A unified client-server platform for Azure & Microsoft 365 security assessment
Designed for authorized penetration testing, red team operations, and security research.
ANIMO is a comprehensive Azure AD / Entra ID assessment platform that combines PowerShell-based session management, Azure CLI parity, and native Graph / ARM API integration. It gives red teamers a single interface to manage multiple Azure sessions, capture and manipulate tokens, enumerate cloud resources, and execute post-exploitation techniques during authorized engagements with WhoAmI-driven autofill so Post-Exploit modules pre-populate from what you already know about the identity.
- Manage multiple Azure PowerShell + az cli sessions simultaneously from one dashboard
- Capture, exchange, mint, and analyze OAuth tokens (access, refresh, PRT, SAS)
- Discovery: WhoAmI with derived Capability verdicts + fine-grained ARM action enumeration
- Seamless autofill WhoAmI findings flow into Post-Exploitation modules with zero re-typing
- Access Outlook, Calendar, Teams, OneDrive, SharePoint, Storage, Key Vault through Graph / ARM
- Enumerate subscriptions, VMs, SQL, Function Apps, Logic Apps, Automation Runbooks and more
- Remote Exec framework: pluggable transports for Azure VM runCommand, uploaded HTTP webshells, and SSTI payload injection (Jinja2 / Twig / Freemarker / Velocity / ERB)
- Fresh Entra device registration (DRS) for cert-based persistence
- Auth-method persistence: TAP issuance, backdoor phone / email / OATH
- Password / SPN / refresh-token sprays
- AES-256-GCM encrypted session persistence with auto-restore on restart
- Professional engagement report generation with session timelines
| Requirement | Version |
|---|---|
| OS | Linux (Kali recommended, build verified), macOS, or Windows natively or via WSL2 |
| Qt6 | 6.2+ (Widgets, Network, WebEngineWidgets, Sql; plus the Svg image plugin for the app icon) |
| CMake | 3.16+ |
| PowerShell | 7.x (pwsh) |
| Azure CLI | 2.x (az) optional but recommended for parity |
| Python | 3.8+ with msal, requests |
# Clone the repository
git clone https://github.com/dmcxblue/ANIMO.git
cd ANIMO
# Install system dependencies (Debian / Ubuntu / Kali)
./install-dependencies.sh
# Install PowerShell modules
pwsh -File Install-AllModules.ps1
# Build
./build.shThe CMake project is cross-platform and Install-AllModules.ps1 runs on both
platforms, but the build itself is currently only verified on Linux. On Windows,
install the prerequisites yourself and invoke CMake directly:
# Prerequisites (via winget, or the Qt Online Installer for Qt itself)
winget install -e --id Kitware.CMake
winget install -e --id Ninja-build.Ninja
winget install -e --id ShiningLight.OpenSSL.Light
# Qt 6.2+ with the Qt WebEngine and Qt SQL modules, plus MSVC (Visual Studio
# Build Tools with the C++ workload). Note the Qt install prefix.
# PowerShell modules
pwsh -File Install-AllModules.ps1
# Configure and build - point CMAKE_PREFIX_PATH at your Qt6 install
cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Release `
-DCMAKE_PREFIX_PATH="C:/Qt/6.7.2/msvc2019_64"
cmake --build buildBinaries land in build\server\AnimoServer.exe and build\client\AnimoClient.exe.
The hardening flags in the top-level CMakeLists.txt are GCC/Clang-only and are
skipped under MSVC. build.sh and clean.sh are bash scripts use the CMake
commands above, or run them from WSL2.
# Start the server
./build/server/AnimoServer -i 0.0.0.0 -p 7777 -P <YourPassword>
# Start the client (separate terminal)
./build/client/AnimoClientConnect to the server using the client login window with your server IP, port, and password.
Modules are organised by the menu the operator uses to reach them.
Login flows that turn credentials, tokens, or consent grants into an authenticated ANIMO session.
