
pip3 install -r requirements.txt

사용법

전역

$ python3 aadoutsider.py -h
usage: aadoutsider.py [-h] [--dns-tcp] [--dns DNS] [-v] {recon,user_enum} ...

AADInternals-Recon.py - The Python equivalent of AADInternals recon as outsider

positional arguments:
  {recon,user_enum}  cmdlet to call
    recon            ReconAsOutsider
    user_enum        UserEnumerationAsOutsider

options:
  -h, --help         show this help message and exit
  --dns-tcp          Use TCP instead of UDP for DNS requests
  --dns DNS          Use this specific DNS (can be used multiple times)
  -v, --verbose

정찰(Recon)

[!CAUTION] 패치됨, 첫 번째 README.md 주석을 참조하세요.

$ python3 aadoutsider.py recon -h
usage: aadoutsider.py recon [-h] [-d DOMAIN] [-u USERNAME] [-s] [-r] [-o OUTPUT] [-of {json,csv,pretty}]

options:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        targeted domain
  -u USERNAME, --username USERNAME
                        targeted username
  -s, --single          only perform advanced checks for the targeted domain
  -r, --relayingparties
                        retrieve relaying parties of STSs
  -o OUTPUT, --output OUTPUT
                        output file
  -of {json,csv,pretty}, --output-form {json,csv,pretty}
                        output format

$ python3 aadoutsider.py -d microsoft.com
INFO: Found 297 domains!
[===============================]
INFO: Tenant brand: Microsoft
INFO: Tenant name: MicrosoftAPC.onmicrosoft.com
INFO: Tenant id: 72f988bf-86f1-41af-91ab-2d7cd011db47
INFO: Tenant region: WW
INFO: DesktopSSO enabled: False

Name                                       	DNS  	MX   	SPF  	DMARC	DKIM 	MTA-STS	Type     	STS
----                                       	---  	--   	---  	-----	---- 	-------	----     	---
008.mgd.microsoft.com                      	True 	False	False	False	False	False  	Managed
064d.mgd.microsoft.com                     	True 	False	False	False	False	False  	Federated	msft.sts.microsoft.com
2hatsecurity.com                           	True 	True 	True 	False	False	False  	Managed
acompli.com                                	True 	True 	True 	True 	False	False  	Managed
adagencytrainings.microsoft.com            	True 	True 	False	False	False	False  	Federated	msft.sts.microsoft.com
adxstudio.com                              	True 	True 	True 	True 	False	False  	Managed
affirmedNetworks.com                       	True 	True 	True 	True 	False	False  	Managed
[...]
Xoxco.com                                  	True 	True 	True 	True 	False	False  	Managed
yammer-inc.com                             	True 	True 	False	True 	False	False  	Managed
zune.net                                   	True 	True 	False	True 	False	False  	Managed

사용자 열거(User enumeration)

$ python3 aadoutsider.py user_enum -h
usage: aadoutsider.py user_enum [-h] [-m {normal,login,autologon,rst2}] [-e] [-d DOMAIN] username

positional arguments:
  username              user to test

options:
  -h, --help            show this help message and exit
  -m {normal,login,autologon,rst2}, --method {normal,login,autologon,rst2}
                        enumeration method
  -e, --external
  -d DOMAIN, --domain DOMAIN

$ python3 aadoutsider.py user_enum [email protected]
INFO: User [email protected] exists

인기

AADOutsider-py

AADOutsider-py

소개

설치

사용법

전역

정찰(Recon)

사용자 열거(User enumeration)

문서