├── README.md
├── SharpGraphView.sln
└── SharpGraphView
├── App.config
├── Config.cs
├── FodyWeavers.xml
├── FodyWeavers.xsd
├── Program.cs
├── Properties
└── AssemblyInfo.cs
├── SharpGraphView.csproj
├── bin
└── Release
│ ├── Microsoft.Bcl.AsyncInterfaces.xml
│ ├── Microsoft.Identity.Client.Extensions.Msal.xml
│ ├── Microsoft.Identity.Client.xml
│ ├── Microsoft.IdentityModel.Abstractions.xml
│ ├── Microsoft.IdentityModel.JsonWebTokens.xml
│ ├── Microsoft.IdentityModel.Logging.xml
│ ├── Microsoft.IdentityModel.Tokens.xml
│ ├── Microsoft.Rest.ClientRuntime.Azure.xml
│ ├── Microsoft.Rest.ClientRuntime.xml
│ ├── Newtonsoft.Json.xml
│ ├── SharpGraphView.exe
│ ├── SharpGraphView.exe.config
│ ├── SharpGraphView.pdb
│ ├── System.Buffers.xml
│ ├── System.ClientModel.xml
│ ├── System.Diagnostics.DiagnosticSource.xml
│ ├── System.IO.FileSystem.AccessControl.xml
│ ├── System.IdentityModel.Tokens.Jwt.xml
│ ├── System.Memory.Data.xml
│ ├── System.Memory.xml
│ ├── System.Numerics.Vectors.xml
│ ├── System.Runtime.CompilerServices.Unsafe.xml
│ ├── System.Security.AccessControl.xml
│ ├── System.Security.Cryptography.ProtectedData.xml
│ ├── System.Security.Principal.Windows.xml
│ ├── System.Text.Encodings.Web.xml
│ ├── System.Text.Json.xml
│ ├── System.Threading.Tasks.Extensions.xml
│ └── System.ValueTuple.xml
├── obj
├── Debug
│ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs
│ ├── DesignTimeResolveAssemblyReferencesInput.cache
│ └── SharpGraphView.csproj.AssemblyReference.cache
└── Release
│ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs
│ ├── Costura
│ ├── 0F467F9BB142FD6BB8D3008B313DF15254825B22.costura.microsoft.rest.clientruntime.azure.dll.compressed.compressed
│ ├── 17A49D2B673E1C9F1CF0416ACE86102AD97D0B93.costura.system.clientmodel.dll.compressed.compressed
│ ├── 180A7BAAFBC820A838BBACA434032D9D33CCEEBE.costura.system.runtime.compilerservices.unsafe.dll.compressed.compressed
│ ├── 18EA7BD41D31247148ABF184527C9368A26F39E7.costura.system.io.filesystem.accesscontrol.dll.compressed.compressed
│ ├── 1E76E6099570EDE620B76ED47CF8D03A936D49F8.costura.newtonsoft.json.dll.compressed.compressed
│ ├── 2242627282F9E07E37B274EA36FAC2D3CD9C9110.costura.system.threading.tasks.extensions.dll.compressed.compressed
│ ├── 28465FD34680A082506F160107F350B46140A1AA.costura.system.security.accesscontrol.dll.compressed.compressed
│ ├── 2F410A0396BC148ED533AD49B6415FB58DD4D641.costura.system.buffers.dll.compressed.compressed
│ ├── 39656DD256F63A30C5D92D222459DDCB9BD090B8.costura.microsoft.azure.keyvault.cryptography.dll.compressed.compressed
│ ├── 3B34715164D27A039AC3E7966D4F7F1888098726.costura.system.diagnostics.diagnosticsource.dll.compressed.compressed
│ ├── 3BB0525BE6130AAFA2A14A682809A83728C2BE0B.costura.microsoft.bcl.asyncinterfaces.dll.compressed.compressed
│ ├── 3C5C5DF5F8F8DB3F0A35C5ED8D357313A54E3CDE.costura.system.memory.dll.compressed.compressed
│ ├── 3C8990726CDD9EC04AE001E32DE7B3D9DD7CA1AB.costura.system.management.automation.dll.compressed.compressed
│ ├── 3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0.costura.system.numerics.vectors.dll.compressed.compressed
│ ├── 4B0229A22589FE75D6C83724B77DE4024E25763D.costura.azure.identity.dll.compressed.compressed
│ ├── 5F49CE223A6FD3DE92B15808166DD2FADF42382B.costura.system.security.cryptography.protecteddata.dll.compressed.compressed
│ ├── 6AFEA53A124309753508996A708FFDFE4A1EBF32.costura.microsoft.azure.keyvault.core.dll.compressed.compressed
│ ├── 6C6000A5EAF8579850AB82A89BD6268776EB51AD.costura.costura.pdb.compressed.compressed
│ ├── 7D8264BE4FCB17F81ACB8B1ADD980CD96A6FD856.costura.microsoft.bcl.asyncinterfaces.dll.compressed.compressed
│ ├── 85DC92EDD4B0049ED9049E075C4DEF8A3D64E43B.costura.system.diagnostics.diagnosticsource.dll.compressed.compressed
│ ├── 8BEB16D082D7A1D2167AECA767AC4439B5807A01.costura.microsoft.identitymodel.abstractions.dll.compressed.compressed
│ ├── 94C56BFAC87ED8E2E4CD19B16AD207F21ABE7B62.costura.azure.core.dll.compressed.compressed
│ ├── 9A5BE1FCF410FE5934D720329D36A2377E83747E.costura.system.security.principal.windows.dll.compressed.compressed
