6 | The Azure Kubernetes Service Contributor role grants full control 7 | of the target Azure Kubernetes Service Managed Cluster. This includes 8 | the ability to remotely fetch administrator credentials for the cluster 9 | as well as the ability to execute arbitrary commands on compute 10 | nodes associated with the AKS Managed Cluster. 11 |
12 | ); 13 | }; 14 | 15 | export default General; 16 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAKSContributor/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This will depend on which particular abuse you perform, but in 7 | general Azure will create a log event for each abuse. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAKSContributor/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | Andy Robbins - BARK.ps1 8 | 9 |Via the Azure portal:
7 |25 | Via PowerZure: Add-AzureADGroup -User [UPN] -Group [Group name] 26 |
27 | 28 | ); 29 | }; 30 | 31 | export default Abuse; 32 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAddMembers/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |The ability to add other principals to an Azure security group
6 | ); 7 | }; 8 | 9 | export default General; 10 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAddMembers/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | The Azure activity log for the tenant will log who added what 7 | principal to what group, including the date and time. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAddMembers/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://powerzure.readthedocs.io/en/latest/Functions/operational.html#add-azureadgroup 8 | 9 |7 | This edge is created during post-processing. It is created against 8 | all App Registrations and Service Principals within the same tenant 9 | when an Azure principal has one of the following Azure Active 10 | Directory roles: 11 |
12 | 13 |14 |
23 | You will not see these privileges when auditing permissions against 24 | any of the mentioned objects when you use Microsoft tooling, including 25 | the Azure portal or any API. 26 |
27 | 28 | ); 29 | }; 30 | 31 | export default General; 32 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAddOwner/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | Any time you add an owner to any Azure object, the AzureAD audit 8 | logs will create an event logging who added an owner to what object, 9 | as well as what the new owner added to the object was. 10 |
11 | 12 | ); 13 | }; 14 | 15 | export default Opsec; 16 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAddOwner/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | Azure provides several systems and mechanisms for granting 8 | control of securable objects within Azure Active Directory, 9 | including tenant-scoped admin roles, object-scoped admin roles, 10 | explicit object ownership, and API permissions. 11 |
12 |13 | When a principal has been granted "Cloud App Admin" or "App 14 | Admin" against the tenant, that principal gains the ability to 15 | add new secrets to all Service Principals and App Registrations. 16 | Additionally, a principal that has been granted "Cloud App 17 | Admin" or "App Admin" against, or explicit ownership of a 18 | Service Principal or App Registration gains the ability to add 19 | secrets to that particular object. 20 |
21 | 22 | ); 23 | }; 24 | 25 | export default General; 26 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAddSecret/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | When you create a new secret for an App or Service Principal, 8 | Azure creates an event called “Update application – Certificates 9 | and secrets management”. This event describes who added the secret 10 | to which application or service principal. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAddSecret/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |6 | Create a new credential for the app, then authenticate to the tenant 7 | as the app's service principal, then abuse whatever privilege it is 8 | that the service principal has. 9 |
10 | ); 11 | }; 12 | 13 | export default Abuse; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAppAdmin/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | rerturn( 5 |6 | Principals with the Application Admin role can control 7 | tenant-resident apps. 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAppAdmin/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | The Azure portal will create a log even whenever a new credential is 7 | created for a service principal. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAppAdmin/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | 6 | https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/ 7 | 8 | ); 9 | }; 10 | 11 | export default References; 12 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAutomationContributor/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | The Azure Automation Contributor role grants full control 7 | of the target Azure Automation Account. This includes 8 | the ability to execute arbitrary commands on the Automation 9 | Account. 10 |
11 | ); 12 | }; 13 | 14 | export default General; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAutomationContributor/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This will depend on which particular abuse you perform, but in 7 | general Azure will create a log event for each abuse. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAutomationContributor/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | Andy Robbins - BARK.ps1 8 | 9 |7 | The Avere Contributor role allows you to run SYSTEM 8 | commands on the VM 9 |
10 | 11 |Via PowerZure:
12 | Invoke-AzureRunCommand 13 |6 | Any principal granted the Avere Contributor role, scoped to the 7 | affected VM, can reset the built-in administrator password on the 8 | VM. 9 |
10 | ); 11 | }; 12 | 13 | export default General; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAvereContributor/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | Because you‘ll be running a command as the SYSTEM user on the 7 | Virtual Machine, the same opsec considerations for running malicious 8 | commands on any system should be taken into account: command line 9 | logging, PowerShell script block logging, EDR, etc. 10 |
11 | ); 12 | }; 13 | 14 | export default Opsec; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZAvereContributor/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T0008: Lateral Movement 8 | 9 |6 | Create a new credential for the app, then authenticate to the tenant 7 | as the app's service principal, then abuse whatever privilege it is 8 | that the service principal has. 9 |
10 | ); 11 | }; 12 | 13 | export default Abuse; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZCloudAppAdmin/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | Principals with the Cloud App Admin role can control tenant-resident 7 | apps 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZCloudAppAdmin/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | Auzre will create a log event whenever a new secret is created for a 7 | service principal. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZCloudAppAdmin/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 |6 | 7 | https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/ 8 | 9 |
10 | ); 11 | }; 12 | 13 | export default References; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZContains/AZContains.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { Tabs, Tab } from 'react-bootstrap'; 4 | import General from './General'; 5 | import Abuse from './Abuse'; 6 | import Opsec from './Opsec'; 7 | import References from './References'; 8 | 9 | const AZContains = ({ sourceName, sourceType, targetName, targetType }) => { 10 | return ( 11 |6 | There is no abuse necessary, but any roles scoped on a parent object 7 | will descend down to all child objects. 8 |
9 | ); 10 | }; 11 | 12 | export default Abuse; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZContains/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | This indicates that the parent object contains the child object, 7 | such as a resource group containing a virtual machine, or a tenant 8 | "containing" a subscription. 9 |
10 | ); 11 | }; 12 | 13 | export default General; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZContains/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This depends on what you do, see other edges as far as opsec 7 | considerations for activating roles 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZContains/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return (<>) 5 | }; 6 | 7 | export default References; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZContributor/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | The contributor role grants almost all abusable privileges in all 7 | circumstances, with some exceptions. Those exceptions are not 8 | collected by AzureHound. 9 |
10 | ); 11 | }; 12 | 13 | export default General; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZContributor/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This will depend on which particular abuse you perform, but in 7 | general Azure will create a log event for each abuse. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZContributor/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/{' '} 8 | 9 |6 | Principals with the Intune Administrators role are able to 7 | execute arbitrary PowerShell scripts on devices that are joined 8 | to the Azure Active Directory tenant. 9 |
10 | ); 11 | }; 12 | 13 | export default General; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZExecuteCommand/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | MITRE: Execution 8 | 9 |7 | Use PowerShell or PowerZure to fetch the certificate from the 8 | key vault 9 |
10 |Via PowerZure
11 | 12 | Get-AzureKeyVaultContent 13 | 14 |The ability to read certificates from key vaults
; 5 | }; 6 | 7 | export default General; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGetCertificates/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | Azure will create a new log event for the key vault whenever a 7 | secret is accessed. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGetCertificates/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://blog.netspi.com/azure-automation-accounts-key-stores/ 8 | 9 |7 | Use PowerShell or PowerZure to fetch the key from the key vault 8 |
9 |Via PowerZure
10 | 11 | Export-AzureKeyVaultContent 12 | 13 | 14 | ); 15 | }; 16 | 17 | export default Abuse; 18 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGetKeys/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | returnThe ability to read keys from key vaults
; 5 | }; 6 | 7 | export default General; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGetKeys/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | Azure will create a new log event for the key vault whenever a 7 | secret is accessed. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGetKeys/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://blog.netspi.com/azure-automation-accounts-key-stores/ 8 | 9 |7 | Use PowerShell or PowerZure to fetch the secret from the key 8 | vault 9 |
10 |Via PowerZure
11 | 12 | Get-AzureKeyVaultContent 13 | 14 | 15 | ); 16 | }; 17 | 18 | export default Abuse; 19 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGetSecrets/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | returnThe ability to read secrets from key vaults
; 5 | }; 6 | 7 | export default General; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGetSecrets/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | Azure will create a new log event for the key vault whenever a 7 | secret is accessed. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGetSecrets/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://blog.netspi.com/azure-automation-accounts-key-stores/ 8 | 9 |6 | This edge indicates the principal has the Global Admin role active 7 | against the target tenant. In other words, the principal is a Global 8 | Admin. Global Admins can do almost anything against almost every 9 | object type in the tenant, this is the highest privilege role in 10 | Azure. 11 |
