Update v1.0

mlcsec · mlcsec · commit a9abd533401f · 2024-07-24T14:45:08.000+01:00
diff --git a/Graphpython/__main__.py b/Graphpython/__main__.py
@@ -196,13 +196,12 @@ def main():
                             "display-lapsaccountprotectionpolicyrules",
                             "display-usergroupaccountprotectionpolicyrules", "add-exclusiongrouptopolicy",
                             "deploy-maliciousscript", "deploy-maliciousweblink", "backdoor-script",
-                            "update-deviceconfig", "reboot-device", "retire-device", "lock-device",
-                            "shutdown-device"]:
+                            "update-deviceconfig", "reboot-device", "lock-device", "shutdown-device"]:
             getattr(intune_exploit, args.command.replace("-", "_"))(args)
 
         # Cleanup commands
         elif args.command in ["delete-user", "delete-group", "remove-groupmember", "delete-application",
-                            "delete-device", "wipe-device"]:
+                            "delete-device", "wipe-device", "retire-device"]:
             getattr(cleanup, args.command.replace("-", "_"))(args)
 
         # Locator commands
diff --git a/Graphpython/commands/cleanup.py b/Graphpython/commands/cleanup.py
@@ -5,6 +5,7 @@
 # Cleanup #
 ###########
 
+# delete-user
 def delete_user(args):
     if not args.id:
         print_red("[-] Error: --id argument is required for Delete-User command")
@@ -27,6 +28,7 @@ def delete_user(args):
         print_red(response.text)
     print("=" * 80)
 
+# delete-group
 def delete_group(args):
     if not args.id:
         print_red("[-] Error: --id argument is required for Delete-Group command")
@@ -49,6 +51,7 @@ def delete_group(args):
         print_red(response.text)
     print("=" * 80)
 
+# remove-groupmember
 def remove_groupmember(args):
     if not args.id:
         print_red("[-] Error: --id groupid,objectid required for Remove-GroupMember command")
@@ -77,6 +80,7 @@ def remove_groupmember(args):
         print_red(response.text)
     print("=" * 80)
 
+# delete-application
 def delete_application(args):
     if not args.id:
         print_red("[-] Error: --id argument is required for Delete-Application command")
@@ -99,6 +103,7 @@ def delete_application(args):
         print_red(response.text)
     print("=" * 80)
 
+# delete-device
 def delete_device(args):
     if not args.id:
         print_red("[-] Error: --id argument is required for Delete-Device command")
@@ -121,6 +126,7 @@ def delete_device(args):
         print_red(response.text)
     print("=" * 80)
 
+# wipe-device 
 def wipe_device(args):
     if not args.id:
         print_red("[-] Error: --id argument is required for Wipe-Device command")
@@ -149,4 +155,28 @@ def wipe_device(args):
     else:
         print_red(f"[-] Failed to initiate device wipe: {response.status_code}")
         print_red(response.text)
+    print("=" * 80)
+
+# retire-device
+def retire_device(args):
+    if not args.id:
+        print_red("[-] Error: --id argument is required for Retire-Device command")
+        return
+
+    print_yellow("[*] Retire-Device")
+    print("=" * 80)
+    api_url = f"https://graph.microsoft.com/beta/deviceManagement/managedDevices/{args.id}/retire"
+    user_agent = get_user_agent(args)
+    
+    headers = {
+        'Authorization': f'Bearer {get_access_token(args.token)}',
+        'User-Agent': user_agent
+    }
+    
+    response = requests.post(api_url, headers=headers)
+    if response.ok:
+        print_green(f"[+] Device retire initiated successfully")
+    else:
+        print_red(f"[-] Failed to initiate device retire: {response.status_code}")
+        print_red(response.text)
     print("=" * 80)
diff --git a/Graphpython/commands/intune_exploit.py b/Graphpython/commands/intune_exploit.py
@@ -1972,30 +1972,6 @@ def reboot_device(args):
         print_red(response.text)
     print("=" * 80)
 
-# retire-device
-def retire_device(args):
-    if not args.id:
-        print_red("[-] Error: --id argument is required for Retire-Device command")
-        return
-
-    print_yellow("[*] Retire-Device")
-    print("=" * 80)
-    api_url = f"https://graph.microsoft.com/beta/deviceManagement/managedDevices/{args.id}/retire"
-    user_agent = get_user_agent(args)
-    
-    headers = {
-        'Authorization': f'Bearer {get_access_token(args.token)}',
-        'User-Agent': user_agent
-    }
-    
-    response = requests.post(api_url, headers=headers)
-    if response.ok:
-        print_green(f"[+] Device retire initiated successfully")
-    else:
-        print_red(f"[-] Failed to initiate device retire: {response.status_code}")
-        print_red(response.text)
-    print("=" * 80)
-
 # lock-device
 def lock_device(args):
     if not args.id:
diff --git a/Graphpython/utils/helpers.py b/Graphpython/utils/helpers.py
@@ -161,7 +161,6 @@ def list_commands():
         ["Display-UserGroupAccountProtectionPolicyRules", "Display user group account protection policy rules"],
         ["Add-ExclusionGroupToPolicy", "Bypass av, asr, etc. rules by adding an exclusion group containing compromised user or device"],
         ["Reboot-Device", "Reboot managed device"],
-        ["Retire-Device", "Retire managed device"],
         ["Lock-Device", "Lock managed device"],
         ["Shutdown-Device", "Shutdown managed device"],
         ["Update-DeviceConfig", "Update properties of the managed device configuration"]
@@ -174,6 +173,7 @@ def list_commands():
         ["Delete-Application", "Delete an application"],
         ["Delete-Device", "Delete managed device"],
         ["Wipe-Device", "Wipe managed device"],
+        ["Retire-Device", "Retire managed device"]
     ]
 
     locator_commands = [
