netspi/microburst

A collection of scripts for assessing Microsoft Azure security

MicroBurst: A PowerShell Toolkit for Attacking Azure

MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. It is intended to be used during penetration tests where Azure is in use.

Author, Contributors, and License

• Author: Karl Fosaaen (@kfosaaen), NetSPI
• Contributors:
  • Scott Sutherland (@_nullbind)
  • Thomas Elling (@thomaselling)
  • Jake Karnes (@jakekarnes42)
  • Josh Magri (@passthehashbrwn)
• License: BSD 3-Clause
• Required Dependencies: Az, Azure, AzureRM, AzureAD, and MSOnline PowerShell Modules are all used in different scripts
• Dependencies Note: Originally written with the AzureRM PS modules, older scripts have been ported to their newer Az equivalents
• Platform Note: These scripts will only run on a Windows-based platform.

Importing the Module / Usage

PS C:> Import-Module .\MicroBurst.psm1

This will import all applicable functions based off of the currently installed modules in your environment. The scripts can then be invoked using their names like

PS C:> Get-AzDomainInfo

If you want to simplify the trusting of the code files, use the following "Unblock-File" command to recursively trust each of the downloaded files:

PS C:> dir -Recurse .\MicroBurst-master | Unblock-File

Recommended Modules to install:

• Az
• AzureAd
• MSOnline

Here's how a module can be installed in Powershell

PS C:> Install-Module <module-name>

Scripts Information

If you want to learn what a specific script does use Get-Help with script name like:

PS C:> Get-Help Invoke-EnumerateAzureSubDomains

Related Blogs

• A Beginners Guide to Gathering Azure Passwords
• Anonymously Enumerating Azure Services
• Anonymously Enumerating Azure File Resources
• Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence
• Using Azure Automation Accounts to Access Key Vaults
• Running PowerShell on Azure VMs at Scale
• Maintaining Azure Persistence via Automation Accounts
• Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings
• Attacking Azure with Custom Script Extensions
• Lateral Movement in Azure App Services
• Get-AzPasswords: Encrypting Automation Password Data
• Azure Privilege Escalation Using Managed Identities
• Azure Persistence with Desired State Configurations
• How To Extract Credentials from Azure Kubernetes Service (AKS)

Presentations

• Extracting all the Azure Passwords - DEF CON 29 - Cloud Village
  • Slides
• Adventures in Azure Privilege Escalation - DerbyCon 9
  • DerbyCon 9 (2019) Slides
• Attacking Azure Environments with PowerShell - DerbyCon 8
  • DerbyCon 8 (2018) Slides
  • BSidesPDX (2018) Slides

Wiki Information

Check out the MicroBurst Wiki for more information on the usage of the toolkit and the available functions.

microburst's Issues

Module Checking Logic Flaws

Hello,

The module checking logic in MicroBurst.psm1 has some issues.

If AzureAD module is not pre-installed on the system, the below code will not load the local version from $PSScriptRoot
PowerShell will simply throw an error and will immediately go to the CATCH statement, so you end up without loading anything, neither the installed module (if any) nor the local version
Import-Module AzureAD -ErrorAction Stop
Import-Module $PSScriptRoot\AzureAD\MicroBurst-AzureAD.psm1

Here's what the result looks like:

My test machine has Az and AzureAD pre-installed, so what happens is:

• Az/AzureAD get imported using the Import-Module AzureAD -ErrorAction Stop
• Then they are imported again from the local version, since first import didn't throw errors so the code doesn't stop
• MSOnline throws an error coz I don't have it installed, however, the local version never gets loaded coz the code jumps to the CATCH statement

The module checking logic should be something like this

if (!(Get-Module AzureAD)) {
   if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) { 
      Write-Host -ForegroundColor Green "Found AzureAD installed, Importing." 
      Import-Module AzureAD
   }
   else {
      Write-Host -ForegroundColor Green "AzureAD not installed, Importing local version."
      Import-Module $PSScriptRoot\AzureAD\MicroBurst-AzureAD.psm1
   }
}

Cheers & thanks for the nice tool!

Get-AzureADServicePrincipal: Could not load file or assembly 'RestSharp

Get-AzureADServicePrincipal: Could not load file or assembly 'RestSharp, Version=106.3.1.0, Culture=neutral, PublicKeyToken=598062e77f915f75'. Could not find or load a specific file. (0x80131621)

any idea how i can fix this error

Get-AzureDomainInfo.ps1 InvalidOperation: (:) [], RuntimeException

Hi,
Just to start off, very impressive tool.

However, when reaching the "Getting Domain Users for each group..." prompt when running Get-AzureDomainInfo I seem to be facing this error

You cannot call a method on a null-valued expression.
At Get-AzDomainInfo.ps1:213 char:42

• ... each ($char in $charlist){$groupName = $groupName.replace($char,'.')}

•                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

Seems to hang for a good while; little unsure

The command I've ran is:
Get-AzDomainInfo -folder C:\Users\testbox\Desktop\test -Verbose

Any ideas what may be the cause of this? Has anyone encountered this before?

Get-AzPasswords - Add Assignable Scope Options for Token Generation

When getting Managed Identity tokens with Get-AzPasswords and AKS clusters, the token is currently scoped to management.azure.com. It would be helpful to have additional services as scopes that could be selected as parameters.

