Skip to content

Commit 33a07ec

Browse files
mlcsecmlcsec
authored
Update README.md
1 parent 9ecf695 commit 33a07ec

1 file changed

Lines changed: 23 additions & 7 deletions

File tree

‎README.md‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ GraphPython covers external reconnaissance, authentication/token manipulation, e
4141
- [Post-Auth Intune Exploitation](#post-auth-intune-exploitation-1)
4242
- [Display-AVPolicyRules](#display-avpolicyrules)
4343
- [Get-ScriptContent](#get-scriptcontent)
44+
- [Backdoor-Script](#backdoor-script)
4445
- [Deploy-MaliciousScript](#deploy-maliciousscript)
4546
- [Add-ExclusionGroupToPolicy](#add-exclusiongrouptopolicy)
4647
- [Cleanup](#cleanup-1)
@@ -62,10 +63,9 @@ pip3 install -r requirements.txt
6263
## Usage
6364

6465
```
65-
usage: graphpython.py [-h] [--command COMMAND] [--list-commands] [--token TOKEN] [--estsauthcookie ESTSAUTHCOOKIE] [--use-cae] [--cert CERT] [--domain DOMAIN] [--tenant TENANT] [--username USERNAME]
66-
[--secret SECRET] [--id ID] [--select SELECT] [--query QUERY] [--search SEARCH] [--entity {driveItem,message,chatMessage,site,event}] [--device {mac,windows,androidmobile,iphone}]
67-
[--browser {android,IE,chrome,firefox,edge,safari}] [--only-return-cookies] [--mail-folder {allitems,inbox,archive,drafts,sentitems,deleteditems,recoverableitemsdeletions}] [--top TOP]
68-
[--script SCRIPT] [--email EMAIL]
66+
usage: graphpython.py [-h] [--command COMMAND] [--list-commands] [--token TOKEN] [--estsauthcookie ESTSAUTHCOOKIE] [--use-cae] [--cert CERT] [--domain DOMAIN] [--tenant TENANT] [--username USERNAME] [--secret SECRET] [--id ID] [--select SELECT] [--query QUERY]
67+
[--search SEARCH] [--entity {driveItem,message,chatMessage,site,event}] [--device {mac,windows,androidmobile,iphone}] [--browser {android,IE,chrome,firefox,edge,safari}] [--only-return-cookies]
68+
[--mail-folder {allitems,inbox,archive,drafts,sentitems,deleteditems,recoverableitemsdeletions}] [--top TOP] [--script SCRIPT] [--email EMAIL]
6969
7070
options:
7171
-h, --help show this help message and exit
@@ -95,7 +95,7 @@ options:
9595
--mail-folder {allitems,inbox,archive,drafts,sentitems,deleteditems,recoverableitemsdeletions}
9696
Mail folder to dump (dump-owamailbox)
9797
--top TOP Number (int) of messages to retrieve (dump-owamailbox)
98-
--script SCRIPT File containing the script content (deploy-maliciousscript)
98+
--script SCRIPT File containing the script content (deploy-maliciousscript and backdoor-script)
9999
--email EMAIL File containing OWA email message body content (spoof-owaemailmessage)
100100
```
101101

@@ -225,6 +225,7 @@ Please refer to the [Wiki](https://github.com/mlcsec/Graphpython/wiki) for the f
225225

226226
* **Dump-DeviceManagementScripts** - Dump device management PowerShell scripts
227227
* **Get-ScriptContent** - Get device management script content
228+
* **Backdoor-Script** - Add malicious code to pre-existing device management script
228229
* **Deploy-MaliciousScript** - Deploy new malicious device management PowerShell script (all devices)
229230
* **Display-AVPolicyRules** - Display antivirus policy rules
230231
* **Display-ASRPolicyRules** - Display Attack Surface Reduction (ASR) policy rules
@@ -478,6 +479,21 @@ Get all device management PowerShell script details and content:
478479

479480
![](./.github/getscriptcontent.png)
480481

482+
### Backdoor-Script
483+
484+
Identify a pre-existing device management script you want to add malicious code to and get it's content:
485+
486+
![](./.github/getscriptcontent-new.png)
487+
488+
Create a new script locally with the existing content and your malicious code added:
489+
490+
![](./.github/createdirbackdoored.png)
491+
492+
Supply the backdoored script to the --script flag which will then patch the existing script:
493+
494+
![](./.github/backdoorscript.png)
495+
496+
481497
### Deploy-MaliciousScript
482498

483499
Creating the new script and assignment options:
@@ -582,10 +598,10 @@ Graph permission IDs applied to objects can be easily located with detailed expl
582598
- [x] `Spoof-OWAEmailMessage` - add --email option containing formatted message as only accepts one line at the mo...
583599
- [x] `Deploy-MaliciousScript` - add input options to choose runAsAccount, enforceSignatureCheck, etc. and more assignment options
584600
- [x] `Get-DeviceConfigurationPolicies` - tidy up the templateReference and assignmentTarget output
585-
- [ ] `Add-ApplicationPermission` - logic check to ensure existing perms aren't overridden
601+
- [ ] `Add-ApplicationPermission` - check logic to ensure existing perms aren't overridden
586602
- New:
587603
- [ ] `Grant-AdminConsent` - grant admin consent for requested/applied admin app permissions
588-
- [ ] `Backdoor-Script` - first user downloads target script content then adds their malicious code, supply updated script as args, encodes then [patch](https://learn.microsoft.com/en-us/graph/api/intune-shared-devicemanagementscript-update?view=graph-rest-beta)
604+
- [x] `Backdoor-Script` - first user downloads target script content then adds their malicious code, supply updated script as args, encodes then [patch](https://learn.microsoft.com/en-us/graph/api/intune-shared-devicemanagementscript-update?view=graph-rest-beta)
589605
- [ ] `Deploy-MaliciousWin32App` - use IntuneWinAppUtil.exe to package the EXE/MSI and deploy to devices
590606
- check also [here](https://learn.microsoft.com/en-us/graph/api/resources/intune-app-conceptual?view=graph-rest-1.0) for managing iOS, Android, LOB apps etc. via graph
591607
- [x] `Add-ApplicationCertificate` - similar to add-applicationpassword but gen and assign openssl cert to ent app

0 commit comments

Comments
 (0)