Runs the OAuth 2.0 device-code flow so the operator can send the microsoft.com/devicelogin URL + code to a target. When the target authenticates, the captured access / refresh token is auto-logged and (optionally) becomes a full server session. Supports specifying the target resource (Graph, Management, Key Vault, Storage, custom).
Direct username-and-password login via MSAL's Resource Owner Password Credentials flow. Bootstraps both Az PowerShell (Connect-AzAccount -Credential) and Azure CLI (az login -u -p) in the session terminal so both toolchains have valid contexts. Includes a resource dropdown (Management / Graph / Key Vault / Storage / SQL / custom).
Paste an existing access token (with optional refresh token) to instantiate a session without re-authentication. The token's aud claim determines the resource; the JWT is parsed for identity / expiry so the session dashboard row is populated correctly.
Sign in as a Service Principal using {appId, clientSecret, tenantId}. Runs Connect-AzAccount -ServicePrincipal + az login --service-principal, then enumerates the SPN's subscriptions and pins the first one for scope-less cmdlets to work out of the box. Resource dropdown supports Management / Graph / Key Vault / Storage / SQL.
Serves an OAuth consent page from a local listener, capturing the code exchange when a target grants consent to a rogue app. Configurable redirect URI, scopes, and port; the resulting tokens are auto-logged and optionally converted to a session.
Standalone HTTP listener that receives tokens posted by external implants (e.g. GrabTokenAzureAD, Get-UserPRTToken). Modes: capture all tokens / PRT-only / access-refresh-only every captured token drops into the Token Log automatically.
Fine-grained token manipulation across resources.
Exchange a refresh token for new access tokens against arbitrary Microsoft resources. Handy for pivoting from a Graph refresh token into a Management or Key Vault token when the audience-scope you originally obtained isn't what you need next.
Redeem a Primary Refresh Token to mint arbitrary-resource access tokens via the x-ms-RefreshTokenCredential cookie flow. Automates the exchange loop and drops the resulting tokens into the Token Log tagged with the user + resource.
Converts a captured SSO cookie (e.g. ESTSAUTHPERSISTENT) into a bearer access token via the OAuth authorization-code flow. Useful when the only credential material you have is a browser cookie.
Bulk credential guessing and app-secret injection.
Sprays a single password against a userlist targeting the legacy MSOL endpoint. Configurable per-attempt delay to stay under lockout thresholds; results table highlights valid credentials as they land.
Serial spray of {clientId, clientSecret} combinations against a tenant's OAuth2 token endpoint. Loads client-id / secret files or accepts a single pair; tenant field auto-fills from the last WhoAmI snapshot.
Tests a single refresh token against ~10 curated Microsoft first-party app IDs from helpers/auth_apps.json, identifying which apps accept it. Reports scopes granted for each successful app and can auto-check for privileged permissions.
Adds a new client secret (or certificate credential) to an Azure AD Application registration. Requires an owner or Application Administrator role on the target app; the new secret can be immediately used to obtain SPN tokens.
Enumeration of directory objects, RBAC assignments, tenant policies, and cloud resources.
Comprehensive read-only identity dump for the selected session: identity + JWT claims, groups, admin roles (active + PIM eligible), owned objects, Azure RBAC assignments across every accessible subscription, auth methods, licenses, OAuth grants, and token permissions. Includes a Capabilities tab with derived yes/no verdicts (register apps, run VM commands, reset passwords, grant admin consent, etc.) and a fine-grained ARM actions tree enumerated via az role assignment list + az role definition list that catches custom roles with Microsoft.Authorization/roleAssignments/write and similar. Publishes findings to WhoAmiInsights so downstream Post-Exploitation modules autofill their fields.
Single POST /v1.0/search/query returns hits across OneDrive / SharePoint (driveItem), mail (message), Teams (chatMessage), calendar (event), and sites the fastest way to hunt for credentials with keywords like password | secret | vpn. Results grouped by entity type; CSV / JSON export.
