-
Notifications
You must be signed in to change notification settings - Fork 193
Azure Commands
carlosvendramini-bf edited this page Jan 5, 2023
·
22 revisions
Before you can use the Azure commands, you need to:
- Install Azure CLI
- Authenticate with the client:
# az login
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code [REDACTED] to authenticate.
[
{
"cloudName": "AzureCloud",
"homeTenantId": "[REDACTED]",
"id": "[REDACTED]",
"isDefault": true,
"managedByTenants": [],
"name": "[REDACTED]",
"state": "Enabled",
"tenantId": "[REDACTED]",
"user": {
"name": "[REDACTED]",
"type": "user"
}
},
...omitted for brevity...
To list Azure commands:
# ./cloudfox azure -h
For help with a specific subcommand:
./cloudfox azure [command_name] -h
CloudFox offer a --wrap flag for all subcommands that will adjust the table output to the terminal screen when used. This flag does not have any effect on output files.
The whoami command displays information on the current tenant, subscriptions and resource groups available to your current Azure CLI session.
./cloudfox azure whoami
[🦊 cloudfox DEV 🦊 ][whoami] Enumerating Azure CLI sessions...
╭──────────────────────────────────┬──────────────────────────────────┬───────────────────┬─────────────────┬────────┬─────────────────╮
│ Tenant ID │ Subscription ID │ Subscription Name │ RG Name │ Region │ Domain │
├──────────────────────────────────┼──────────────────────────────────┼───────────────────┼─────────────────┼────────┼─────────────────┤
│ 11111111-1111-1111-1111-11111111 │ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ SubscriptionA │ ResourceGroupA1 │ eastus │ cloudfox1.local │
│ 11111111-1111-1111-1111-11111111 │ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ SubscriptionA │ ResourceGroupA2 │ eastus │ cloudfox1.local │
│ 11111111-1111-1111-1111-11111111 │ BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │ SubscriptionB │ ResourceGroupB1 │ eastus │ cloudfox1.local │
│ 11111111-1111-1111-1111-11111111 │ BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │ SubscriptionB │ ResourceGroupB2 │ eastus │ cloudfox1.local │
│ 22222222-2222-2222-2222-22222222 │ CCCCCCCC-CCCC-CCCC-CCCC-CCCCCCCC │ SubscriptionC │ ResourceGroupC1 │ eastus │ cloudfox2.local │
│ 22222222-2222-2222-2222-22222222 │ CCCCCCCC-CCCC-CCCC-CCCC-CCCCCCCC │ SubscriptionC │ ResourceGroupC2 │ eastus │ cloudfox2.local │
╰──────────────────────────────────┴──────────────────────────────────┴───────────────────┴─────────────────┴────────┴─────────────────╯
The instances command enumerates the Compute instances' userful information at subscription or tenant level
Example 1: enumerating instances for a specific subscription
./cloudfox azure instances --tenant 11111111-1111-1111-1111-11111111
[🦊 cloudfox DEV 🦊 ][instances] Enumerating VMs for tenant 11111111-1111-1111-1111-11111111
╭──────────────────────────────────┬──────────┬─────────────┬─────────────┬─────────────┬────────────────┬─────────────────────╮
│ Subscription ID │ VM Name │ VM Location │ Private IPs │ Public IPs │ Admin Username │ Resource Group Name │
├──────────────────────────────────┼──────────┼─────────────┼─────────────┼─────────────┼────────────────┼─────────────────────┤
│ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ TestVM-1 │ us-east-1 │ 192.168.0.1 │ 72.88.100.1 │ admin │ ResourceGroupA1 │
│ │ │ │ 192.168.0.2 │ 72.88.100.2 │ │ │
│ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ TestVM-3 │ us-east-2 │ 192.168.0.5 │ 72.88.100.5 │ admin │ ResourceGroupA1 │
│ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ TestVM-2 │ us-west-2 │ 192.168.0.3 │ 72.88.100.3 │ admin │ ResourceGroupA2 │
│ │ │ │ 192.168.0.4 │ 72.88.100.4 │ │ │
╰──────────────────────────────────┴──────────┴─────────────┴─────────────┴─────────────┴────────────────┴─────────────────────╯
[instances] Output written to [cloudfox-output/azure/tenants/11111111-1111-1111-1111-11111111/table/instances.txt]
[instances] Output written to [cloudfox-output/azure/tenants/11111111-1111-1111-1111-11111111/csv/instances.csv]
Example 2: enumerating instances for a specific tenant
./cloudfox azure instances --subscription AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA
[🦊 cloudfox DEV 🦊 ][instances] Enumerating VMs for subscription AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA
╭──────────────────────────────────┬──────────┬─────────────┬─────────────┬─────────────┬────────────────┬─────────────────────╮
│ Subscription ID │ VM Name │ VM Location │ Private IPs │ Public IPs │ Admin Username │ Resource Group Name │
├──────────────────────────────────┼──────────┼─────────────┼─────────────┼─────────────┼────────────────┼─────────────────────┤
│ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ TestVM-1 │ us-east-1 │ 192.168.0.1 │ 72.88.100.1 │ admin │ ResourceGroupA1 │
│ │ │ │ 192.168.0.2 │ 72.88.100.2 │ │ │
│ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ TestVM-3 │ us-east-2 │ 192.168.0.5 │ 72.88.100.5 │ admin │ ResourceGroupA1 │
│ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ TestVM-2 │ us-west-2 │ 192.168.0.3 │ 72.88.100.3 │ admin │ ResourceGroupA2 │
│ │ │ │ 192.168.0.4 │ 72.88.100.4 │ │ │
╰──────────────────────────────────┴──────────┴─────────────┴─────────────┴─────────────┴────────────────┴─────────────────────╯