Lines 800-824 cover the Managed Identity token generation in Get-AzPasswords.

Add User Assigned Managed Identity

Using the following commands we can extract a User Assigned Managed Identity

$UserAssignedIdentity =  Get-AzUserAssignedIdentity -ResourceGroupName $AutoAccount.ResourceGroupName -SubscriptionId $AutoAccount.SubscriptionId
$ClientId = $UserAssignedIdentity.ClientId
$apiVersion = "2017-09-01"
$headers=@{"secret"=$env:IDENTITY_HEADER}

# Querying the Graph API with a User ClientID
$userResponse = Invoke-RestMethod -Method Get -Uri "$($env:IDENTITY_ENDPOINT)?resource=https://graph.microsoft.com/&clientid=$ClientId&api-version=$apiVersion" -Headers $headers

# This response should give us a User Bearer Token for later use in Graph API calls
$useraccessToken = $userResponse.access_token

Get-AzPasswords or Get-Passwords not work

Hello

I authenticate with "az login" and "connect-Azure", but when executing anything with the "Get-Passwords" script, PowerShell gives an error:

PS C:\Users\XXXX\Downloads\MicroBurst-master\Az> get-help Get-AzPasswords.ps1
get-help : Get-Help could not find Get-AzPasswords.ps1 in a help file in this session. To download updated help topics type: "Update-Help". To get help online, search for the help topic in the TechNet library at https:/go.microsoft.com/fwlink/?LinkID=107116.
At line:1 char:1

• get-help Get-AzPasswords.ps1

•   + CategoryInfo          : ResourceUnavailable: (:) [Get-Help], HelpNotFoundException
    + FullyQualifiedErrorId : HelpNotFound,Microsoft.PowerShell.Commands.GetHelpCommand
  
  
  

PS C:\Users\XXXX\Downloads\MicroBurst-master\Az> Get-AzPasswords.ps1 -verbose
Get-AzPasswords.ps1 : The term 'Get-AzPasswords.ps1' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1

• Get-AzPasswords.ps1 -verbose

•   + CategoryInfo          : ObjectNotFound: (Get-AzPasswords.ps1:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
  
  

PS C:\Users\XXXX\Downloads\MicroBurst-master> Get-AzurePasswords
Get-AzurePasswords : The term 'Get-AzurePasswords' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1

• Get-AzurePasswords

•   + CategoryInfo          : ObjectNotFound: (Get-AzurePasswords:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
  
  
  