Enumerates every Azure subscription the identity can reach and, per subscription, the resources within (VMs, Storage, Key Vaults, App Services, SQL, etc.). Highlights resources with managed identities and includes IMDS attack hints for those.
Reads the tenant's Conditional Access policies via Graph and displays them in a structured tree with an analysis pane. Useful for identifying policies you might trigger (or ways to bypass MFA gaps).
Displays the tenant's default cross-tenant access settings and per-partner B2B / B2C configurations. Read-only; helps identify partner tenants that could provide privilege escalation paths.
Enumerates every user's registered authentication methods via /authentication/methods and marks users as PROTECTED (has MFA) or VULNERABLE (password only). CSV export for the vulnerable list feeds directly into a spray target file.
Detects whether Azure AD Connect password-writeback is enabled and enumerates who holds the on-premises admin roles needed to abuse it. Combined with hybrid-identity findings, tells you whether an Entra-first breach could burn down to on-prem.
Enumerates every consent grant (oauth2PermissionGrants) issued in the tenant, highlighting AllPrincipals grants and apps without a redirect-URI restriction the primary consent-abuse discovery pane.
Raw Graph API request builder pick GET / POST, paste a URL, optionally attach a JSON body, and hit send. Host-locked to graph.microsoft.com with automatic bearer-token attachment; the response renders with syntax highlighting.
Enumerates Key Vaults across accessible subscriptions and browses secrets / keys / certificates within each vault. Automatically detects Vault-audience tokens and mints one via the cascade when needed.
Lists Azure SQL servers and databases; supports both AAD-authenticated and SQL-authenticated (username / password) queries. Executes arbitrary T-SQL against a chosen database and returns results in a table.
Enumerates VMs across subscriptions, showing OS type, power state, and location. Includes a Run Command tab that dispatches PowerShell (Windows) or shell script (Linux) via ARM runCommand properly polls the async operation URL so the output actually comes back.
Enumerates Azure Automation accounts and their runbooks. Displays runbook code and lets the operator inspect the execution history useful for finding stored credentials or lateral-movement primitives.
Enumerates Service Principals AND Application Registrations, showing appId, service principal type, sign-in audience, and account status. Right-click a Service Principal to send it to Add App Secret or the Graph Query window.
Lists Function Apps across accessible subscriptions with their triggers, code (where readable), and app settings a rich source of secrets and pivot points.
Enumerates Logic Apps and their workflow definitions. Workflow JSON often exposes connection secrets or webhook URLs the operator can abuse for lateral movement.
Reads user data through Graph the exfiltration surface.
Full Outlook mailbox client: read / search / reply / forward / send / delete emails via Graph's /messages endpoints. Supports HTML compose with attachments and a preview pane that renders the message body safely.
Read the user's calendar via Graph meetings, attendees, dial-in info, attached files. Handy for identifying targets, meeting patterns, and confidential information embedded in invites.
Browses joined Teams and channels, reads chat conversations, and can send messages using either Graph (/chats/) or the Skype API. Search across messages for keyword hunting.
Tree-style file browser over /drives/ traverse OneDrive personal drives and SharePoint document libraries, download files, and preview content. Feeds directly into the exfiltration workflow.
Enumerates Azure Storage accounts and browses blob containers, file shares, tables, and queues. Supports both bearer-token (Connected Account) and SAS token authentication paste a SAS query string and every list / download call uses it automatically.
Long-term footholds that survive password reset or session expiry.
Creates hidden Outlook inbox rules that forward / redirect / delete matching messages the classic BEC persistence primitive. Supports keyword filters (invoice | payment | wire), stealth flags (hidden rule name, stop-processing-more-rules), and per-rule sequence ordering.
Approves pending admin consent requests, adds delegated permission grants (oauth2PermissionGrants), and assigns app roles (appRoleAssignments). Once you have Application / Cloud Application / Global Admin, this window silently grants an attacker-owned app whatever permissions it needs.
