mvelazc0 / badzure

BadZure orchestrates the setup of Azure AD tenants, populating them with diverse entities while also introducing common security misconfigurations to create vulnerable tenants with multiple attack paths.

Hi there 👋

I'm Mauricio. Currently, I'm a threat researcher at Splunk's Threat Research Team. My areas of focus include detection engineering, threat hunting and adversary simulation.

I (ocassionally) maintain a blog at https://medium.com/@mvelazco/.

I have presented and hosted workshops at conferences including BlackHat Arsenal, Defcon, DerbyCon, BSides, X33fcon, BruCON, Splunk .conf, SANS, MITRE ATT&CKcon, and others. Most of these can be found here: Talks-Presentations.

You can also find me on Twitter and LinkedIn.

---

badzure's Issues

race condition when creating all attack paths

when creating all attack paths, there is a possibility that the Get-Random commandlet picks the same app registration more than once. this breaks the process as applications can only have one owner

Repeated Util Function (GetRandomUser)

Hello,

I notice that the GetRandomUser function seems to be defined twice - in lines 637 to 655

BadZure/Invoke-BadZure.ps1

Line 637 in 14cd3ea

Function GetRandomUser{

and subsequently in lines 660 to 677

BadZure/Invoke-BadZure.ps1

Line 660 in 14cd3ea

Function GetRandomUser{

Am not sure if this was intended!

Authentication timeout of 120 seconds on line 87.

[CloudShell users]
When creating the lab for the first time, the line 87 gives me timeout of 120 secs.

Connect-Graph -Scopes "Application.ReadWrite.All", "Directory.AccessAsUser.All","EntitlementManagement.ReadWrite.All","RoleManagement.ReadWrite.Directory","Group.Read.All" | Out-Null

To solve this we can try to run the command manually.

Connect-MpGraph -Scopes "Application.ReadWrite.All", "Directory.AccessAsUser.All","EntitlementManagement.ReadWrite.All","RoleManagement.ReadWrite.Directory","Group.Read.All"