i've delete/remove all modules, but the problem persist

at this time i've this modules:
Version Name Repository Description

---

4.3.0 Az PSGallery Microsoft Azure PowerShell - Cmdlets to manage resources in Azure. This module is compatible with WindowsPowerShell and PowerShell Core....
1.9.0 Az.Accounts PSGallery Microsoft Azure PowerShell - Accounts credential management cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.1 Az.Advisor PSGallery Microsoft Azure PowerShell - Azure Advisor Cmdlets for Advisor in Windows PowerShell and PowerShell Core. Get Advisor recommendations, Manage Advisor configurations.
1.1.2 Az.Aks PSGallery Microsoft Azure PowerShell - Azure managed Kubernetes cmdlets for Windows PowerShell and PowerShell Core....
1.1.3 Az.AnalysisServices PSGallery Microsoft Azure PowerShell - Analysis Services cmdlets for Windows PowerShell and PowerShell Core....
2.0.1 Az.ApiManagement PSGallery Microsoft Azure PowerShell - Api Management service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.0 Az.ApplicationInsights PSGallery Microsoft Azure PowerShell - Application Insights management cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core. Creates and manages application insights in Azure Resource ...
1.3.6 Az.Automation PSGallery Microsoft Azure PowerShell - Automation service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
3.1.0 Az.Batch PSGallery Microsoft Azure PowerShell - Batch service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.0.3 Az.Billing PSGallery Microsoft Azure PowerShell - Billing service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.4.3 Az.Cdn PSGallery Microsoft Azure PowerShell - CDN service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.5.0 Az.CognitiveServices PSGallery Microsoft Azure PowerShell - Cognitive Services management cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core. Creates and manages cognitive services accounts in Azure Resou...
4.2.0 Az.Compute PSGallery Microsoft Azure PowerShell - Compute service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core. Manages virtual machines, hosted services, and related resources in Azure R...
1.0.3 Az.ContainerInstance PSGallery Microsoft Azure PowerShell - Container Instance cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.1 Az.ContainerRegistry PSGallery Microsoft Azure PowerShell - Container Registry service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.0 Az.DataBoxEdge PSGallery Microsoft Azure PowerShell - DataBoxEdge service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.8.2 Az.DataFactory PSGallery Microsoft Azure PowerShell - Data Factory service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.0.2 Az.DataLakeAnalytics PSGallery Microsoft Azure PowerShell - Data Lake Analytics in Windows PowerShell and PowerShell Core....
1.2.8 Az.DataLakeStore PSGallery Microsoft Azure PowerShell - Azure Data Lake Store cmdlets in Windows PowerShell and PowerShell Core....
1.0.0 Az.DataShare PSGallery Microsoft Azure PowerShell - DataShare service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core.
1.1.0 Az.DeploymentManager PSGallery PowerShell .Net Core Microsoft Azure PowerShell - Deployment Manager cmdlets for Azure Resource Manager....
1.0.0 Az.DesktopVirtualization PSGallery Microsoft Azure PowerShell: DesktopVirtualization cmdlets
1.0.2 Az.DevTestLabs PSGallery Microsoft Azure PowerShell - DevTest Labs service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.2 Az.Dns PSGallery Microsoft Azure PowerShell - DNS service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.2.3 Az.EventGrid PSGallery Microsoft Azure PowerShell - Event Grid service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.5.0 Az.EventHub PSGallery Microsoft Azure PowerShell - Event Hubs service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.5.0 Az.FrontDoor PSGallery Microsoft Azure PowerShell - Front Door service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.0.1 Az.Functions PSGallery Microsoft Azure PowerShell - Azure Functions service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
3.3.0 Az.HDInsight PSGallery Microsoft Azure PowerShell - HDInsight service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.0 Az.HealthcareApis PSGallery Microsoft Azure PowerShell - HealthcareApis management cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core. Creates and manages HealthcareApis service accounts in Azure Resou...
2.5.0 Az.IotHub PSGallery Microsoft Azure PowerShell - IoT Hub service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
2.0.0 Az.KeyVault PSGallery Microsoft Azure PowerShell - Key Vault service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.3.2 Az.LogicApp PSGallery Microsoft Azure PowerShell - Logic Apps cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.3 Az.MachineLearning PSGallery Microsoft Azure PowerShell - Machine Learning Web Services cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.0.0 Az.Maintenance PSGallery Microsoft Azure PowerShell - Maintenance cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.0.2 Az.ManagedServices PSGallery Microsoft Azure PowerShell - ManagedServices cmdlets for Azure Resource Manager
1.0.2 Az.MarketplaceOrdering PSGallery Microsoft Azure PowerShell - Marketplace Ordering agreements service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.1 Az.Media PSGallery Microsoft Azure PowerShell - Media service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
2.0.1 Az.Monitor PSGallery Microsoft Azure PowerShell - Monitor service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
3.1.0 Az.Network PSGallery Microsoft Azure PowerShell - Networking service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.1 Az.NotificationHubs PSGallery Microsoft Azure PowerShell - Notification Hubs cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
2.2.0 Az.OperationalInsights PSGallery Microsoft Azure PowerShell - Operational Insights service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core.
1.3.1 Az.PolicyInsights PSGallery Microsoft Azure PowerShell - Azure Policy Insights cmdlets for Windows PowerShell and PowerShell Core. Allows querying policy evaluation events and compliance states....
1.1.2 Az.PowerBIEmbedded PSGallery Microsoft Azure PowerShell - Power BI Embedded service management cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core. Creates and manages Power BI Embedded workspace collec...
1.0.3 Az.PrivateDns PSGallery Microsoft Azure PowerShell - Private DNS service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
2.10.0 Az.RecoveryServices PSGallery Microsoft Azure PowerShell - Recovery Services cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.2.1 Az.RedisCache PSGallery Microsoft Azure PowerShell - Redis Cache service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.0.3 Az.Relay PSGallery Microsoft Azure PowerShell - Relay service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
2.2.0 Az.Resources PSGallery Microsoft Azure PowerShell - Azure Resource Manager and Active Directory cmdlets in Windows PowerShell and PowerShell Core. Manages subscriptions, tenants, resource groups, deployment templates, pro...
1.4.1 Az.ServiceBus PSGallery Microsoft Azure PowerShell - Service Bus service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
2.1.0 Az.ServiceFabric PSGallery Microsoft Azure PowerShell - Service Fabric cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.1 Az.SignalR PSGallery Microsoft Azure PowerShell - Azure SignalR service commands for Windows PowerShell and PowerShell Core....
2.8.0 Az.Sql PSGallery Microsoft Azure PowerShell - SQL service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.1.0 Az.SqlVirtualMachine PSGallery Microsoft Azure PowerShell - SqlVirtualMachine service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core.
2.2.0 Az.Storage PSGallery Microsoft Azure PowerShell - Storage service data plane and management cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core. Creates and manages storage accounts in Azure Res...
