v0.5.0

v0.5.0 Release

First beta release of Entruder, a comprehensive unified Python framework for authorized offensive security testing against Microsoft Entra ID tenants and general Azure environments. The tool aims to unify all testing techniques commonly done through various PowerShell modules against a tenant via an "all-in-one" framework, analogous to how NetExec or BloodyAD function against Active Directory domains.

Supported features

Currently version 1.0.0 holds 9 unique modules, with each respective module containing their own commands. Additionally, Entruder features file caching functionalities for access tokens, tenant and client ids, meaning testers won't have to re-specify them explicitly on every command once an initial authentication is performed.

Included modules are:

• login - Authentication flows: device code, ROPC, authorization code with PKCE, FOCI family token abuse, certificate, Kerberos ticket, refresh token, client secret, and raw JWT access token injection
• brute - Offensive enumeration and spraying: user enumeration, password spraying, MFA gap detection across resource planes, User-Agent Conditional Access gap discovery, and public storage container discovery
• enum - Directory and Azure resource enumeration: users, groups, roles, Administrative Units, Conditional Access Policies, app registrations, service principals, OAuth2 delegated permission grants, devices, storage accounts, Key Vaults, automation accounts, RBAC role assignments, function apps, web applications, and Azure subscriptions
• get - Targeted data extraction commands: Key Vault secret values, SharePoint and OneDrive file downloads, mailbox content, Automation runbook source code, storage blob downloads, and managed identity token acquisition via IMDS (must be run on an Azure resource with a managed identity attached)
• set - Manipulating attributes for resources and users: user password reset, group membership, directory role assignment, application role grants, client secret creation, and application ownership assignment, RBAC role assignments on resources
• exploit - Compute exploitation for managed identity token extraction: App Service via Kudu SCM, Automation Accounts via malicious runbook execution, and Function Apps via runtime-aware zip deployment
• azsync - Azure AD Connect hybrid attack chain: ADSync database credential extraction and Global Administrator tenant takeover via the Directory Synchronization Accounts role
• sharepoint - SharePoint site enumeration and cross-tenant file search via the Microsoft Search API
• info - Offline utilities: JWT decoding and analysis with privilege tier classification, FOCI family detection, and known Microsoft client ID lookup (the tool allows for inputting aliases instead of explicit client ids)