12 | ); 13 | }; 14 | 15 | export default General; 16 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGlobalAdmin/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This depends on exactly what you do, but in general Azure will log 7 | each abuse action. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZGlobalAdmin/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | 6 | https://blog.netspi.com/attacking-azure-cloud-shell/ 7 | 8 | ); 9 | }; 10 | 11 | export default References; 12 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZHasRole/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | return ( 5 | <> 6 |7 | No abuse is necessary. This edge only indicates 8 | that the principal has been granted a particular 9 | AzureAD admin role. 10 |
11 | 12 | ); 13 | }; 14 | 15 | export default Abuse; 16 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZHasRole/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | This edge indicates that a principal has been granted a particular 7 | AzureAD admin role. 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZHasRole/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | The opsec considerations for a particular action authorized by a 7 | principal“s active AzureAD role assignment will wholly depend 8 | on what the action taken is. This edge does not capture all abusable 9 | possibilities. 10 |
11 | ); 12 | }; 13 | 14 | export default Opsec; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZHasRole/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | Microsoft Graph Permission Reference 8 | 9 |7 | You can read secrets and alter access policies (grant yourself access to read secrets) 8 |
9 | 10 |Via PowerZure:
11 | 12 | Get-AzureKeyVaultContent 13 | 14 |6 | The Key Vault Contributor role grants full control of the 7 | target Key Vault. This includes the ability to read all secrets 8 | stored on the Key Vault. 9 |
10 | ); 11 | }; 12 | 13 | export default General; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZKeyVaultKVContributor/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This will depend on which particular abuse you perform, but in 7 | general Azure will create a log event for each abuse. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZKeyVaultKVContributor/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/{' '} 8 | 9 |7 | Currently you need access to the portal GUI to execute this abuse. 8 |
9 | 10 |11 | The abuse involves adding or modifying an existing logic app to coerce 12 | the logic app into sending a JWT for its managed identity service principal 13 | to a web server you control. 14 |
15 | 16 |17 | You can see a full walkthrough for executing that abuse in this blog post: 18 |
19 | 20 |21 | 22 | Andy Robbins - Managed Identity Attack Paths, Part 2: Logic Apps 23 | 24 |
25 | 26 | 27 | ); 28 | }; 29 | 30 | export default Abuse; 31 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZLogicAppContributor/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | The Logic Contributor role grants full control 7 | of the target Logic App. This includes the ability 8 | to execute arbitrary commands on the Logic App. 9 |
10 | ); 11 | }; 12 | 13 | export default General; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZLogicAppContributor/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This will depend on which particular abuse you perform, but in 7 | general Azure will create a log event for each abuse. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZLogicAppContributor/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | Andy Robbins - BARK.ps1 8 | 9 |7 | The Azure activity log for the tenant will log who added what 8 | principal to what group, including the date and time. 9 |
10 | 11 | ); 12 | }; 13 | 14 | export default Opsec; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGAddMember/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | Any time you add an owner to any Azure object, the AzureAD audit 8 | logs will create an event logging who added an owner to what object, 9 | as well as what the new owner added to the object was. 10 |
11 | 12 | ); 13 | }; 14 | 15 | export default Opsec; 16 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGAddOwner/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | When you create a new secret for an App or Service Principal, 8 | Azure creates an event called “Update application – Certificates 9 | and secrets management”. This event describes who added the secret 10 | to which application or service principal. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGAddSecret/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created when a Service Principal has been 8 | granted the AppRoleAssignment.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Abuse; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGAppRoleAssignment_ReadWrite_All/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the AppRoleAssignment.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default General; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGAppRoleAssignment_ReadWrite_All/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the AppRoleAssignment.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGAppRoleAssignment_ReadWrite_All/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created when a Service Principal has been 8 | granted the Application.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Abuse; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGApplication_ReadWrite_All/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the Application.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default General; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGApplication_ReadWrite_All/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the Application.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGApplication_ReadWrite_All/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created when a Service Principal has been 8 | granted the Directory.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Abuse; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGDirectory_ReadWrite_All/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the Directory.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default General; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGDirectory_ReadWrite_All/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the Directory.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGDirectory_ReadWrite_All/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created during post-processing. It is created against 8 | AzureAD tenant objects when a Service Principal has one of the following 9 | MS Graph app role assignments: 10 |
11 | 12 |13 |
7 | When you assign an app role to a Service Principal, the Azure 8 | Audit logs will create an event called "Add app role assignment 9 | to service principal". This event describes who made the change, 10 | what the target service principal was, and what app role assignment 11 | was granted. 12 |
13 | 14 | ); 15 | }; 16 | 17 | export default Opsec; 18 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGrantAppRoles/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created during post-processing. It is created against 8 | all AzureAD admin roles when a Service Principal has the following 9 | MS Graph app role assignment: 10 |
11 | 12 |13 |
19 | This privilege allows the Service Principal to promote itself or 20 | any other principal to any AzureAD admin role, including Global 21 | Administrator. 22 |
23 | 24 | ); 25 | }; 26 | 27 | export default General; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGrantRole/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | When you assign an AzureAD admin role to a principal 8 | using this privilege, the Azure Audit log will create 9 | an event called "Add member to role outside of PIM 10 | (permanent)". 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGrantRole/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created when a Service Principal has been 8 | granted the GroupMember.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Abuse; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGroupMember_ReadWrite_All/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the GroupMember.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default General; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGroupMember_ReadWrite_All/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the GroupMember.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGroupMember_ReadWrite_All/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created when a Service Principal has been 8 | granted the Group.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Abuse; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGroup_ReadWrite_All/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the Group.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default General; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGroup_ReadWrite_All/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the Group.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGGroup_ReadWrite_All/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created when a Service Principal has been 8 | granted the RoleManagement.ReadWrite.Directory edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Abuse; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGRoleManagement_ReadWrite_Directory/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the RoleManagement.ReadWrite.Directory edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default General; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGRoleManagement_ReadWrite_Directory/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the RoleManagement.ReadWrite.Directory edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGRoleManagement_ReadWrite_Directory/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |7 | This edge is created when a Service Principal has been 8 | granted the ServicePrincipalEndpoint.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Abuse; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGServicePrincipalEndpoint_ReadWrite_All/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the ServicePrincipalEndpoint.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default General; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGServicePrincipalEndpoint_ReadWrite_All/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | This edge is created when a Service Principal has been 8 | granted the ServicePrincipalEndpoint.ReadWrite.All edge. The edge is 9 | not abusable, but is used during post-processing to create 10 | abusable edges. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMGServicePrincipalEndpoint_ReadWrite_All/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T1098: Account Manipulation 8 | 9 |6 | Azure resources like Virtual Machines, Logic Apps, and Automation Accounts 7 | can be assigned to either System- or User-Assigned Managed Identities. 8 | This assignment allows the Azure resource to authenticate to Azure services 9 | as the Managed Identity without needing to know the credential for that 10 | Managed Identity. Managed Identities, whether System- or User-Assigned, are 11 | AzureAD Service Principals. 12 |
13 | ); 14 | }; 15 | 16 | export default General; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZManagedIdentity/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnThis will depend on which particular abuse you perform, but in general Azure will create a log event for each abuse.