1.2.3 Az.StorageSync PSGallery Microsoft Azure PowerShell - Storage Sync cmdlets in Windows PowerShell and PowerShell Core. Manages operations pertaining to Azure File Sync in PowerShell.
1.0.1 Az.StreamAnalytics PSGallery Microsoft Azure PowerShell - Stream Analytics service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.0.0 Az.Support PSGallery Microsoft Azure PowerShell - Azure Support cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core.
1.0.4 Az.TrafficManager PSGallery Microsoft Azure PowerShell - Traffic Manager service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
1.10.0 Az.Websites PSGallery Microsoft Azure PowerShell - App Service (Web Apps) service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core....
5.3.0 Azure PSGallery Microsoft Azure PowerShell - Service Management
4.6.1 Azure.Storage PSGallery Microsoft Azure PowerShell - Storage service cmdlets. Manages blobs, queues, tables and files in Microsoft Azure storage accounts
2.0.2.76 AzureAD PSGallery Azure Active Directory V2 General Availability Module....
6.13.1 AzureRM PSGallery Azure Resource Manager Module
0.6.14 AzureRM.AnalysisServices PSGallery Microsoft Azure PowerShell - Analysis Services
6.1.7 AzureRM.ApiManagement PSGallery Microsoft Azure PowerShell - Api Management service cmdlets for Azure Resource Manager
0.1.8 AzureRM.ApplicationInsights PSGallery Microsoft Azure PowerShell - Application Insights service management cmdlets for Azure Resource Manager. Creates and manages application insights in Azure Resource Manager.
6.1.1 AzureRM.Automation PSGallery Microsoft Azure PowerShell - Automation service cmdlets for Azure Resource Manager
4.0.11 AzureRM.Backup PSGallery Microsoft Azure PowerShell - Azure Backup service cmdlets for Azure Resource Manager
4.1.5 AzureRM.Batch PSGallery Microsoft Azure PowerShell - Batch service cmdlets for Azure Resource Manager
0.14.6 AzureRM.Billing PSGallery Microsoft Azure PowerShell - Billing service cmdlets for Azure Resource Manager
5.0.6 AzureRM.Cdn PSGallery Microsoft Azure PowerShell - CDN service cmdlets for Azure Resource Manager
0.9.12 AzureRM.CognitiveServices PSGallery Microsoft Azure PowerShell - Cognitive Services management cmdlets for Azure Resource Manager. Creates and manages cognitive services accounts in Azure Resource Manager.
5.9.1 AzureRM.Compute PSGallery Microsoft Azure PowerShell - Compute service cmdlets for Azure Resource Manager. Manages virtual machines, hosted services, and related resources in Azure Resource Manager
0.3.7 AzureRM.Consumption PSGallery Microsoft Azure PowerShell - Consumption service cmdlets for Azure Resource Manager
0.2.12 AzureRM.ContainerInstance PSGallery Microsoft Azure PowerShell - Container Instance cmdlets for Azure Resource Manager
1.0.10 AzureRM.ContainerRegistry PSGallery Microsoft Azure PowerShell - ContainerRegistry service cmdlets for Azure Resource Manager
5.0.3 AzureRM.DataFactories PSGallery Microsoft Azure PowerShell - DataFactories service cmdlets for Azure Resource Manager
0.5.11 AzureRM.DataFactoryV2 PSGallery Microsoft Azure PowerShell - DataFactories service cmdlets for Azure Resource Manager
5.1.4 AzureRM.DataLakeAnalytics PSGallery Microsoft Azure PowerShell - Data Lake Analytics
6.2.1 AzureRM.DataLakeStore PSGallery Microsoft Azure PowerShell - Data Lake Store
4.0.9 AzureRM.DevTestLabs PSGallery Microsoft Azure PowerShell - DevTestLabs service cmdlets for Azure Resource Manager
5.1.0 AzureRM.Dns PSGallery Microsoft Azure PowerShell - Dns service cmdlets for Azure Resource Manager
0.3.7 AzureRM.EventGrid PSGallery Microsoft Azure PowerShell - EventGrid service cmdlets for Azure Resource Manager
0.7.0 AzureRM.EventHub PSGallery Microsoft Azure PowerShell - EventHubs service cmdlets for Azure Resource Manager
4.1.8 AzureRM.HDInsight PSGallery Microsoft Azure PowerShell - HDInsight service cmdlets for Azure Resource Manager
5.1.5 AzureRM.Insights PSGallery Microsoft Azure PowerShell - Insights service cmdlets for Azure Resource Manager
3.1.8 AzureRM.IotHub PSGallery Microsoft Azure PowerShell - IotHub service cmdlets for Azure Resource Manager
5.2.1 AzureRM.KeyVault PSGallery Microsoft Azure PowerShell - KeyVault service cmdlets for Azure Resource Manager
4.1.4 AzureRM.LogicApp PSGallery Microsoft Azure PowerShell - LogicApp cmdlets for Azure Resource Manager
0.18.5 AzureRM.MachineLearning PSGallery Microsoft Azure PowerShell - Machine Learning Web Services cmdlets for Azure Resource Manager
0.4.8 AzureRM.MachineLearningCompute PSGallery Microsoft Azure PowerShell - Machine Learning Compute cmdlets for Azure Resource Manager
0.2.7 AzureRM.MarketplaceOrdering PSGallery Microsoft Azure PowerShell - MarketplaceOrdering agreements service cmdlets for Azure Resource Manager
0.10.4 AzureRM.Media PSGallery Microsoft Azure PowerShell - Media service cmdlets for Azure Resource Manager
6.11.1 AzureRM.Network PSGallery Microsoft Azure PowerShell - Network service cmdlets for Azure Resource Manager
5.0.3 AzureRM.NotificationHubs PSGallery Microsoft Azure PowerShell - NotificationHubs
5.0.6 AzureRM.OperationalInsights PSGallery Microsoft Azure PowerShell - OperationalInsights service cmdlets for Azure Resource Manager
1.1.0 AzureRM.PolicyInsights PSGallery Microsoft Azure PowerShell - Azure Policy Insights cmdlets. Allows querying policy evaluation events and compliance states.
4.1.10 AzureRM.PowerBIEmbedded PSGallery Microsoft Azure PowerShell - Power BI Embedded service management cmdlets for Azure Resource Manager. Creates and manages Power BI Embedded workspace collections and Power BI Dedicated Capacities in...
5.8.2 AzureRM.profile PSGallery Microsoft Azure PowerShell - Profile credential management cmdlets for Azure Resource Manager
4.1.9 AzureRM.RecoveryServices PSGallery Microsoft Azure PowerShell - RecoveryServices cmdlets for Azure Resource Manager
4.5.2 AzureRM.RecoveryServices.Backup PSGallery Microsoft Azure PowerShell - Azure Backup service cmdlets for Azure Resource Manager
0.2.12 AzureRM.RecoveryServices.SiteRec... PSGallery Microsoft Azure PowerShell - SiteRecovery service cmdlets for Azure Resource Manager
5.1.0 AzureRM.RedisCache PSGallery Microsoft Azure PowerShell - RedisCache service cmdlets for Azure Resource Manager
0.3.12 AzureRM.Relay PSGallery Microsoft Azure PowerShell - Relay service cmdlets for Azure Resource Manager
6.7.3 AzureRM.Resources PSGallery Microsoft Azure PowerShell - Azure Resource Manager cmdlets. Manages subscriptions, tenants, resource groups, deployment templates, providers, and resource permissions in Azure Resource Manager. Pr...
0.16.10 AzureRM.Scheduler PSGallery Microsoft Azure PowerShell - Scheduler cmdlets for Azure Resource Manager
0.6.13 AzureRM.ServiceBus PSGallery Microsoft Azure PowerShell - ServiceBus service cmdlets for Azure Resource Manager
0.3.15 AzureRM.ServiceFabric PSGallery Microsoft Azure PowerShell - Service Fabric cmdlets for Azure Resource Manager
1.0.0 AzureRM.SignalR PSGallery Microsoft Azure PowerShell - Azure SignalR service commands
4.12.1 AzureRM.Sql PSGallery Microsoft Azure PowerShell - Sql service cmdlets for Azure Resource Manager
5.2.0 AzureRM.Storage PSGallery Microsoft Azure PowerShell - Storage service management cmdlets for Azure Resource Manager. Creates and manages storage accounts in Azure Resource Manager.
4.0.10 AzureRM.StreamAnalytics PSGallery Microsoft Azure PowerShell - StreamAnalytics service cmdlets for Azure Resource Manager
4.0.5 AzureRM.Tags PSGallery Microsoft Azure PowerShell - Tags service cmdlets for Azure Resource Manager
4.1.3 AzureRM.TrafficManager PSGallery Microsoft Azure PowerShell - TrafficManager service cmdlets for Azure Resource Manager
4.0.5 AzureRM.UsageAggregates PSGallery Microsoft Azure PowerShell - UsageAggregates service cmdlets for Azure Resource Manager
5.2.0 AzureRM.Websites PSGallery Microsoft Azure PowerShell - Websites service cmdlets for Azure Resource Manager
1.1.183.57 MSOnline PSGallery Microsoft Azure Active Directory Module for Windows PowerShell