[instances] Output written to [cloudfox-output/azure/subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA/table/instances.txt]
[instances] Output written to [cloudfox-output/azure/subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA/csv/instances.csv]
The rbac command maps the Azure RBAC role assignments at subscription or tenant level
Example 1: enumerating Azure RBAC role assignment at subscription level
./cloudfox azure rbac --subscription AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA
[🦊 cloudfox DEV 🦊 ][rbac] Enumerating RBAC permissions for subscription AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA
╭───────────┬─────────────┬─────────────────────────────────────────────────╮
│ User Name │ Role Name │ Role Scope │
├───────────┼─────────────┼─────────────────────────────────────────────────┤
│ User 1 │ Reader │ /subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │
│ User 2 │ Contributor │ /subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │
╰───────────┴─────────────┴─────────────────────────────────────────────────╯
[rbac] Output written to [cloudfox-output/azure/subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA/table/rbac.txt]
[rbac] Output written to [cloudfox-output/azure/subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA/csv/rbac.csv]
Example 2: enumerating Azure RBAC role assignment at tenant level
./cloudfox azure rbac --tenant 11111111-1111-1111-1111-11111111
[🦊 cloudfox DEV 🦊 ][rbac] Enumerating RBAC permissions for tenant 11111111-1111-1111-1111-11111111
╭───────────┬─────────────────────────┬─────────────────────────────────────────────────╮
│ User Name │ Role Name │ Role Scope │
├───────────┼─────────────────────────┼─────────────────────────────────────────────────┤
│ User 1 │ Reader │ /subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │
│ User 2 │ Contributor │ /subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │
│ User 1 │ Data Labeling - Labeler │ /subscriptions/BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │
│ User 3 │ Data Labeling - Labeler │ /subscriptions/BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │
│ User 1 │ Reader │ /subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │
│ User 2 │ Contributor │ /subscriptions/AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │
│ User 1 │ Data Labeling - Labeler │ /subscriptions/BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │
│ User 3 │ Data Labeling - Labeler │ /subscriptions/BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │
╰───────────┴─────────────────────────┴─────────────────────────────────────────────────╯
[rbac] Output written to [cloudfox-output/azure/tenants/11111111-1111-1111-1111-11111111/table/rbac.txt]
[rbac] Output written to [cloudfox-output/azure/tenants/11111111-1111-1111-1111-11111111/csv/rbac.csv]
The storage command is still under development. Currently it only displays limited data about the storage accounts as shown in the examples below.
Example 1: enumerating storage accounts at subscription level
./cloudfox az storage --tenant 11111111-1111-1111-1111-11111111
[🦊 cloudfox DEV 🦊 ][storage] Enumerating storage accounts for tenant 11111111-1111-1111-1111-11111111
╭──────────────────────────────────┬──────────────────────┬─────────────────┬─────────────────────╮
│ Subscription ID │ Storage Account Name │ Kind │ Public Blob Allowed │
├──────────────────────────────────┼──────────────────────┼─────────────────┼─────────────────────┤
│ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ Storage-12345 │ KindBlobStorage │ true │
│ AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAA │ Storage-678910 │ KindStorageV2 │ false │
│ BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │ Storage-1112131415 │ KindStorageV2 │ true │
│ BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │ Storage-16171819 │ KindStorageV2 │ false │
╰──────────────────────────────────┴──────────────────────┴─────────────────┴─────────────────────╯
[storage] Output written to [cloudfox-output/azure/tenants/11111111-1111-1111-1111-11111111/table/storage.txt]
[storage] Output written to [cloudfox-output/azure/tenants/11111111-1111-1111-1111-11111111/csv/storage.csv]
Example 2: enumerating storage accounts at tenant level
./cloudfox az storage --subscription BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB
[🦊 cloudfox DEV 🦊 ][storage] Enumerating storage accounts for subscription BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB
╭──────────────────────────────────┬──────────────────────┬───────────────┬─────────────────────╮
│ Subscription ID │ Storage Account Name │ Kind │ Public Blob Allowed │
├──────────────────────────────────┼──────────────────────┼───────────────┼─────────────────────┤
│ BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │ Storage-1112131415 │ KindStorageV2 │ true │
│ BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB │ Storage-16171819 │ KindStorageV2 │ false │
╰──────────────────────────────────┴──────────────────────┴───────────────┴─────────────────────╯
[storage] Output written to [cloudfox-output/azure/subscriptions/BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB/table/storage.txt]
[storage] Output written to [cloudfox-output/azure/subscriptions/BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBB/csv/storage.csv]