Injects authentication methods against a target user: Temporary Access Pass (returns the passcode inline), phone (SMS / voice), alternative email, and Software OATH. Auth Admin / Priv Auth Admin / Global Admin can mint a TAP that satisfies MFA and lets the operator sign in as the target without a password reset alert.
Native implementation of the Entra Device Registration Service wire protocol joins a fresh fake device to the tenant and receives back a signed X.509 device certificate. The cert survives password reset and is the modern-tradecraft equivalent of a golden ticket for cloud identities. Encrypted at rest under data/device_certs.dat.
Registers a WHfB credential on the compromised account by running the AAD Internals device-and-key registration flow. Once registered, the operator can mint PRTs for the victim independently of their password.
Top-level tabbed window covering directory-side attack primitives. Fields autofill from WhoAmI the Role Assignment tab's principal / subscription / scope populate from the last WhoAmI snapshot, and a "From WhoAmI" combo lists every RBAC scope the identity holds so the operator picks one instead of retyping.
- User Groups search users / groups, add users to security groups
- App Backdoors create backdoor Application registrations
- Password Reset PATCH
/users/{id}passwordProfile - Role Assignment assign Azure RBAC roles at any scope; scope picker prefilled from WhoAmI
- Guest Invite B2B
POST /invitationswith silent-invite options - SPN Enumeration search Service Principals + inspect credentials
Interactive shell UI over a pluggable transport framework the same "target → command → output" mental model whether the payload lands via Azure runCommand, an uploaded PHP webshell, or a SSTI injection point.
- Azure VM (runCommand) properly polls the ARM async operation; one-click "Grab MI Token from IMDS" for Managed Identity theft
- HTTP Webshell for uploaded
cmd.php-style RCE; configurable output extractor (raw / regex / between markers) - HTTP SSTI payload templating with presets for Jinja2, Twig, Freemarker, Velocity, ERB, or custom
- Persistent target list saved targets survive restarts (encrypted at rest)
Chronological view of every captured token, decorated with source (device-code / credential / SPN / webhook / cascade-mint / etc.), user, resource, and expiry. Export / import / delete per row.
Consolidated event feed: session creations, session exits, token issuances, and command activity in a single sortable timeline.
JWT decoder paste any bearer / refresh token to see claims, expiry, audience, issuer, and scopes / roles broken down with syntax highlighting.
Per-session activity timeline showing token issuance, expiry, refresh events, and command activity as a visual scroll. Useful for reconstructing the engagement narrative for the report.
Generates a professional HTML report summarising sessions, captured tokens, enumeration findings, and post-exploitation actions from the current data directory. Ready to drop into a client deliverable with minimal editing.
┌─────────────────────────────────────────────────────────────────┐
│ AnimoClient │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────────┐ │
│ │ Dashboard │ │ Plugin │ │ Direct API Calls │ │
│ │ (Sessions) │ │ Windows │ │ (Graph, ARM, Vault) │ │
│ └──────┬──────┘ └──────┬──────┘ └────────────┬────────────┘ │
│ │ │ │ │
│ └────────────────┴───────────────────────┘ │
│ │ │
│ ClientTransport │
│ │ TCP / JSON │
└──────────────────────────┼──────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ AnimoServer │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ Request Dispatcher │ │
│ └──────────┬─────────────────────────────────┬───────────────┘ │
│ │ │ │
│ ┌──────────▼──────────┐ ┌───────────▼───────────┐ │
│ │ PowerShellManager │ │ SessionDBManager │ │
│ │ (Sessions: pwsh + │ │ (SQLite Database) │ │
│ │ az cli contexts) │ │ │ │
│ └─────────────────────┘ └───────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
Communication uses line-delimited JSON over TCP (default port 7777). Every login flow logs into both Az PowerShell (Connect-AzAccount) and Azure CLI (az login) so the session terminal is fully usable from either toolchain az account get-access-token --resource X and Get-AzAccessToken -ResourceUrl X both work out of the box.