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZManagedIdentity/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://attack.mitre.org/techniques/T1078/ 8 | 9 |6 | No abuse is necessary. This edge simply indicates that a principal 7 | belongs to a security group. 8 |
9 | ); 10 | }; 11 | 12 | export default Abuse; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMemberOf/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName }) => { 6 | return ( 7 | <> 8 |9 | The {typeFormat(sourceType)} {sourceName} is a member of the 10 | group {targetName}. 11 |
12 |13 | Groups in Azure Active Directory grant their direct members any privileges 14 | the group itself has. If a group has an AzureAD admin role, direct members 15 | of the group inherit those permissions. 16 |
17 | 18 | ); 19 | }; 20 | 21 | General.propTypes = { 22 | sourceName: PropTypes.string, 23 | sourceType: PropTypes.string, 24 | targetName: PropTypes.string, 25 | }; 26 | 27 | export default General; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMemberOf/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnNo opsec considerations apply to this edge.
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZMemberOf/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | Create a role-assignable group in Azure Active Directory 8 | 9 | 10 | ); 11 | }; 12 | 13 | export default References; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZNodeResourceGroup/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | return ( 5 | <> 6 |7 | You will abuse this relationship by executing a command 8 | against the AKS Managed Cluster the edge is emiting from. 9 | You can target any managed identity assignment scoped to 10 | the Virtual Machine Scale Sets under the target Resource Group. 11 |
12 | 13 | ); 14 | }; 15 | 16 | export default Abuse; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZNodeResourceGroup/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 | 7 |8 | This edge is created to link Azure Kubernetes Service 9 | Managed Clusters to the Virtual Machine Scale Sets they 10 | use to execute commands on. 11 |
12 | 13 |14 | The system-assigned identity for the AKS Cluster will 15 | have the Contributor role against the target Resource Group 16 | and its child Virtual Machine Scale Sets. 17 |
18 | 19 | 20 | ); 21 | }; 22 | 23 | export default General; 24 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZNodeResourceGroup/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This will depend on which particular abuse you perform, but in 7 | general Azure will create a log event for each abuse. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZNodeResourceGroup/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | Andy Robbins - BARK.ps1 8 | 9 |6 | Everything a Contributor can do, with the addition of assigning 7 | rights to resources. 8 |
9 | ); 10 | }; 11 | 12 | export default Abuse; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZOwns/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | Object ownership means almost all abuses are possible against the 7 | target object. 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZOwns/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This depends on which abuse you perform, but in general Azure will 7 | create a log for each abuse action. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZOwns/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | 6 | https://blog.netspi.com/attacking-azure-with-custom-script-extensions/ 7 | 8 | ); 9 | }; 10 | 11 | export default References; 12 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZPrivilegedAuthAdmin/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | This edge indicates the principal has the Privileged Authentication Administrator 7 | role active against the target tenant. Principals with this role can update 8 | sensitive properties for all users. Privileged Authentication Administrator can 9 | set or reset any authentication method (including passwords) for any user, 10 | including Global Administrators. 11 |
12 | ); 13 | }; 14 | 15 | export default General; 16 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZPrivilegedRoleAdmin/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | return ( 5 |6 | Activate the Global Admin role for yourself or for another user 7 | using PowerZure or PowerShell. 8 |
9 | ); 10 | }; 11 | 12 | export default Abuse; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZPrivilegedRoleAdmin/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | The Privileged Role Admin role can grant any other admin role to 7 | another principal at the tenant level. 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZPrivilegedRoleAdmin/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | The Azure Activity Log will log who activated an admin role for what 7 | other principal, including the date and time. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZPrivilegedRoleAdmin/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | 6 | https://powerzure.readthedocs.io/en/latest/Functions/operational.html#add-azureadrole 7 | 8 | ); 9 | }; 10 | 11 | export default References; 12 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZResetPassword/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | The ability to change another user's password without knowing their 7 | current password 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZResetPassword/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | When resetting a user’s password and letting Azure 8 | set a new random password, Azure will log two events: 9 |
10 | 11 |12 | “Reset user password” and “Reset password (by admin)”. 13 | These logs describe who performed the password reset, 14 | against which user, and at what time. 15 |
16 | 17 |18 | When setting a specified new password for the user, 19 | Azure will log two events: 20 |
21 | 22 |23 | “Reset user password” and “Update user”. The first log 24 | will describe who changed the target’s password and when. 25 |
26 | 27 | ); 28 | }; 29 | 30 | export default Opsec; 31 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZResetPassword/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 |6 | 7 | https://powerzure.readthedocs.io/en/latest/Functions/operational.html#set-azureuserpassword 8 | 9 |
10 | ); 11 | }; 12 | 13 | export default References; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZRunsAs/AZRunsAs.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { Tabs, Tab } from 'react-bootstrap'; 4 | import General from './General'; 5 | import Abuse from './Abuse'; 6 | import Opsec from './Opsec'; 7 | import References from './References'; 8 | 9 | const AZRunsAs = ({ sourceName, sourceType, targetName, targetType }) => { 10 | return ( 11 |6 | This edge should be taken into consideration when abusing control of 7 | an app. Apps authenticate with service principals to the tenant, so 8 | if you have control of an app, what you are abusing is that control 9 | plus the fact that the app runs as a privileged service principal 10 |
11 | ); 12 | }; 13 | 14 | export default Abuse; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZRunsAs/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | The Azure App runs as the Service Principal when it needs to 7 | authenticate to the tenant 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZRunsAs/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnNo opsec considerations for this edge.
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZRunsAs/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return References go here; 5 | }; 6 | 7 | export default References; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZUserAccessAdministrator/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | return ( 5 |6 | This role can be used to grant yourself or another principal any 7 | privilege you want against Automation Accounts, VMs, Key Vaults, and 8 | Resource Groups. Use the Azure portal to add a new, abusable role 9 | assignment against the target object for yourself. 10 |
11 | ); 12 | }; 13 | 14 | export default Abuse; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZUserAccessAdministrator/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | The User Access Admin role can edit roles against many other objects 7 |
8 | ); 9 | }; 10 | 11 | export default General; 12 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZUserAccessAdministrator/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnAzure will log any role activation event for any object type.