can you help?

Get-AzDomainInfo throwing Illegal characters in path.

After running Get-AzDomainInfo -verbose I received an Illegal characters in path error for every time Get-AzDomainInfo tried to write any output:

This is because the subscription has pipes | in it's name and those are illegal characters for a folder name. To fix my issue I edited lines 173-176 of Get-AzDomainInfo.ps1 to the following code:

    $folderSubscription = $Subscription.replace('|','-')
    if(Test-Path $folder"\"$folderSubscription){}
    else{New-Item -ItemType Directory $folder"\"$folderSubscription | Out-Null}
    
    $folder = -join ($folder, "\", $folderSubscription)

Probably a better solution to catch all Illegal characters is remove any characters from [System.IO.Path]::GetInvalidFileNameChars() -join '' out of the folder name to prevent this issue in the future.

MSOnline cmdlet deprecation?

Hi Team,

The MSOnline module's obsolete prerequisite was shown in the https://github.com/NetSPI/MicroBurst modules. Will there be an updated version with Microsoft Graph?

Thank you in advance and I look forward to your reply.

check multiple names in EnumerateAzureBlobs

Hi, I really liked your tool but I wonder is there anyway I can define the multiple storage accounts in some file. Lets say If I need to check 100 storage accounts then do I have to type "Invoke-EnumerateAzureBlobs -Base testaccount1" till testaccount100 every time or is there any workaround.

Thanks.

Import-Module : Could not load type 'Microsoft.Azure.Management

When trying to import keep getting this error:
`Imported Az MicroBurst functions
Imported AzureAD MicroBurst functions
Import-Module : Could not load type 'Microsoft.Azure.Management.DataLake.Analytics.Models.DataLakeStoreAccountInfo'
from assembly 'Microsoft.Azure.Management.DataLake.Analytics, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35'.
At C:\Program Files\WindowsPowerShell\Modules\AzureRM.DataLakeAnalytics\4.2.3\AzureRM.DataLakeAnalytics.psm1:21 char:1

• Import-Module (Join-Path -Path $PSScriptRoot -ChildPath Microsoft.Azu ...

•   + CategoryInfo          : NotSpecified: (:) [Import-Module], TypeLoadException
    + FullyQualifiedErrorId : System.TypeLoadException,Microsoft.PowerShell.Commands.ImportModuleCommand
  
  

Import-Module : The module to process 'AzureRM.DataLakeAnalytics.psm1', listed in field 'ModuleToProcess/RootModule'
of module manifest 'C:\Program
Files\WindowsPowerShell\Modules\AzureRM.DataLakeAnalytics\4.2.3\AzureRM.DataLakeAnalytics.psd1' was not processed
because no valid module was found in any module directory.
At C:\Program Files\WindowsPowerShell\Modules\AzureRM\5.7.0\AzureRM.psm1:30 char:1

• Import-Module AzureRM.DataLakeAnalytics -RequiredVersion 4.2.3 -Globa ...

