Skip to content

GraphRunner.ps1

Jump to bottom
Beau Bullock edited this page Sep 3, 2023 · 39 revisions

GraphRunner.ps1

GraphRunner includes a PowerShell set of tools to assist with carrying out various attacks during post-exploitation of a Microsoft Entra ID (Azure AD) tenant. Most of the modules rely on having authenticated access tokens. To assist with this there are multiple modules for obtaining and working with both user and application (service principal) tokens.

To get started, import GraphRunner into a new PowerShell session.

Import-Module .\GraphRunner.ps1

Authentication

  • Get-GraphTokens - Authenticate as a user to Microsoft Graph
  • Invoke-RefreshGraphTokens - Use a refresh token to obtain new access tokens
  • Get-AzureAppTokens - Complete OAuth flow as an app to obtain access tokens
  • Invoke-RefreshAzureAppTokens - Use a refresh token and app credentials to refresh a token
  • Invoke-AutoOAuthFlow - Automates OAuth flow by standing up a web server and listening for auth code
  • Invoke-CheckAccess - Check if tokens are valid

Recon & Enumeration Modules

  • Invoke-GraphRecon - Performs general recon for org info, user settings, directory sync settings, etc
  • Invoke-DumpCAPS - Gets conditional access policies
  • Invoke-DumpApps - Gets app registrations and external enterprise apps along with consent and scope info
  • Get-AzureADUsers - Gets user directory
  • Get-SecurityGroups - Gets security groups and members
  • Invoke-GraphOpenInboxFinder - Checks each user’s inbox in a list to see if they are readable

Persistence Modules

  • Invoke-InjectOAuthApp - Injects an app registration into the tenant
  • Invoke-SecurityGroupCloner - Clones a security group while using an identical name and member list but can inject another user as well
  • Invoke-InviteGuest - Invites a guest user to the tenant
  • Invoke-DeleteOAuthApp - Delete an OAuth App

Pillage Modules

  • Invoke-SearchSharePointAndOneDrive - Search across all SharePoint sites and OneDrive drives visible to the user
  • Invoke-SearchMailbox - Has the ability to do deep searches across a user’s mailbox and can export messages
  • Invoke-SearchTeams - Can search all Teams messages in all channels that are readable by the current user.
  • Invoke-SearchUserAttributes - Search for terms across all user attributes in a directory
  • Get-Inbox - Gets inbox items

Invoke-GraphRunner Module

  • Invoke-GraphRunner - Runs Invoke-GraphRecon, Get-AzureADUsers, Get-SecurityGroups, Invoke-DumpCAPS, Invoke-DumpApps, and then uses the default_detectors.json file to search with Invoke-SearchMailbox, Invoke-SearchSharePointAndOneDrive, and Invoke-SearchTeams.

Clone this wiki locally