v1.9.0

AWS

New commands:

• ecs-tasks - List all ecs tasks. This returns a list of ecs tasks and associated cluster, task definition, container instance, launch type, and associated IAM principal. (thanks @DominicBreuker)
• elastic-network-interfaces - List all eni information. This returns a list of eni ID, type, external IP, private IP, VPCID, attached instance and a description. (thanks @DominicBreuker)
• eks - List all EKS clusters, see if they expose their endpoint publicly, and check the associated IAM roles attached to reach cluster or node group. Generates a loot file with the aws eks udpate-kubeconfig command needed to connect to each cluster.
• pmapper - Looks for pmapper data stored on the local filesystem, in the locations defined here. If pmapper data has been found (you already ran pmapper graph create), then this command will use this data to build a graph in cloudfox memory let you know who can privesc to admin.

Updates:

• Less errors: Cloudfox aws now avoids making queries to a region if a service is not supported there, and when regions are administratively disabled.
• Role Insights: instances, lambda, eks, ecs-tasks, and role-trusts commands now look for pmapper data, and if it exists, these commands will use the pmapper data and tell you 1) if the role attached to the workload is an admin, and 2) if the role can privesc to admin. If there is no pmapper data, cloudfox will use the iam-simulator command to at least tell you if the role is an admin.
• Role-trusts now shows federated role trusts (was missing earlier)

Azure

New Commands

• whoami - The whoami command displays information on the current tenant, subscriptions and resource groups available to your current Azure CLI session. This is useful to provide situation awareness on what tenant and subscription IDs to use with the other sub commands.
• storage - The storage command is still under development. Currently it only displays limited data about the storage accounts as shown in the examples below.

Updated Commands

• instances - The instances command enumerates the Compute instances' userful information at subscription or tenant level
• rbac - The rbac command maps the Azure RBAC role assignments at subscription or tenant level