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZUserAccessAdministrator/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | 6 | https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/ 7 | 8 | ); 9 | }; 10 | 11 | export default References; 12 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZVMAdminLogin/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | return ( 5 | <> 6 |7 | Connect to the VM via RDP and you will be granted local admin rights 8 | on the VM. 9 |
10 | 11 | ); 12 | }; 13 | 14 | export default Abuse; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZVMAdminLogin/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 | <> 6 |7 | When a virtual machine is configured to allow logon with Azure 8 | AD credentials, the VM automatically has certain principals 9 | added to its local administrators group, including any principal 10 | granted the Virtual Machine Administrator Login (or "VMAL") 11 | admin role. 12 |
13 |14 | Any principal granted this role, scoped to the affected VM, can 15 | connect to the VM via RDP and will be granted local admin rights 16 | on the VM. 17 |
18 | 19 | ); 20 | }; 21 | 22 | export default General; 23 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZVMAdminLogin/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | If the target computer is a workstation and a user is currently 8 | logged on, one of two things will happen. If the user you are 9 | abusing is the same user as the one logged on, you will 10 | effectively take over their session and kick the logged on user 11 | off, resulting in a message to the user. If the users are 12 | different, you will be prompted to kick the currently logged on 13 | user off the system and log on. If the target computer is a 14 | server, you will be able to initiate the connection without 15 | issue provided the user you are abusing is not currently logged 16 | in. 17 |
18 |19 | Remote desktop will create Logon and Logoff events with the 20 | access type RemoteInteractive. 21 |
22 | 23 | ); 24 | }; 25 | 26 | export default Opsec; 27 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZVMAdminLogin/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | ATT&CK T0008: Lateral Movement 8 | 9 | 10 | ATT&CK T1021: Remote Services 11 | 12 | 13 | Login to Windows virtual machine in Azure using Azure Active 14 | Directory authentication 15 | 16 | 17 | ); 18 | }; 19 | 20 | export default References; 21 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZVMContributor/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | return ( 5 | <> 6 |7 | The Virtual Machine Contributor role allows you to run SYSTEM 8 | commands on the VM 9 |
10 | 11 |Via PowerZure:
12 | Invoke-AzureRunCommand 13 |6 | The Virtual Machine contributor role grants almost all abusable 7 | privileges against Virtual Machines. 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZVMContributor/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | Because you'll be running a command as the SYSTEM user on the 7 | Virtual Machine, the same opsec considerations for running malicious 8 | commands on any system should be taken into account: command line 9 | logging, PowerShell script block logging, EDR, etc. 10 |
11 | ); 12 | }; 13 | 14 | export default Opsec; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZVMContributor/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | 6 | https://blog.netspi.com/running-powershell-scripts-on-azure-vms/ 7 | 8 | ); 9 | }; 10 | 11 | export default References; 12 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZWebsiteContributor/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const General = () => { 4 | return ( 5 |6 | The Website Contributor role grants full control of the target 7 | Function App or Web App. Full control of either of those types 8 | of resources allows for arbitrary command execution against the 9 | target resoruce. 10 |
11 | ); 12 | }; 13 | 14 | export default General; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZWebsiteContributor/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This will depend on which particular abuse you perform, but in 7 | general Azure will create a log event for each abuse. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AZWebsiteContributor/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | Andy Robbins - BARK.ps1 8 | 9 |6 | To execute this attack, the Rubeus C# assembly needs to be executed 7 | on some system with the ability to send/receive traffic in the 8 | domain. Modification of the 9 | *msDS-AllowedToActOnBehalfOfOtherIdentity* property against the 10 | target also must occur, whether through PowerShell or another 11 | method. The property should be cleared (or reset to its original 12 | value) after attack execution in order to prevent easy detection. 13 |
14 | ); 15 | }; 16 | 17 | export default Opsec; 18 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AddKeyCredentialLink/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat } from '../Formatter'; 4 | 5 | const General = ({sourceName, sourceType, targetName}) => { 6 | return ( 7 |8 | {groupSpecialFormat(sourceType, sourceName)} the ability to write to 9 | the "msds-KeyCredentialLink" property on {targetName}. Writing to 10 | this property allows an attacker to create "Shadow Credentials" on 11 | the object and authenticate as the principal using kerberos PKINIT. 12 |
13 | ); 14 | }; 15 | 16 | General.propTypes = { 17 | sourceName: PropTypes.string, 18 | sourceType: PropTypes.string, 19 | targetName: PropTypes.string, 20 | }; 21 | 22 | export default General; 23 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AddKeyCredentialLink/LinuxAbuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | 4 | const LinuxAbuse = ({ sourceName, sourceType }) => { 5 | return ( 6 | <> 7 |To abuse this privilege, use pyWhisker.
8 | 9 |
10 | {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
11 |
12 |
13 | 14 | For other optional parameters, view the pyWhisker documentation. 15 |
16 | 17 | ); 18 | }; 19 | 20 | LinuxAbuse.propTypes = { 21 | sourceName: PropTypes.string, 22 | sourceType: PropTypes.string, 23 | }; 24 | 25 | export default LinuxAbuse; 26 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AddKeyCredentialLink/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | Executing the attack will generate a 5136 (A directory object 8 | was modified) event at the domain controller if an appropriate 9 | SACL is in place on the target object. 10 |
11 | 12 |13 | If PKINIT is not common in the environment, a 4768 (Kerberos 14 | authentication ticket (TGT) was requested) ticket can also 15 | expose the attacker. 16 |
17 | 18 | ); 19 | }; 20 | 21 | export default Opsec; 22 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AddKeyCredentialLink/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://github.com/eladshamir/Whisker 8 | 9 |To abuse this privilege, use Whisker.
