{"id":13498890,"url":"https://github.com/mvelazc0/BadZure","last_synced_at":"2025-03-29T03:32:13.107Z","repository":{"id":180734516,"uuid":"636541972","full_name":"mvelazc0/BadZure","owner":"mvelazc0","description":"BadZure orchestrates the setup of Azure AD tenants, populating them with diverse entities while also introducing common security misconfigurations to create vulnerable tenants with multiple attack paths.","archived":false,"fork":false,"pushed_at":"2023-12-04T16:14:07.000Z","size":412,"stargazers_count":339,"open_issues_count":0,"forks_count":18,"subscribers_count":11,"default_branch":"main","last_synced_at":"2024-02-19T00:32:20.749Z","etag":null,"topics":["azure-active-directory","purpleteaming"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mvelazc0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-05-05T04:52:21.000Z","updated_at":"2024-05-30T00:50:45.057Z","dependencies_parsed_at":"2024-05-30T00:50:44.397Z","dependency_job_id":"734aaecc-1922-4588-b25e-fbfcd145e6c2","html_url":"https://github.com/mvelazc0/BadZure","commit_stats":null,"previous_names":["mvelazc0/badzure"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mvelazc0%2FBadZure","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mvelazc0%2FBadZure/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mvelazc0%2FBadZure/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mvelazc0%2FBadZure/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mvelazc0","download_url":"https://codeload.github.com/mvelazc0/BadZure/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246135700,"owners_count":20729056,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure-active-directory","purpleteaming"],"created_at":"2024-07-31T22:00:18.969Z","updated_at":"2025-03-29T03:32:11.840Z","avatar_url":"https://github.com/mvelazc0.png","language":"PowerShell","funding_links":[],"categories":["EntraID (Azure Active Directory)","Sorted by Technology and Category","Tools","Python","Other Lists"],"sub_categories":["CLI","🧪 LAB"],"readme":"# BadZure\n[![BlackHat Arsenal 2024](https://raw.githubusercontent.com/toolswatch/badges/master/arsenal/usa/2024.svg)](https://www.blackhat.com/asia-23/arsenal/schedule/index.html#purplesharp-automated-adversary-simulation-31336)\n[![Open_Threat_Research Community](https://img.shields.io/badge/Open_Threat_Research-Community-brightgreen.svg)](https://twitter.com/OTR_Community)\n\n\u003cdiv align=\"center\"\u003e\n    \u003cimg src=\"img/BadZure.png\" alt=\"BadZure logo\" style=\"width: 35%; height: 35%;\"\u003e\n\u003c/div\u003e\n\u003cbr\u003e\n\nBadZure is a Python tool that utilizes Terraform to automate the setup of Azure Active Directory (now Entra ID) tenants, populating them with various entities and introducing common security misconfigurations to create vulnerable tenants with multiple attack paths.\n\nBadZure automates the creation of various entities, including users, groups, application registrations, service principals, and administrative units. To simulate common security misconfigurations in real environments, it randomly assigns Azure AD roles, Graph permissions, and application ownership privileges to selected security principals, enabling the creation of unique attack paths. Adhering to the 'Assume Breach' principle, BadZure offers users two methods of initial access to the vulnerable tenants it creates, thereby simulating account takeover scenarios.\n\nThe key advantage of BadZure is its ability to quickly populate and purge Azure AD tenants with randomly generated vulnerable configurations and pre-configured initial access, facilitating continuous and iterative Azure AD adversary simulation and detection development experimentation. It is designed for security practitioners interested in exploring and understanding Azure AD security.\n\n## Goals / Use Cases\n\nBadZure was initialy written to host the [Azure AD Battle School: Hands-on Attack and Defense](https://www.x33fcon.com/#!s/MauricioVelazco.md) workshop at X33fcon 2023.\n\nAn Azure AD tenant populated with BadZure also enables red and blue teams to:\n\n* Experiment with common Azure AD attack vectors and tools\n* Quickly stand up misconfigured Azure AD lab tenants.\n* Obtain attack telemetry to build, test and enhance detection controls\n* Execute purple team exercises in a safe setting\n* Faciliate hands-on Azure AD security training\n* Host dynamic Azure AD Capture the Flag (CTF) events\n\n## Attack Paths\n\n### Initial Access\n\nBadZure simulates initial access by employing common account takeover techniques, including password attacks and token theft. By providing both passwords and tokens, BadZure enables security practitioners to effectively simulate initial access scenarios and explore various attack vectors against Azure AD tenants.\n\n#### Password-Based Access\n\nWhen configured to use passwords, BadZure assigns randomly generated passwords to key user accounts that are part of the attack paths. These passwords are provided to BadZure users to simulate password-based attacks, such as [credential stuffing](https://owasp.org/www-community/attacks/Credential_stuffing) or [password spraying](https://owasp.org/www-community/attacks/Password_Spraying_Attack). Additionally, BadZure automatically generates a users.txt file containing the usernames of all created accounts, facilitating testing strategies like password spraying.