•   + CategoryInfo          : ResourceUnavailable: (AzureRM.DataLakeAnalytics:String) [Import-Module], PSInvalidOperat
   ionException
    + FullyQualifiedErrorId : Modules_ModuleFileNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand
  
  

MSOnline module not installed, checking other modules
Imported Misc MicroBurst functions
Imported Azure REST API MicroBurst functions`

Very slow on big environment

Hello,

Thank you for this very useful tool.

I tried to get users, groups, devices with the command "Get-AzDomainInfo".
I worked on a big environment with 80 000 users, 40 000 groups, etc.

It takes much time to get users, but I had to stop the step when the tool searches groups of each user.
After 15 hours, this step was not yet finished.

Best regards,

Installation Issues

Hi, I'm having a huge issue importing the base module.
PS C:\Users****\Downloads\MicroBurst-master> $PSVersionTable

Name Value

---

PSVersion 6.1.3
PSEdition Core
GitCommitId 6.1.3
OS Microsoft Windows 10.0.14393
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

Here is the otuput:
PS C:\Users*\Downloads\MicroBurst-master> Import-Module .\MicroBurst.psm1
VERBOSE: Loading module from path 'C:\Users*\Downloads\MicroBurst-master\Get-AzureDomainInfo.ps1'.
VERBOSE: Dot-sourcing the script file 'C:\Users****\Downloads\MicroBurst-master\Get-AzureDomainInfo.ps1'.

Confirm
Are you sure you want to perform this action?
Performing the operation "Install-Module" on target "Version '6.13.1' of module 'AzureRM'".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): A

Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its
InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from
'PSGallery'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): A

Confirm
Are you sure you want to perform this action?
Performing the operation "Install-Module" on target "Version '5.3.0' of module 'Azure'".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): A

Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the
Set-PSRepository cmdlet. Are you sure you want to install the modules from 'PSGallery'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): A
VERBOSE: Loading module from path 'C:\Users*\Downloads\MicroBurst-master\Get-AzurePasswords.ps1'.
VERBOSE: Dot-sourcing the script file 'C:\Users*\Downloads\MicroBurst-master\Get-AzurePasswords.ps1'.
Import-Module : Could not load file or assembly 'System.Windows.Forms, Version=4.0.0.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089'. The system cannot find the file specified.
At C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psm1:81 char:1

• Import-Module (Join-Path -Path $PSScriptRoot -ChildPath Microsoft.Azu ...
• CategoryInfo : NotSpecified: (:) [Import-Module], FileNotFoundException
• FullyQualifiedErrorId : System.IO.FileNotFoundException,Microsoft.PowerShell.Commands.ImportModuleCommand

Import-Module : The module to process 'AzureRM.Profile.psm1', listed in field 'ModuleToProcess/RootModule' of module manifest 'C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psd1' was not processed because no valid module was found in any module directory.
At C:\Program Files\PowerShell\Modules\AzureRM\6.13.1\AzureRM.psm1:81 char:1

• Import-Module AzureRM.Profile -RequiredVersion 5.8.2 -Global
• CategoryInfo : ResourceUnavailable: (AzureRM.Profile:String) [Import-Module], PSInvalidOperationException
• FullyQualifiedErrorId : Modules_ModuleFileNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand

Import-Module : Could not load file or assembly 'System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'. The sys
tem cannot find the file specified.
At C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psm1:81 char:1

• Import-Module (Join-Path -Path $PSScriptRoot -ChildPath Microsoft.Azu ...
• CategoryInfo : NotSpecified: (:) [Import-Module], FileNotFoundException
• FullyQualifiedErrorId : System.IO.FileNotFoundException,Microsoft.PowerShell.Commands.ImportModuleCommand

Import-Module : The module to process 'AzureRM.Profile.psm1', listed in field 'ModuleToProcess/RootModule' of module manifest 'C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psd1' was not processed because no valid module was found in any module directory.
At C:\Program Files\PowerShell\Modules\Azure.Storage\4.6.1\Azure.Storage.psm1:50 char:5

• Import-Module AzureRM.Profile -MinimumVersion 5.6.0 -Scope Global
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

• CategoryInfo : ResourceUnavailable: (AzureRM.Profile:String) [Import-Module], PSInvalidOperationException
• FullyQualifiedErrorId : Modules_ModuleFileNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand

Import-Module : Could not load file or assembly 'System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'. The system cannot find the file specified.
At C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psm1:81 char:1

• Import-Module (Join-Path -Path $PSScriptRoot -ChildPath Microsoft.Azu ...
• CategoryInfo : NotSpecified: (:) [Import-Module], FileNotFoundException
• FullyQualifiedErrorId : System.IO.FileNotFoundException,Microsoft.PowerShell.Commands.ImportModuleCommand

Import-Module : The module to process 'AzureRM.Profile.psm1', listed in field 'ModuleToProcess/RootModule' of module manifest 'C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psd1' was not processed because no valid module was found in any module directory.
At C:\Program Files\PowerShell\Modules\AzureRM.AnalysisServices\0.6.14\AzureRM.AnalysisServices.psm1:19 char:5