8 | 9 |10 | You may need to authenticate to the Domain Controller as{' '} 11 | {sourceType === 'User' || sourceType === 'Computer' 12 | ? `${sourceName} if you are not running a process as that user/computer` 13 | : `a member of ${sourceName} if you are not running a process as a member`} 14 |
15 | 16 |
17 | {'Whisker.exe add /target:'}
18 |
19 |
20 | 21 | For other optional parameters, view the Whisker documentation. 22 |
23 | 24 | ); 25 | }; 26 | 27 | WindowsAbuse.propTypes = { 28 | sourceName: PropTypes.string, 29 | sourceType: PropTypes.string, 30 | }; 31 | 32 | export default WindowsAbuse; 33 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AddMember/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} the ability to add 10 | arbitrary principals, including{' '} 11 | {sourceType === 'Group' ? 'themselves' : 'itself'}, to the group{' '} 12 | {targetName}. Because of security group delegation, the members 13 | of a security group have the same privileges as that group. 14 |
15 | 16 |17 | By adding itself to the group, {sourceName} will gain the same 18 | privileges that {targetName} already has. 19 |
20 | 21 | ); 22 | }; 23 | 24 | General.propTypes = { 25 | sourceName: PropTypes.string, 26 | sourceType: PropTypes.string, 27 | targetName: PropTypes.string, 28 | }; 29 | 30 | export default General; 31 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AddMember/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 8 | 9 |9 | {groupSpecialFormat(sourceType, sourceName)} the ability to add{' '} 10 | {sourceType === 'Group' ? 'themselves' : 'itself'}, to the group{' '} 11 | {targetName}. Because of security group delegation, the members 12 | of a security group have the same privileges as that group. 13 |
14 | 15 |16 | By adding itself to the group, {sourceName} will gain the same 17 | privileges that {targetName} already has. 18 |
19 | 20 | ); 21 | }; 22 | 23 | General.propTypes = { 24 | sourceName: PropTypes.string, 25 | sourceType: PropTypes.string, 26 | targetName: PropTypes.string, 27 | }; 28 | 29 | export default General; 30 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AdminTo/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | There are several forensic artifacts generated by the techniques 8 | described above. For instance, lateral movement via PsExec will 9 | generate 4697 events on the target system. If the target 10 | organization is collecting and analyzing those events, they may 11 | very easily detect lateral movement via PsExec. 12 |
13 | 14 |15 | Additionally, an EDR product may detect your attempt to inject 16 | into lsass and alert a SOC analyst. There are many more opsec 17 | considerations to keep in mind when abusing administrator 18 | privileges. For more information, see the References tab. 19 |
20 | 21 | ); 22 | }; 23 | 24 | export default Opsec; 25 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AllExtendedRights/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat, typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName, targetType }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} the 10 | AllExtendedRights privilege to the {typeFormat(targetType)} 11 | {targetName}. 12 |
13 | 14 |15 | Extended rights are special rights granted on objects which 16 | allow reading of privileged attributes, as well as performing 17 | special actions. 18 |
19 | 20 | ); 21 | }; 22 | 23 | General.propTypes = { 24 | sourceName: PropTypes.string, 25 | sourceType: PropTypes.string, 26 | targetName: PropTypes.string, 27 | targetType: PropTypes.string, 28 | }; 29 | 30 | export default General; 31 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AllExtendedRights/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | When using the PowerView functions, keep in mind that PowerShell v5 7 | introduced several security mechanisms that make it much easier for 8 | defenders to see what's going on with PowerShell in their network, 9 | such as script block logging and AMSI. You can bypass those security 10 | mechanisms by downgrading to PowerShell v2, which all PowerView 11 | functions support. 12 |
13 | ); 14 | }; 15 | 16 | export default Opsec; 17 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AllowedToAct/LinuxAbuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | 4 | const LinuxAbuse = ({ sourceName }) => { 5 | return ( 6 | <> 7 | We can then get a service ticket for the service name (sname) we 8 | want to "pretend" to be "admin" for. Impacket's getST.py example script 9 | can be used for that purpose. 10 |
11 |
12 | {
13 | "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
14 | }
15 |
16 |
17 | This ticket can then be used with Pass-the-Ticket, and could grant access
18 | to the file system of the TARGETCOMPUTER.
19 |
20 | );
21 | };
22 |
23 | LinuxAbuse.propTypes = {
24 | sourceName: PropTypes.string,
25 | };
26 |
27 | export default LinuxAbuse;
28 |
--------------------------------------------------------------------------------
/src/components/Modals/HelpTexts/AllowedToAct/Opsec.jsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 |
3 | const Opsec = () => {
4 | return (
5 | 6 | To execute this attack, the Rubeus C# assembly needs to be executed 7 | on some system with the ability to send/receive traffic in the 8 | domain. 9 |
10 | ); 11 | }; 12 | 13 | export default Opsec; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/AllowedToDelegate/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | As mentioned in the abuse info, in order to currently abuse this 7 | primitive the Rubeus C# assembly needs to be executed on some system 8 | with the ability to send/receive traffic in the domain. See the 9 | References for more information. 10 |
11 | ); 12 | }; 13 | 14 | export default Opsec; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/CanPSRemote/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat } from '../Formatter'; 4 | 5 | const General = ({sourceName, sourceType, targetName}) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} the capability to 10 | create a PSRemote Connection with the computer {targetName}. 11 |
12 | 13 |14 | PS Session access allows you to enter an interactive session 15 | with the target computer. If authenticating as a low privilege 16 | user, a privilege escalation may allow you to gain high 17 | privileges on the system. 18 |
19 |Note: This edge does not guarantee privileged execution.
20 | 21 | ); 22 | }; 23 | 24 | General.propTypes = { 25 | sourceName: PropTypes.string, 26 | sourceType: PropTypes.string, 27 | targetName: PropTypes.string, 28 | }; 29 | 30 | export default General; 31 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/CanPSRemote/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | When using the PowerShell functions, keep in mind that 8 | PowerShell v5 introduced several security mechanisms that make 9 | it much easier for defenders to see what's going on with 10 | PowerShell in their network, such as script block logging and 11 | AMSI. 12 |
13 |14 | Entering a PSSession will generate a logon event on the target 15 | computer. 16 |
17 | 18 | ); 19 | }; 20 | 21 | export default Opsec; 22 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/CanPSRemote/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssession?view=powershell-7/ 8 | 9 |9 | {groupSpecialFormat(sourceType, sourceName)} the capability to 10 | create a Remote Desktop Connection with the computer{' '} 11 | {targetName}. 12 |
13 | 14 |15 | Remote Desktop access allows you to enter an interactive session 16 | with the target computer. If authenticating as a low privilege 17 | user, a privilege escalation may allow you to gain high 18 | privileges on the system. 19 |
20 |Note: This edge does not guarantee privileged execution.
21 | 22 | ); 23 | }; 24 | 25 | General.propTypes = { 26 | sourceName: PropTypes.string, 27 | sourceType: PropTypes.string, 28 | targetName: PropTypes.string, 29 | }; 30 | 31 | export default General; 32 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/CanRDP/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | If the target computer is a workstation and a user is currently 8 | logged on, one of two things will happen. If the user you are 9 | abusing is the same user as the one logged on, you will 10 | effectively take over their session and kick the logged on user 11 | off, resulting in a message to the user. If the users are 12 | different, you will be prompted to kick the currently logged on 13 | user off the system and log on. If the target computer is a 14 | server, you will be able to initiate the connection without 15 | issue provided the user you are abusing is not currently logged 16 | in. 17 |
18 |19 | Remote desktop will create Logon and Logoff events with the 20 | access type RemoteInteractive. 21 |
22 | 23 | ); 24 | }; 25 | 26 | export default Opsec; 27 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/CanRDP/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://michael-eder.net/post/2018/native_rdp_pass_the_hash/ 8 | 9 |There is no abuse info related to this edge.
; 5 | }; 6 | 7 | export default Abuse; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/Contains/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName, targetType }) => { 6 | return ( 7 | <> 8 |9 | {typeFormat(sourceType)} {sourceName} contains the{' '} 10 | {typeFormat(targetType)} {targetName}. 11 |
12 |13 | GPOs linked to a container apply to all objects that are 14 | contained by the container. 15 |
16 | 17 | ); 18 | }; 19 | 20 | General.propTypes = { 21 | sourceName: PropTypes.string, 22 | sourceType: PropTypes.string, 23 | targetName: PropTypes.string, 24 | targetType: PropTypes.string, 25 | }; 26 | 27 | export default General; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/Contains/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnThere are no opsec considerations related to this edge.