\n\n#### Token-Based Access\n\nFor token-based access, BadZure generates JWT access tokens for specified principals. These tokens are provided in the output, simulating scenarios where an attacker has obtained valid tokens through [reverse proxy phishing](https://help.evilginx.com/), [endpoint malware](https://mrd0x.com/stealing-tokens-from-office-applications/) or [device code phishing](https://aadinternals.com/post/phishing/). Users can utilize these tokens to authenticate directly against Azure AD resources, gaining an understanding of potential attack vectors involving token theft.\n\n\n### Privilege Escalation\n\nBadZure simulates privilege escalation by introducing misconfigurations within Azure AD roles, Graph API permissions, and application ownerships. These misconfigurations include assigning high-privilege roles to service principals or users, granting extensive Graph API permissions to applications, and configuring users as owners of privileged applications. These settings allow for the configuration of [service principal abuse](https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5) attack scenarios.\n\nA BloodHound-generated graph, showcasing the attack paths BadZure can create, is shown below.\n\n![](img/attack_paths.png)\n\n## Demo\n\n[![BadZure](https://img.youtube.com/vi/IzurUrOsvsQ/0.jpg)](https://www.youtube.com/watch?v=IzurUrOsvsQ\u0026t=746s)\n\n## Quick Start Guide\n\n### Requirements\n\n- **Azure CLI**: Follow the instructions [here](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli) to install Azure CLI.\n- **Terraform**: Follow the instructions [here](https://learn.hashicorp.com/tutorials/terraform/install-cli) to install Terraform.\n\n### Create an Azure AD Tenant \n\n[Creating an Azure subscription](https://learn.microsoft.com/en-us/training/modules/create-an-azure-account/1-introduction) will also provide you an Azure AD tenant. \n\n**Note:** Utilizing BadZure within your Azure subscription won't lead to any additional costs as it only requires an [Azure AD Free license](https://azure.microsoft.com/en-us/free/).\n\n### Clone Repository\n\n````shell\ngit clone https://github.com/mvelazc0/BadZure\ncd BadZure\n````\n\n### Create virtual environment and install dependencies\n\n```shell\n# Create a virtual environment\npython -m venv venv\n\n# Activate the virtual environment\n# On Windows\nvenv\\Scripts\\activate\n\n# On Unix or MacOS\nsource venv/bin/activate\n\n# Install dependencies\npip install -r requirements.txt\n```\n### Login to Azure as a Global Administrator\n\n```shell\naz login\n````\n\n### Create and destroy vulnerable tenants\n\n````shell\n# Display the help menu\npython badzure.py --help\n\n# Populate a tenant and configure all attack paths using the default badzure.yml config file\npython badzure.py build\n\n# Populate a tenant and configure all attack paths with a different config file\npython badzure.py build --config config.yml\n\n# Show the created resources in Azure AD tenant \npython badzure.py show\n\n# Destroy all created identities with verbose logging\npython badzure.py destroy --verbose\n\n````\n\n## YAML Configuration File\n\nBadZure leverages a configuration file used to configure the setup of the Azure AD tenant. This file allows users to specify details such as the number of users, groups, applications, administrative units, and attack paths to be created.\n\n### Example Configuration\n\n```yaml\ntenant:\n  tenant_id: \"your-tenant-id\"\n  domain: \"your-domain.com\"\n  users: 30\n  groups: 10\n  applications: 10\n  administrative_units: 10\n\nattack_paths:\n\n  attack_path_1:\n    enabled: true\n    initial_access: password \n    privilege_escalation: ServicePrincipalAbuse\n    method: AzureADRole\n    entra_role : random\n\n  attack_path_2:\n    enabled: true\n    initial_access: token\n    privilege_escalation: ServicePrincipalAbuse\n    method: GraphAPIPermission\n    app_role : random \n\n```\n\nFor more details on the configuration options, please refer to the [Wiki](https://github.com/mvelazc0/BadZure/wiki/YAML-Configuration-Guide)\n\n## Author\n\n* **Mauricio Velazco** - [@mvelazco](https://twitter.com/mvelazco)\n\n## Contributors\n\n* [Chan Huan Jun](https://www.linkedin.com/in/chan-huan-jun-50a704115/) \n\n## References\n\n* [Cloud Katana](https://github.com/Azure/Cloud-Katana) by [Roberto Rodriguez](https://twitter.com/Cyb3rWard0g)\n* [AADInternals](https://github.com/Gerenios/AADInternals) by [Nestori Syynimaa](https://twitter.com/DrAzureAD)\n* [Azure Attack Paths](https://cloudbrothers.info/en/azure-attack-paths/) by [Fabian Bader](https://twitter.com/fabian_bader)\n* [ROADtools](https://github.com/dirkjanm/ROADtools) by [Dirkjan Mollema](https://twitter.com/_dirkjan)\n* [PurpleCloud](https://github.com/iknowjason/PurpleCloud) by [Jason Ostrom](https://twitter.com/securitypuck) \n* [Azure AD - Attack and Defense Playbook](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense) by [Sami Lamppu](https://twitter.com/samilamppu) and [Thomas Naunheim](https://twitter.com/Thomas_Live)\n* [BloodHound/AzureHound](https://github.com/BloodHoundAD/AzureHound) by [Andy Robbins](https://twitter.com/_wald0) \n* Blog posts, talks and tools by [@Haus3c](https://twitter.com/Haus3c), [@kfosaaen](https://twitter.com/kfosaaen), [@inversecos](https://twitter.com/inversecos) and others.\n\n## License\n\nThis project is licensed under the Apache 2.0 License - see the [LICENSE](LICENSE) file for details\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmvelazc0%2FBadZure","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmvelazc0%2FBadZure","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmvelazc0%2FBadZure/lists"}