│ ├── 9DABAA985AB92C2B5F8C3615FC35F7AC1D0CD8C6.costura.system.identitymodel.tokens.jwt.dll.compressed.compressed
│ ├── A9A36A7FF7463BA945E61D1AD1585439C5E0A84C.costura.system.runtime.compilerservices.unsafe.dll.compressed.compressed
│ ├── B1144A892338B90D6FC31704F7828590EDC34F58.costura.system.text.json.dll.compressed.compressed
│ ├── B3EE776373E226C8CF3201157E5DF9F966266B15.costura.system.memory.data.dll.compressed.compressed
│ ├── CC35F06B54A4B09C3FFEC6F2E9EA22293F5F5529.costura.microsoft.identitymodel.jsonwebtokens.dll.compressed.compressed
│ ├── CF7E2D61A33A4DFE686C96EA75E469CB8D9D68BD.costura.microsoft.rest.clientruntime.dll.compressed.compressed
│ ├── D1664731719E85AAD7A2273685D77FEB0204EC98.costura.system.valuetuple.dll.compressed.compressed
│ ├── E27922C42135475FB0DB26D9816101B549D65AE3.costura.system.text.encodings.web.dll.compressed.compressed
│ ├── ECE1552E05009275FD9A34872D627C6CB5DF705B.costura.microsoft.identitymodel.tokens.dll.compressed.compressed
│ ├── EF2DD3C4DCDEAA87724FCC8D888538D77BBCA471.costura.microsoft.identity.client.extensions.msal.dll.compressed.compressed
│ ├── F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906.costura.costura.dll.compressed.compressed
│ ├── F936A3BAC7ADDBD8D3AB46827AC9F306F93042E6.costura.microsoft.identity.client.dll.compressed.compressed
│ └── FA8958681397C389855CAB28F0AE17FB0B54DE59.costura.microsoft.identitymodel.logging.dll.compressed.compressed
│ ├── DesignTimeResolveAssemblyReferencesInput.cache
│ ├── SharpGra.20B14D14.Up2Date
│ ├── SharpGraphView.csproj.AssemblyReference.cache
│ ├── SharpGraphView.csproj.CoreCompileInputs.cache
│ ├── SharpGraphView.csproj.FileListAbsolute.txt
│ ├── SharpGraphView.csproj.Fody.CopyLocal.cache
│ ├── SharpGraphView.exe
│ └── SharpGraphView.pdb
└── packages.config
/README.md:
--------------------------------------------------------------------------------
1 | # SharpGraphView
2 |
3 | ## READ-ONLY: Please see [Graphpython](https://github.com/mlcsec/Graphpython) for a more comprehensive solution covering everything from SharpGraphView and much more
4 |
5 | Sharp post-exploitation toolkit providing modular access to the Microsoft Graph API (*graph.microsoft.com*) for cloud and red team operations.
6 |
7 | Created during the [Advanced Azure Cloud Attacks Lab](https://www.alteredsecurity.com/azureadvanced). Inspired by [GraphRunner](https://github.com/dafthack/GraphRunner) and [TokenTactics](https://github.com/rvrsh3ll/TokenTactics).
8 |
9 |
10 | ## Index
11 |
12 | - [Updates](#Updates)
13 | - [Build](#Build)
14 | - [Usage](#Usage)
15 | - [Flags](#Flags)
16 | - [Methods](#Methods)
17 | - [Auth Methods](#Auth-methods)
18 | - [Post-Auth Methods](#post-auth-methods)
19 | - [Demo](#Demo)
20 | - [Get-GraphTokens](#Get-GraphTokens)
21 | - [Invoke-RefreshToAzureManagementToken](#Invoke-RefreshToAzureManagementToken)
22 | - [Invoke-RefreshToMSGraphToken](#Invoke-RefreshToMSGraphToken)
23 | - [Invoke-RefreshToVaultToken](#Invoke-RefreshToVaultToken)
24 | - [Invoke-CertToAccessToken](#Invoke-CertToAccessToeken)
25 | - [Get-TokenScope](#Get-TokenScope)
26 | - [New-SignedJWT](#New-SignedJWT)
27 | - [Observations](#Observations)
28 | - [Common HTTP Error Codes](#Common-HTTP-Error-Codes)
29 |
30 |
31 |
32 | # Build
33 |
34 | Compiled executable in `bin/Release` is ready to go.
35 |
36 | If loading and building for the first time select the 'Restore' button in VS (may need to add and use [nuget.org](https://learn.microsoft.com/en-us/nuget/consume-packages/install-use-packages-visual-studio#package-sources) as a package source then update any packages via `References` > `Manage NuGet Packages...` > `Updates`)
37 |
38 | 
39 |
40 |
41 | The following packages are required:
42 |
43 | - Newtonsoft.Json
44 | - Costura.Fody
45 |
46 |
47 |
48 | # Usage
49 |
50 | > All methods and flags are case-insensitve. Method must be the first argument, flags are position-independent.
51 |
52 | ```
53 | SharpGraphView by @mlcsec
54 |
55 | Usage:
56 |
57 | SharpGraphView.exe [Method] [-Domain ] [-Tenant ] [-Id