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/Contains/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | rerturn( 5 | <> 6 | https://wald0.com/?p=179 7 |9 | {groupSpecialFormat(sourceType, sourceName)} the 10 | DS-Replication-Get-Changes and the 11 | DS-Replication-Get-Changes-All privilege on the domain{' '} 12 | {targetName}. 13 |
14 |15 | These two privileges allow a principal to perform a DCSync 16 | attack. 17 |
18 | 19 | ); 20 | }; 21 | 22 | General.propTypes = { 23 | sourceName: PropTypes.string, 24 | sourceType: PropTypes.string, 25 | targetName: PropTypes.string, 26 | }; 27 | 28 | export default General; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/DCSync/LinuxAbuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const LinuxAbuse = () => { 4 | return ( 5 | <> 6 |7 | You may perform a dcsync attack to get the password hash of an 8 | arbitrary principal using impacket's secretsdump.py example script: 9 |
10 | 11 |
12 |
13 | {
14 | "secretsdump.py 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
15 | }
16 |
17 |
18 |
19 | 20 | You can also perform the more complicated ExtraSids attack to 21 | hop domain trusts. For information on this see the blog post by 22 | harmj0y in the references tab. 23 |
24 | 25 | ); 26 | }; 27 | 28 | export default LinuxAbuse; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/DCSync/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | For detailed information on detection of dcsync as well as opsec 7 | considerations, see the adsecurity post in the references tab. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/DCSync/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://adsecurity.org/?p=1729 8 | 9 |7 | You may perform a dcsync attack to get the password hash of an 8 | arbitrary principal using mimikatz: 9 |
10 |
11 |
12 | {
13 | 'lsadump::dcsync /domain:testlab.local /user:Administrator'
14 | }
15 |
16 |
17 | 18 | You can also perform the more complicated ExtraSids attack to 19 | hop domain trusts. For information on this see the blog post by 20 | harmj0y in the references tab. 21 |
22 | 23 | ); 24 | }; 25 | 26 | export default WindowsAbuse; 27 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/Default/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | return <>; 5 | }; 6 | export default Abuse; 7 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/Default/Default.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { Tabs, Tab } from 'react-bootstrap'; 4 | import General from './General'; 5 | import Abuse from './Abuse'; 6 | import Opsec from './Opsec'; 7 | import References from './References'; 8 | 9 | const Default = ({ sourceName, sourceType, targetName, targetType }) => { 10 | return ( 11 |6 | This is an error. Please report this to the BloodHound dev team 7 | along with instructions to replicate. 8 |
9 | ); 10 | }; 11 | 12 | export default General; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/Default/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return <>; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/Default/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 |10 | {groupSpecialFormat(sourceType, sourceName)} the 11 | Standalone Managed Service Account (sMSA) {targetName} installed on it. 12 |
13 | 14 |15 | With administrative privileges on {sourceName}, it is 16 | possible to dump {targetName}'s password stored in LSA 17 | secrets. 18 |
19 | 20 | ); 21 | }; 22 | 23 | General.propTypes = { 24 | sourceName: PropTypes.string, 25 | sourceType: PropTypes.string, 26 | targetName: PropTypes.string, 27 | }; 28 | 29 | export default General; 30 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/DumpSMSAPassword/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | 5 | return ( 6 | <> 7 |8 | Access to registry hives can be monitored and alerted via event ID 4656 9 | (A handle to an object was requested). 10 |
11 | 12 | ) 13 | }; 14 | 15 | export default Opsec; 16 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/DumpSMSAPassword/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | 4 | const References = () => { 5 | return( 6 | <> 7 | https://simondotsh.com/infosec/2022/12/12/assessing-smsa.html 8 |9 | {groupSpecialFormat(sourceType, sourceName)} membership in the 10 | Distributed COM Users local group on the computer {targetName}. 11 |
12 |13 | This can allow code execution under certain conditions by 14 | instantiating a COM object on a remote machine and invoking its 15 | methods. 16 |
17 | 18 | ); 19 | }; 20 | 21 | General.propTypes = { 22 | sourceName: PropTypes.string, 23 | sourceType: PropTypes.string, 24 | targetName: PropTypes.string, 25 | }; 26 | 27 | export default General; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/ForceChangePassword/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat, typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName, targetType }) => { 6 | return ( 7 |8 | {groupSpecialFormat(sourceType, sourceName)} the capability to 9 | change the {typeFormat(targetType)} {targetName}'s password without 10 | knowing that user's current password. 11 |
12 | ); 13 | }; 14 | 15 | General.propTypes = { 16 | sourceName: PropTypes.string, 17 | sourceType: PropTypes.string, 18 | targetName: PropTypes.string, 19 | targetType: PropTypes.string, 20 | }; 21 | 22 | export default General; 23 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/Formatter.jsx: -------------------------------------------------------------------------------- 1 | export const groupSpecialFormat = (sourceType, sourceName) => { 2 | if (sourceType === 'Group') { 3 | return `The members of the ${typeFormat( 4 | sourceType 5 | )} ${sourceName} have`; 6 | } else { 7 | return `The ${typeFormat(sourceType)} ${sourceName} has`; 8 | } 9 | }; 10 | 11 | export const typeFormat = type => { 12 | if (type === 'GPO' || type === 'OU') { 13 | return type; 14 | } else { 15 | return type.toLowerCase(); 16 | } 17 | }; 18 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GenericAll/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat, typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName, targetType }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} GenericAll 10 | privileges to the {typeFormat(targetType)} {targetName}. 11 |
12 | 13 |14 | This is also known as full control. This privilege allows the 15 | trustee to manipulate the target object however they wish. 16 |
17 | 18 | ); 19 | }; 20 | 21 | General.propTypes = { 22 | sourceName: PropTypes.string, 23 | sourceType: PropTypes.string, 24 | targetName: PropTypes.string, 25 | targetType: PropTypes.string, 26 | }; 27 | export default General; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GenericAll/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This depends on the target object and how to take advantage of this 7 | privilege. Opsec considerations for each abuse primitive are 8 | documented on the specific abuse edges and on the BloodHound wiki. 9 |
10 | ); 11 | }; 12 | 13 | export default Opsec; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GenericWrite/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat, typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName, targetType }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} generic write 10 | access to the {typeFormat(targetType)} {targetName}. 11 |
12 |13 | Generic Write access grants you the ability to write to any 14 | non-protected attribute on the target object, including 15 | "members" for a group, and "serviceprincipalnames" for a user 16 |
17 | 18 | ); 19 | }; 20 | 21 | General.propTypes = { 22 | sourceName: PropTypes.string, 23 | sourceType: PropTypes.string, 24 | targetName: PropTypes.string, 25 | targetType: PropTypes.string, 26 | }; 27 | 28 | export default General; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GenericWrite/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | This depends on the target object and how to take advantage of this 7 | privilege. Opsec considerations for each abuse primitive are 8 | documented on the specific abuse edges and on the BloodHound wiki. 9 |
10 | ); 11 | }; 12 | 13 | export default Opsec; 14 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GetChanges/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} the 10 | DS-Replication-Get-Changes privilege on the domain {targetName}. 11 |