Other updates

• Update inputs, outputs and UI to match the AWS command standards

Commits

• 3e3a9e8: Refactored some Azure authentication code (carlosvendramini-bf) #23
• 61da828: Added RG code to build a RG selector in Azure (carlosvendramini-bf) #23
• e919c3c: menu function for azure and test cases (carlosvendramini-bf) #23
• 5ec6101: refactored some azure client code (carlosvendramini-bf) #23
• 206542f: wrote an interactive menu for Azure (carlosvendramini-bf) #23
• e877139: refactoring azure instances command (carlosvendramini-bf) #23
• fe3a09a: finished refactoring az instances code, still need to add menu (carlosvendramini-bf) #23
• 0e12ca2: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• d9b5c13: adjusted azure test cases (carlosvendramini-bf) #23
• b2033c0: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 7641a3e: adjusting menu for rg selection in azure (carlosvendramini-bf) #23
• 0e8febd: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• dfae1ce: drafted a test for the AWS ecr command (carlosvendramini-bf) #23
• 36740bc: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 63e9338: changed order of code for readability (carlosvendramini-bf) #23
• 3b26a03: added carlos's test for ecr (sethsec-bf) #18
• 1caa02c: Merge branch 'main' of github.com:BishopFox/cloudfox into seth-dev (sethsec-bf) #18
• e1af1b8: sync lambda moduel to origin (sethsec-bf) #18
• 7cb4ba3: added exclusion for vscode launch files (carlosvendramini-bf) #23
• 73da61e: removed sample aws ecr unit tests (carlosvendramini-bf) #23
• d1d335f: azure interactive scope menu now returns subscription and rg (carlosvendramini-bf) #23
• 1926e2a: almost finished refactoring az instances, still some bugs (carlosvendramini-bf) #23
• 127f2c0: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• a7cccdb: added better tests for azure instances command (carlosvendramini-bf) #23
• 5e7bfb3: created a constants package and moved azure and utils constants there (carlosvendramini-bf) #23
• 4a992d3: added identifier prefix to OutputSelector, it now prints [module][identifier] (carlosvendramini-bf) #23
• e262dae: added buckets test, fixed ecr test (sethsec-bf) #18
• 18a500f: fixed some bugs with az instances, still need to add sub and rg filters to az instances cli (cvendramini2) #23
• 59a7bd5: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• f2cdf4d: add code for the ecs-tasks and elastic-network-interfaces commands (Dominic Breuker) #16
• 8fbfb38: added unit tests for aws ecs-tasks and elastic-network-interfaces (carlosvendramini-bf) #16
• d67a017: ecs-tasks and eni commands added to all-checks (carlosvendramini-bf) #16
• b1cff22: ecs-tasks and eni command ready to merge. Thank you @DominicBreuker! (carlosvendramini-bf) #16
• 8c00a82: updated AWS module count (carlosvendramini-bf)
• 5a71948: updated new modules to use the new cobra pattern (sethsec-bf) #18
• 6832898: adjusted azure instances test cases, moved test data to json files (carlosvendramini-bf) #23
• 037172c: added azure function to retrieve subscription for any given available resource group (carlosvendramini-bf) #23
• 0cce677: new azure instances modes: single subscription, resource group or interactive mode (carlosvendramini-bf) #23
• ee151be: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 72ce4f6: small outpuf fix for aws ecs-tasks and eni commands (carlosvendramini-bf) #23
• c450480: adjusted logging to no longer create a secondary logging file (carlosvendramini-bf) #23
• d460e63: added help menu use cases for azure commands (carlosvendramini-bf) #23
• 90261dd: added functions to set clients for azure rbac command (carlosvendramini-bf) #23
• 924c9db: added functions and test data for Azure RBAC command API calls (carlosvendramini-bf) #23
• 964dd5e: added tenants to azure scope functionality and test cases (carlosvendramini-bf) #23
• b92f61d: refactored some azure menu and scoping code to acommodate the new rbac command (carlosvendramini-bf) #23
• 274f16f: various bug fixes and code improvements (carlosvendramini-bf) #23
• 732ae09: rename constants package to globals (carlosvendramini-bf) #23
• f042e07: azure instances command adjustments (carlosvendramini-bf) #23
• ae3ac75: adjusted azure rbac command test template (carlosvendramini-bf) #23
• b8608a1: adjusted azure rbac command test template (carlosvendramini-bf) #23
• 8f76cd9: adjusted azure rbac mocks (carlosvendramini-bf) #23
• 129a8ce: added az rbac function to cross reference and get relevant data (carlosvendramini-bf) #23
• 13ae4b9: added rg and sub filters for az rbac command (carlosvendramini-bf) #23
• d179e8d: added az rbac command to cli (carlosvendramini-bf) #23
• 06029e8: when invoking az without flags the helper displays logged in sessions (carlosvendramini-bf) #23
• 9d826de: added function to fetch all az storage accounts data and its test templates (carlosvendramini-bf) #23
• 5fde076: adjusted package permissions for azure functions (carlosvendramini-bf) #23
• 11eb8b3: Updated data receiver to use a close instead of a done message (sethsec-bf) #23
• 3c4612b: Added enabled region check. Added awsservicemap package functionality (sethsec-bf) #23
• 8f02f3b: Removed Wyatt's network ports command file from my branch so that it is fresh when the PR gets merged (sethsec-bf) #23
• e509639: fixed compile bug in these azure modules after i upgraded go modules. carlos is rewriting them so this should just get overwritten on his next merge (sethsec-bf) #23
• 0ced510: added awsservicemap logic to inventory module (sethsec-bf) #23
• 09e59bb: fixed bug in env-vars ecs where it would have missed every region other than us-east-1. Also, updated the logic to pull one (the latest) active task definition for each family instead of every active veresion of the same definition. (sethsec-bf) #23
• 0f1e003: added awsservicemap logic to the rest of the applicable modules (sethsec-bf) #23
• 9cba6bd: Added isAdmin check to role-trusts module (sethsec-bf) #23
• 86dde7e: Added isAdmin check to ecs-tasks command (sethsec-bf) #23
• 56def9b: Switched a bunch of commands to accept API interfaces to facilitate future tests (sethsec-bf) #23
• c567c4f: az instances code cleanup (carlosvendramini-bf) #23