| Shortcut | Action |
|---|---|
Ctrl+N |
New Device Code session |
F5 |
Refresh sessions list |
Ctrl+Q |
Quit application |
Ctrl+Shift+T |
Open Token Log |
Ctrl+G |
Open Graph Query |
Ctrl+E |
Open Azure Enumeration |
AnimoServer [options]
-i, --ip <address> Listen IP (default: 127.0.0.1)
-p, --port <port> Listen port (default: 7777)
-P, --password <pass> Client authentication password (required)
-d, --data <path> Data directory (default: ./data)
Installed by Install-AllModules.ps1. The script is additive it never removes
modules you already have and skips Windows-only components on Linux and macOS
with a message rather than failing.
| Module | Purpose | Platform |
|---|---|---|
Az.Accounts, Az.Resources, Az.Compute, Az.Network, Az.Storage, Az.KeyVault, Az.Monitor |
The Az cmdlets ANIMO actually calls | Any |
Az |
Umbrella meta-module (~2 GB; skip with -SkipUmbrellaAz) |
Any |
Microsoft.Graph |
Microsoft Graph SDK | Any |
SqlServer |
Invoke-SqlCmd for the SQL Database module |
Any |
AADInternals |
Azure AD internals & token operations | Any (some cmdlets Windows-only) |
AADInternals-Endpoints |
AADInternals endpoint helpers | Any (some cmdlets Windows-only) |
AzTable |
Azure Table Storage | Any |
AzureAD |
Azure Active Directory (legacy) | Windows only |
AzureAD targets .NET Framework and cannot be imported by PowerShell 7 use
Windows PowerShell 5.1, or Import-Module AzureAD -UseWindowsPowerShell from
pwsh 7 on Windows. On Linux the Get-AzureAD* terminal autocompletions remain
available but the cmdlets will not resolve; every ANIMO panel has an Az or Graph
code path, so nothing depends on AzureAD being present.
On Windows the script also installs az, func, and git via winget. On Linux,
az comes from install-dependencies.sh.
ANIMO pairs well with these projects. Clone them outside this repository:
mkdir -p ~/tools && cd ~/tools| Project | Purpose |
|---|---|
| AADInternals | Azure AD internals research toolkit |
| ROADtools | Azure AD exploration and enumeration |
| TokenTacticsV2 | Token manipulation and family refresh abuse |
| APEX | Azure privilege escalation toolkit |
| PowerZure | Azure post-exploitation framework |
| MicroBurst | Azure enumeration and privesc scripts |
| Stormspotter | Azure attack-graph visualisation |
| MFASweep | MFA coverage gap discovery |
| MSOLSpray | Password spraying against Microsoft Online |
| Office365Hacker | Office 365 attack tooling |
| OffensiveCloud | Multi-cloud offensive references |
| ROADtoken gist | PRT cookie retrieval via browsercore |
- Transport: Use SSH tunnels or VPN for client-server communication over untrusted networks
- Server Password: Transmitted in cleartext over TCP use strong passwords
- Token Storage: Captured tokens are stored in SQLite protect the
data/directory - Device Certs: DRS-joined device private keys are AES-256-GCM encrypted at rest under
data/device_certs.dat - Cleanup: Always run
./clean.sh(or delete thedata/directory) after an engagement - Token Lifetimes: Access tokens expire in ~1 hour; refresh tokens last up to 90 days unless revoked
ANIMO is intended for authorized security testing, red team operations, and security research only.
Users are responsible for:
- Obtaining proper written authorization before testing
- Complying with all applicable laws and regulations
- Following responsible disclosure practices
- Protecting captured credentials and tokens during and after engagements
Unauthorized access to computer systems is illegal. The authors are not responsible for misuse of this tool.
A small blog showing ANIMO usage.
https://www.init1security.com/post/prt-tokens-from-initial-access-to-long-term-cloud-control
- AADInternals Azure AD internals research
- ROADtools Azure AD exploration toolkit
- MSAL Microsoft Authentication Library
- GraphSpy Inspiration for parts of the Discovery and Persistence Design
ANIMO Azure Network Intel & Mission Ops