12 |13 | Individually, this edge does not grant the ability to perform an 14 | attack. However, in conjunction with 15 | DS-Replication-Get-Changes-All, a principal may perform a DCSync 16 | attack. 17 |
18 | 19 | ); 20 | }; 21 | 22 | General.propTypes = { 23 | sourceName: PropTypes.string, 24 | sourceType: PropTypes.string, 25 | targetName: PropTypes.string, 26 | }; 27 | 28 | export default General; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GetChanges/LinuxAbuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const LinuxAbuse = () => { 4 | return ( 5 | <> 6 |7 | You may perform a dcsync attack to get the password hash of an 8 | arbitrary principal using impacket's secretsdump.py example script: 9 |
10 | 11 |
12 |
13 | {
14 | "secretsdump.py 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
15 | }
16 |
17 |
18 |
19 | 20 | You can also perform the more complicated ExtraSids attack to 21 | hop domain trusts. For information on this see the blog post by 22 | harmj0y in the references tab. 23 |
24 | 25 | ); 26 | }; 27 | 28 | export default LinuxAbuse; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GetChanges/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | For detailed information on detection of dcsync as well as opsec 7 | considerations, see the adsecurity post in the references tab. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GetChanges/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://adsecurity.org/?p=1729 8 | 9 |7 | With both GetChanges and GetChangesAll privileges in BloodHound, 8 | you may perform a dcsync attack to get the password hash of an 9 | arbitrary principal using mimikatz: 10 |
11 |
12 |
13 | {
14 | 'lsadump::dcsync /domain:testlab.local /user:Administrator'
15 | }
16 |
17 |
18 | 19 | You can also perform the more complicated ExtraSids attack to 20 | hop domain trusts. For information on this see the blog post by 21 | harmj0y in the references tab. 22 |
23 | 24 | ); 25 | }; 26 | 27 | export default WindowsAbuse; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GetChangesAll/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} the 10 | DS-Replication-Get-Changes-All privilege on the domain{' '} 11 | {targetName}. 12 |
13 |14 | Individually, this edge does not grant the ability to perform an 15 | attack. However, in conjunction with DS-Replication-Get-Changes, 16 | a principal may perform a DCSync attack. 17 |
18 | 19 | ); 20 | }; 21 | 22 | General.propTypes = { 23 | sourceName: PropTypes.string, 24 | sourceType: PropTypes.string, 25 | targetName: PropTypes.string, 26 | }; 27 | 28 | export default General; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GetChangesAll/LinuxAbuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const LinuxAbuse = () => { 4 | return ( 5 | <> 6 |7 | You may perform a dcsync attack to get the password hash of an 8 | arbitrary principal using impacket's secretsdump.py example script: 9 |
10 | 11 |
12 |
13 | {
14 | "secretsdump.py 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
15 | }
16 |
17 |
18 |
19 | 20 | You can also perform the more complicated ExtraSids attack to 21 | hop domain trusts. For information on this see the blog post by 22 | harmj0y in the references tab. 23 |
24 | 25 | ); 26 | }; 27 | 28 | export default LinuxAbuse; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GetChangesAll/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | For detailed information on detection of dcsync as well as opsec 7 | considerations, see the adsecurity post in the references tab. 8 |
9 | ); 10 | }; 11 | 12 | export default Opsec; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GetChangesAll/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://adsecurity.org/?p=1729 8 | 9 |7 | With both GetChanges and GetChangesAll privileges in BloodHound, 8 | you may perform a dcsync attack to get the password hash of an 9 | arbitrary principal using mimikatz: 10 |
11 |
12 |
13 | {
14 | 'lsadump::dcsync /domain:testlab.local /user:Administrator'
15 | }
16 |
17 |
18 | 19 | You can also perform the more complicated ExtraSids attack to 20 | hop domain trusts. For information on this see the blog post by 21 | harmj0y in the references tab. 22 |
23 | 24 | ); 25 | }; 26 | 27 | export default WindowsAbuse; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GpLink/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | returnThere is no abuse info related to this edge.
; 5 | }; 6 | 7 | export default Abuse; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GpLink/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, targetName, targetType }) => { 6 | return ( 7 | <> 8 |9 | The GPO {sourceName} is linked to the {typeFormat(targetType)}{' '} 10 | {targetName}. 11 |
12 |13 | A linked GPO applies its settings to objects in the linked 14 | container. 15 |
16 | 17 | ); 18 | }; 19 | 20 | General.propTypes = { 21 | sourceName: PropTypes.string, 22 | targetName: PropTypes.string, 23 | targetType: PropTypes.string, 24 | }; 25 | 26 | export default General; 27 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GpLink/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnThere are no opsec considerations related to this edge.
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/GpLink/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | https://wald0.com/?p=179 7 |7 | No special actions are needed to abuse this, as the kerberos 8 | tickets created will have all SIDs in the object's SID history 9 | attribute added to them; however, if traversing a domain trust 10 | boundary, ensure that SID filtering is not enforced, as SID 11 | filtering will ignore any SIDs in the SID history portion of a 12 | kerberos ticket. 13 |
14 |15 | By default, SID filtering is not enabled for all domain trust 16 | types. 17 |
18 | 19 | ); 20 | }; 21 | 22 | export default Abuse; 23 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/HasSIDHistory/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName, targetType }) => { 6 | return ( 7 | <> 8 |9 | The {typeFormat(sourceType)} {sourceName} has, in its SIDHistory 10 | attribute, the SID for the {typeFormat(targetType)} {targetName} 11 | . 12 |
13 |14 | When a kerberos ticket is created for {sourceName}, it will 15 | include the SID for {targetName}, and therefore grant 16 | {sourceName} the same privileges and permissions as 17 | {targetName}. 18 |
19 | 20 | ); 21 | }; 22 | 23 | General.propTypes = { 24 | sourceName: PropTypes.string, 25 | sourceType: PropTypes.string, 26 | targetName: PropTypes.string, 27 | targetType: PropTypes.string, 28 | }; 29 | 30 | export default General; 31 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/HasSIDHistory/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnNo opsec considerations apply to this edge.
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/HasSession/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |6 | An EDR product may detect your attempt to inject into lsass and 7 | alert a SOC analyst. There are many more opsec considerations to 8 | keep in mind when stealing credentials or tokens. For more 9 | information, see the References tab. 10 |
11 | ); 12 | }; 13 | 14 | export default Opsec; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/MemberOf/Abuse.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Abuse = () => { 4 | return ( 5 |6 | No abuse is necessary. This edge simply indicates that a principal 7 | belongs to a security group. 8 |
9 | ); 10 | }; 11 | 12 | export default Abuse; 13 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/MemberOf/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName }) => { 6 | return ( 7 | <> 8 |9 | The {typeFormat(sourceType)} {sourceName} is a member of the 10 | group {targetName}. 11 |
12 |13 | Groups in active directory grant their members any privileges 14 | the group itself has. If a group has rights to another 15 | principal, users/computers in the group, as well as other groups 16 | inside the group inherit those permissions. 17 |
18 | 19 | ); 20 | }; 21 | 22 | General.propTypes = { 23 | sourceName: PropTypes.string, 24 | sourceType: PropTypes.string, 25 | targetName: PropTypes.string, 26 | }; 27 | 28 | export default General; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/MemberOf/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnNo opsec considerations apply to this edge.