• Import-Module AzureRM.Profile -MinimumVersion 5.5.1 -Scope Global
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

• CategoryInfo : ResourceUnavailable: (AzureRM.Profile:String) [Import-Module], PSInvalidOperationException
• FullyQualifiedErrorId : Modules_ModuleFileNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand

Import-Module : Could not load file or assembly 'System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'. The system cannot find the file specified.
At C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psm1:81 char:1

• Import-Module (Join-Path -Path $PSScriptRoot -ChildPath Microsoft.Azu ...
• CategoryInfo : NotSpecified: (:) [Import-Module], FileNotFoundException
• FullyQualifiedErrorId : System.IO.FileNotFoundException,Microsoft.PowerShell.Commands.ImportModuleCommand

Import-Module : The module to process 'AzureRM.Profile.psm1', listed in field 'ModuleToProcess/RootModule' of module manifest 'C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psd1' was not processed because no valid module was found in any module directory.
At C:\Program Files\PowerShell\Modules\Azure.AnalysisServices\0.5.4\Azure.AnalysisServices.psm1:19 char:5

• Import-Module AzureRM.Profile -MinimumVersion 5.4.0 -Scope Global
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

• CategoryInfo : ResourceUnavailable: (AzureRM.Profile:String) [Import-Module], PSInvalidOperationException
• FullyQualifiedErrorId : Modules_ModuleFileNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand

VERBOSE: Loading module from path 'C:\Users\dsaric1\Downloads\MicroBurst-master\Get-MSOLDomainInfo.ps1'.
VERBOSE: Dot-sourcing the script file 'C:\Users\dsaric1\Downloads\MicroBurst-master\Get-MSOLDomainInfo.ps1'.

Confirm
Are you sure you want to perform this action?
Performing the operation "Install-Module" on target "Version '1.1.183.17' of module 'MSOnline'".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): A

Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the
Set-PSRepository cmdlet. Are you sure you want to install the modules from 'PSGallery'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"): A
VERBOSE: Loading module from path 'C:\Users*\Downloads\MicroBurst-master\Invoke-AzureRmVMBulkCMD.ps1'.
VERBOSE: Dot-sourcing the script file 'C:\Users*\Downloads\MicroBurst-master\Invoke-AzureRmVMBulkCMD.ps1'.
Import-Module : Could not load file or assembly 'System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'. The system cannot find the file specified.
At C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psm1:81 char:1

• Import-Module (Join-Path -Path $PSScriptRoot -ChildPath Microsoft.Azu ...
• CategoryInfo : NotSpecified: (:) [Import-Module], FileNotFoundException
• FullyQualifiedErrorId : System.IO.FileNotFoundException,Microsoft.PowerShell.Commands.ImportModuleCommand

Import-Module : The module to process 'AzureRM.Profile.psm1', listed in field 'ModuleToProcess/RootModule' of module manifest 'C:\Program Files\PowerShell\Modules\AzureRM.Profile\5.8.2\AzureRM.Profile.psd1' was not processed because no valid module was found in any module directory.
At C:\Program Files\PowerShell\Modules\AzureRM\6.13.1\AzureRM.psm1:81 char:1

• Import-Module AzureRM.Profile -RequiredVersion 5.8.2 -Global
• CategoryInfo : ResourceUnavailable: (AzureRM.Profile:String) [Import-Module], PSInvalidOperationException
• FullyQualifiedErrorId : Modules_ModuleFileNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand

VERBOSE: Loading module from path 'C:\Users*\Downloads\MicroBurst-master\Invoke-EnumerateAzureBlobs.ps1'.
VERBOSE: Dot-sourcing the script file 'C:\Users*\Downloads\MicroBurst-master\Invoke-EnumerateAzureBlobs.ps1'.
VERBOSE: Loading module from path 'C:\Users*\Downloads\MicroBurst-master\Invoke-EnumerateAzureSubDomains.ps1'.
VERBOSE: Dot-sourcing the script file 'C:\Users*\Downloads\MicroBurst-master\Invoke-EnumerateAzureSubDomains.ps1'.

Does anyone have any idea why this is happening? I've been on this for about 4 days without progress...

Missing misc functions import-module

Not all of the ps1 scripts included in the "misc" folders are automatically loaded when importing MicroBurst's main psm1 file:

MicroBurst/Misc/MicroBurst-Misc.psm1

Lines 1 to 6 in 156c4e9

	Import-Module $PSScriptRoot\Invoke-EnumerateAzureBlobs.ps1
	Import-Module $PSScriptRoot\Invoke-EnumerateAzureSubDomains.ps1
	Import-Module $PSScriptRoot\Invoke-DscVmExtension.ps1
	Write-Host "Imported Misc MicroBurst functions"

I had the issue when trying to run "Get-AzureVMExtensionSettings". Is that a wanted behaviour or should they be added to the above list?

Get-AzPasswords ACRpasswords block of code throws an exception for the subscription scope Reader role.

Hi,
I wanted to provide a PR for the Dump Azure Container Registry Admin passwords block of code. If the user that is conducting recon has only Reader permissions on the subscription scope, the Get-AzContainerRegistryCredential cmdlet in the Dump Azure Container Registry Admin passwords block of code will throw an exception and interrupt the script; I believe this is not the intended behavior.