• a61ff6b: Update README.md (tragulum) #20
• 39626e4: az instances code cleanup (carlosvendramini-bf) #23
• ecb41d5: az rbac bug fix: code was not enumerating multiple subscriptions in a tenant (carlosvendramini-bf) #23
• e9d37e9: az rbac code cleanup (carlosvendramini-bf) #23
• 5b8abcd: az storage test adjustments (carlosvendramini-bf) #23
• 053fc3a: 2nd Update to ReadMe (Jsn Yrty) #20
• a0ee41f: added az whoami command (cvendramini2) #23
• ac4552d: added cloudfox-output folder to .gitignore (cvendramini2) #23
• 66fa97e: fixed az rbac bug that was passing subID instead of tenantID to getAzureADUsers function (cvendramini2) #23
• 43acb68: Updated to use v0.0.5 of awsservicemap, fixed bug in ecs-tasks when called from all-checks (sethsec-bf) #23
• 5cad2b7: working on az storage command (carlosvendramini-bf) #23
• 383d28a: remove pmapper poc command (sethsec-bf) #23
• ff04f26: merged seth-dev into carlos-dev (carlosvendramini-bf) #23
• 3365c99: remove pmapper poc command (sethsec-bf) #23
• 97ec9f5: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 73207a7: switching out awsservicemap constructor for normal sturct instatiation (sethsec-bf) #23
• d455f4c: fixed bug where the multi profile cli options were not using the new enabledregions check. (sethsec-bf) #23
• 846f28e: fixed bug where the multi profile cli options were not using the new enabledregions check. (sethsec-bf) #23
• 433f54d: changing inputs of az instances to accept only tenant id or sub id (carlosvendramini-bf) #23
• d5de698: first draft of eks command (sethsec-bf) #23
• 8dc3304: refactored eks command a bit to seperate functions (sethsec-bf) #23
• e56634d: updated awsservicemap mod to v1.0.0 (sethsec-bf) #23
• 5d8e9e9: az instances and rbac now only take tenant ID and sub ID for input (carlosvendramini-bf) #23
• 3d7bf08: changed output for az whoami command (carlosvendramini-bf) #23
• 1762753: first version of az storage done and code cleanup on all az commands (carlosvendramini-bf) #23
• 2f518c9: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 8ed67ea: small correction on az instances output (carlosvendramini-bf) #23
• 6bbc528: fixed a syntax error with utils.OutputSelector in the aws eks command (cvendramini2) #23
• 0ea1895: fixed a segmentation fault bug in the az instances module caused by nil public ip objects (cvendramini2) #23
• 4b424a3: refactored eks command to seperate functions (sethsec-bf) #23
• 56e265b: finished a good enough update of role-trusts to show federated roles and helpful context about the trusted subjects. (sethsec-bf) #23
• b1dc875: added --skip-admin-checks flag for all modules that do admin role checks (sethsec-bf) #23
• 2007026: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 385bf52: second draft of pmapper command. Replaced isRoleAdmin check in instances and lambda commands to use pmapper if pmapper data is available, and to fall back to iam-simulator as needed (sethsec-bf) #23
• d8488e1: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 2c17ad1: fixed missing prefixIdentifier for OutputSelector for aws principal and pmapper modules (carlosvendramini-bf) #23
• ded97a0: az whoami command now has an --extended flag for more detailed output (carlosvendramini-bf) #23
• a5c5ec9: Updated all workload commands to use shared functions rather than having to add the same methods to each command (sethsec-bf) #23
• 91976b8: Updated all workload commands to use shared functions rather than having to add the same methods to each command (sethsec-bf) #23
• 5a6e5c1: removed some commented lines (sethsec-bf) #23
• 362fa0c: added --wrap flag for table wrapping. Also added EKS and pmapper commands to all-checks (sethsec-bf) #23
• 1e275d3: added --wrap flag for table wrapping (sethsec-bf) #23
• 1c12c84: Merge branch 'main' of github.com:BishopFox/cloudfox into seth-dev (sethsec-bf) #23
• afbe710: added --wrap flag for table wrapping (sethsec-bf) #23
• 1c334b5: refactored buckets and cloudformation commands to seperate out AWS SDK calls into their own functions (sethsec-bf) #23
• 529d632: Merge remote-tracking branch 'origin/seth-dev' into carlos-dev (carlosvendramini-bf) #23
• 8f3c24e: added eks test (sethsec-bf) #23
• 6777ef2: adjusted --wrap flag to measure terminal, file outputs are no longer wrapped (carlosvendramini-bf) #23
• 0032392: updated eks interface in cli/aws.go (sethsec-bf) #23
• 9b5b9fa: updated test for ecs-tasks (sethsec-bf) #23
• a8103f1: added cloudformation test (sethsec-bf) #23
• c2b7a50: Merge branch 'carlos-dev' into seth-dev (sethsec-bf) #23
• c60c337: added privesc check to eks command (sethsec-bf) #23
• 376e1da: fixed some code warnings (sethsec-bf) #23
• 05bcf9c: fixed some code warnings (sethsec-bf) #23
• d92e8bb: fixed some code warnings (sethsec-bf) #23
• 9f0d99a: renamed utils package to internal (carlosvendramini-bf) #23
• c013090: added switch flag to az module test cases (carlosvendramini-bf) #23
• 63d9327: updated eks test (sethsec-bf) #23
• fff3985: Merge branch 'carlos-dev' into seth-dev (sethsec-bf) #23
• c9daf18: fixed bug in ecs-tasks that caused segfault because the interface was not correct (sethsec-bf) #23
• 097baa0: moved spinner and commandcounter to new internal directory, removing need for console directory (sethsec-bf) #23
• d4eb166: added back aquatable setting to not wrap unless we use our own wrap function (sethsec-bf) #23
• c52a22c: added acceptance test using t.Run to ecs-tasks_test.go (sethsec-bf) #23
• b537c62: fixed bug in eks where it was only reproting on clusters that have node groups. (sethsec-bf) #23
• 840e3d3: removed --extended flag from az whoami command, now everything displays in one table (carlosvendramini-bf) #23
• a9553c4: fixed a segmentation fault bug with az commands (carlosvendramini-bf) #23
• 1bb3bde: code cleanup for 1.9.0 release (carlosvendramini-bf) #23
• 3fe4ac6: added back in prefix to output selector. Reverted back to select channel for receiver in all aws commands because the new way was losing data (sethsec-bf) #23
• d7634a8: Added link to WIKI for each AWS command (sethsec-bf) #23
• 44311b5: removed beta designation from Azure section (sethsec-bf) #23
• f90a52c: Update README.md (Seth Art)