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/MemberOf/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://adsecurity.org/?tag=ad-delegation 8 | 9 |9 | {groupSpecialFormat(sourceType, sourceName)} ownership of the{' '} 10 | {typeFormat(targetType)} {targetName}. 11 |
12 | 13 |14 | Object owners retain the ability to modify object security 15 | descriptors, regardless of permissions on the object's DACL 16 |
17 | 18 | ); 19 | }; 20 | 21 | General.propTypes = { 22 | sourceName: PropTypes.string, 23 | sourceType: PropTypes.string, 24 | targetName: PropTypes.string, 25 | targetType: PropTypes.string, 26 | }; 27 | 28 | export default General; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/ReadGMSAPassword/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 | <> 6 |7 | When abusing a GMSA that is already logged onto a system, you 8 | will have the same opsec considerations as when abusing a 9 | standard user logon. For more information about that, see the 10 | "HasSession" modal's opsec considerations tab. 11 |
12 |13 | When retrieving the GMSA password from Active Directory, you may 14 | generate a 4662 event on the Domain Controller; however, that 15 | event will likely perfectly resemble a legitimate event if you 16 | request the password from the same context as a computer account 17 | that is already authorized to read the GMSA password. 18 |
19 | 20 | ); 21 | }; 22 | 23 | export default Opsec; 24 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/ReadLAPSPassword/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} the ability to read 10 | the password set by Local Administrator Password Solution (LAPS) 11 | on the computer {targetName}. 12 |
13 |14 | The local administrator password for a computer managed by LAPS 15 | is stored in the confidential LDAP attribute, "ms-mcs-AdmPwd". 16 |
17 | 18 | ); 19 | }; 20 | 21 | General.propTypes = { 22 | sourceName: PropTypes.string, 23 | sourceType: PropTypes.string, 24 | targetName: PropTypes.string, 25 | }; 26 | 27 | export default General; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/ReadLAPSPassword/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | return ( 5 |Reading properties from LDAP is an extremely low risk operation.
6 | ); 7 | }; 8 | 9 | export default Opsec; 10 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/ReadLAPSPassword/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf 8 | 9 |
8 | To abuse this privilege with DirSync, first import DirSync into your agent session or into a PowerShell instance at the console. You must authenticate to the Domain Controller as {groupSpecialFormat(sourceType, sourceName)}. Then, execute the Sync-LAPS function:
9 |
12 |
13 | Sync-LAPS -LDAPFilter "(samaccountname={targetName})"
14 |
15 |
16 |
17 |
18 | You can target a specific domain controller using the -Server parameter.
19 |
10 | {groupSpecialFormat(sourceType, sourceName)} the ability to 11 | synchronize the password set by Local Administrator Password 12 | Solution (LAPS) on the computer {targetName}. 13 |
14 | 15 |
16 | The local administrator password for a computer managed by LAPS
17 | is stored in the confidential and Read-Only Domain Controller
18 | (RODC) filtered LDAP attribute ms-mcs-AdmPwd.
19 |
8 | Executing the attack will generate a 4662 (An operation was performed on an object) event at the domain controller if an appropriate SACL is in place on the target object. 9 |
10 | 11 | ) 12 | }; 13 | 14 | export default Opsec; 15 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/SyncLAPSPassword/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | 4 | const References = () => { 5 | return( 6 | <> 7 | https://github.com/simondotsh/DirSync 8 |There is no abuse associated with this edge.
; 5 | }; 6 | 7 | export default Abuse; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/TrustedBy/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | 4 | const General = ({ sourceName, targetName }) => { 5 | return ( 6 | <> 7 |8 | The domain {sourceName} is trusted by the domain {targetName}. 9 |
10 |11 | This edge is informational and does not indicate any attacks, 12 | only that a trust exists. 13 |
14 | 15 | ); 16 | }; 17 | 18 | General.propTypes = { 19 | sourceName: PropTypes.string, 20 | targetName: PropTypes.string, 21 | }; 22 | 23 | export default General; 24 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/TrustedBy/Opsec.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const Opsec = () => { 4 | returnThere is no opsec associated with this edge
; 5 | }; 6 | 7 | export default Opsec; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/TrustedBy/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return <>; 5 | }; 6 | 7 | export default References; 8 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/TrustedBy/TrustedBy.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import { Tabs, Tab } from 'react-bootstrap'; 3 | import General from './General'; 4 | import Abuse from './Abuse'; 5 | import Opsec from './Opsec'; 6 | import References from './References'; 7 | 8 | const TrustedBy = ({ sourceName, sourceType, targetName, targetType }) => { 9 | return ( 10 |6 | To execute this attack, the Rubeus C# assembly needs to be executed 7 | on some system with the ability to send/receive traffic in the 8 | domain. Modification of the 9 | *msDS-AllowedToActOnBehalfOfOtherIdentity* property against the 10 | target also must occur, whether through PowerShell or another 11 | method. The property should be cleared (or reset to its original 12 | value) after attack execution in order to prevent easy detection. 13 |
14 | ); 15 | }; 16 | 17 | export default Opsec; 18 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/WriteDacl/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat, typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName, targetType }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} permissions to 10 | modify the DACL (Discretionary Access Control List) on the{' '} 11 | {typeFormat(targetType)} {targetName} 12 |
13 |14 | With write access to the target object's DACL, you can grant 15 | yourself any privilege you want on the object. 16 |
17 | 18 | ); 19 | }; 20 | 21 | General.propTypes = { 22 | sourceName: PropTypes.string, 23 | sourceType: PropTypes.string, 24 | targetName: PropTypes.string, 25 | targetType: PropTypes.string, 26 | }; 27 | 28 | export default General; 29 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/WriteOwner/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat, typeFormat } from '../Formatter'; 4 | 5 | const General = ({ sourceName, sourceType, targetName, targetType }) => { 6 | return ( 7 | <> 8 |9 | {groupSpecialFormat(sourceType, sourceName)} the ability to 10 | modify the owner of the {typeFormat(targetType)} {targetName}. 11 |
12 |13 | Object owners retain the ability to modify object security 14 | descriptors, regardless of permissions on the object's DACL. 15 |
16 | 17 | ); 18 | }; 19 | 20 | General.propTypes = { 21 | sourceName: PropTypes.string, 22 | sourceType: PropTypes.string, 23 | targetName: PropTypes.string, 24 | targetType: PropTypes.string, 25 | }; 26 | 27 | export default General; 28 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/WriteSPN/General.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import PropTypes from 'prop-types'; 3 | import { groupSpecialFormat, typeFormat } from '../Formatter'; 4 | 5 | const General = ({sourceName, sourceType, targetName, targetType}) => { 6 | return ( 7 |8 | {groupSpecialFormat(sourceType, sourceName)} the ability to write to 9 | the "serviceprincipalname" attribute to the {typeFormat(targetType)}{' '} 10 | {targetName}. 11 |
12 | ); 13 | }; 14 | 15 | General.propTypes = { 16 | sourceName: PropTypes.string, 17 | sourceType: PropTypes.string, 18 | targetName: PropTypes.string, 19 | targetType: PropTypes.string, 20 | }; 21 | 22 | export default General; 23 | -------------------------------------------------------------------------------- /src/components/Modals/HelpTexts/WriteSPN/References.jsx: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | 3 | const References = () => { 4 | return ( 5 | <> 6 | 7 | https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 8 | 9 |Select a node for more information
14 |