Here is the proposed code:
if ($ACR -eq 'Y'){
# Container Registry Section
Write-Verbose "Getting List of Azure Container Registries..."
$registries = Get-AzContainerRegistry
$registries | ForEach-Object {
if ($.AdminUserEnabled -eq 'True'){
try{
$loginServer = $.LoginServer
$name = $_.Name
Write-Verbose "tGetting the Admin User password for $loginServer" $ACRpasswords = Get-AzContainerRegistryCredential -ResourceGroupName $_.ResourceGroupName -Name $name $TempTblCreds.Rows.Add("ACR-AdminUser",$_.LoginServer,$ACRpasswords.Username,$ACRpasswords.Password,"N/A","N/A","N/A","N/A","Password","N/A",$subName) | Out-Null $TempTblCreds.Rows.Add("ACR-AdminUser",$_.LoginServer,$ACRpasswords.Username,$ACRpasswords.Password2,"N/A","N/A","N/A","N/A","Password","N/A",$subName) | Out-Null } catch{Write-Verbose "tuser does not have authorization to perform action Get-AzContainerRegistryCredential for container registry $name"}
}
}
}

Incorrect Bing Search API URL

Invoke-EnumerateAzureBlogs errors when searching BingAPI for containers and storage accounts because the URL and Endpoint is incorrect, or has changed.

The issue can be fixed by modifying Invoke-EnumerateAzureBlobs.ps1 in the Misc directory. On Line 143 the URI needs to be updated.

Old domain: api.cognitive.microsoft.com
Old endpoint: /bing/v7.0/search

New Domain: api.bing.microsoft.com
New Endpoint: /v7.0/search

Line 143, -URI string, new value should be:
-URI "https://api.bing.microsoft.com/v7.0/search?q=$BingQuery&count=50"

MicroBurst running on Kali Linux

Hello, are there any plans or at least interest in making MicroBurst compatible with PowerShell on Kali Linux?

I've been experimenting with it a bit, but before proceeding further, I would like to know if there is any background information on this topic.

Thanks for the great tool.

Cannot find Get-AzDomainInfo function

Hello, I imported the MicroBurst PowerShell module using Import-Module .\MicroBurst.psm1 but it seems to be missing the Get-AzDomainInfo function. The only thing close that seems available after the import is Get-AzDomainInfoREST.
Any idea what might be wrong?

Thanks!
Rick

Get-AzurePasswords -Verbose | Out-GridView

Hello sir, I am having an error using this command "Get-AzurePasswords -Verbose | Out-GridView".
the errors are below Please guide me through this problem. I am also having a problem with the "AzureRM [Deprecated] Functions" section the commands give me a bunch of errors.

System.Exception: XOpenDisplay failed

how can i fix this i get the same error on export-csv

Get-AzPasswords -Verbose | Out-GridView
VERBOSE: TmFtZSRfLk5hbWU=
VERBOSE: SWQkXy5JZA==
VERBOSE: VGVuYW50SWQkXy5UZW5hbnRJZA==
VERBOSE: U3RhdGUkXy5TdGF0ZQ==

Unhandled Exception: System.TypeInitializationException: The type initializer for 'OutGridView.Application.AvaloniaAppRunner' threw an exception. ---> System.Exception: XOpenDisplay failed
at Avalonia.X11.AvaloniaX11Platform.Initialize(X11PlatformOptions options)
at Avalonia.Controls.AppBuilderBase`1.Setup()
at OutGridView.Application.AvaloniaAppRunner.BuildAvaloniaApp() in D:\a\1\s\src\OutGridView.Gui\AvaloniaAppRunner.cs:line 34
at OutGridView.Application.AvaloniaAppRunner..cctor() in D:\a\1\s\src\OutGridView.Gui\AvaloniaAppRunner.cs:line 31
--- End of inner exception stack trace ---
at OutGridView.Application.Program.Main(String[] args) in D:\a\1\s\src\OutGridView.Gui\Program.cs:line 26

Get-AzurePasswords does not return data

When I run below command, I do not see any output. It is not prompting for subscription credentials.

  `Get-AzurePasswords -Verbose | Out-GridView`

What may be the cause? I have tried both in PowerShell ISE and command line.

I am new bee to pen-testing. So below question may be silly. What exactly is the use case of running this script? Am I testing authorization here?

Get-AzDomaininfo throwing an API version-related warning

Hello,
I also tried to run "Get-AzDomainInfo" and it has been running for hours while showing the message, "WARNING: This cmdlet is using API version beta which is under preview". See picture below.
I am using Windows 10 Pro. The version of my Windows PowerShell is shown in the picture below.

I would be glad to learn a workaround to this problem.

Originally posted by @isaac-banda in #22 (comment)

Conflicting Modules

MicroBurst won't run on recent versions of PowerShell

This is all instances where MicroBurst will attempt to install modules online

Unfortunately some of these modules can never coexist together anymore. This what I get:

After some digging I found this:

Reference: https://learn.microsoft.com/en-us/powershell/azure/troubleshooting?view=azps-11.2.0#az-and-azurerm-coexistence

I guess the tool needs to be re-written so that it no longer relies on either Azure or AzureRM modules.
AzureAD, Az, MSOnline should be sufficient.