← retour aux outils back to tools

# azurehound

Collecteur de données BloodHound pour Azure et Azure Active Directory. Énumère les objets AAD, les attributions de rôles et les chemins d'attaque pour les visualiser dans BloodHound. BloodHound data collector for Azure and Azure Active Directory. Enumerates AAD objects, role assignments, and attack paths for visualization in BloodHound.

↗ https://github.com/BloodHoundAD/AzureHound

## Overview

AzureHound is the Azure/AAD equivalent of SharpHound. It collects data from Azure Active Directory and Azure resources, then feeds it into BloodHound for attack path analysis. It finds privilege escalation paths through Azure RBAC roles, AAD group memberships, service principals, and resource permissions.

## Authentication

With username and password (interactive)

    azurehound -u "user@domain.onmicrosoft.com" -p "P@ssw0rd"

With service principal (client credentials)

    azurehound -a "<TENANT_ID>" --client-id "<APP_ID>" --client-secret "<SECRET>"

With existing access token

    azurehound -t "<ACCESS_TOKEN>"

With device code flow (no credentials needed interactively)

    azurehound --device-code

With refresh token (from AADInternals or roadtx)

    azurehound -r "<REFRESH_TOKEN>" -a "<TENANT_ID>"

## Data Collection

Collect all Azure AD data

    azurehound list -t all --tenant "<TENANT_ID>"

    # Collect specific objects
    azurehound list users -t "<TENANT_ID>"
    azurehound list groups -t "<TENANT_ID>"
    azurehound list roles -t "<TENANT_ID>"
    azurehound list apps -t "<TENANT_ID>"
    azurehound list service-principals -t "<TENANT_ID>"
    azurehound list devices -t "<TENANT_ID>"

Include Azure resource data

    azurehound list -t all --tenant "<TENANT_ID>" --subscriptions

## Output and Import to BloodHound

Collect and save to JSON (import into BloodHound CE)

    azurehound list -t all --tenant "<TENANT_ID>" -o azurehound.json

Start BloodHound CE locally

    docker run -p 7474:7474 -p 7687:7687 specterops/bloodhound-ce:latest

    # Import data via BloodHound UI:
    # Administration → File Ingest → Upload azurehound.json

## Tenant Discovery

Find tenant ID from domain

    curl "https://login.microsoftonline.com/<domain.com>/.well-known/openid-configuration" \
      | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['token_endpoint'].split('/')[3])"

List available subscriptions after auth

    azurehound list subscriptions

## What AzureHound Collects

    AAD Objects:
      Users, Groups, Service Principals, Applications
      Device registrations, Role assignments
      Group memberships and ownership
      Conditional Access policies

    Azure Resources:
      Subscriptions and management groups
      Resource groups
      VM instances
      Key Vaults and secrets
      Storage accounts
      App Services and Function Apps

## BloodHound Attack Paths (Azure)

    AZAddMembers          → Add members to groups
    AZOwns                → Ownership gives full control
    AZContributor         → Azure resource contributor role
    AZUserAccessAdministrator → Grant any role
    AZResetPassword       → Reset AAD user password
    AZApplicationAdministrator → Manage all applications
    AZGlobalAdmin         → Full AAD admin

## Tips

- Combine with on-prem BloodHound data for hybrid AD environments
- `AZContributor` + resource with MSI can escalate to other resources
- Service principals with `AZOwns` on app registrations can add credentials
- Check for `AZAddSecret` edges — allows adding secrets to service principals

Getting Access Tokens (for azurehound)

    # Using roadtx (token theft toolkit)
    pip install roadtx
    roadtx gettokens --username user@domain.com --password pass

Using AADInternals (PowerShell)

    Get-AADIntAccessTokenForMSGraph -Credentials (Get-Credential) | ConvertFrom-Json

    # Using az CLI
    az login
    az account get-access-token --resource https://graph.microsoft.com

## Vue d’ensemble

AzureHound est l’équivalent Azure/AAD de SharpHound. Il collecte des données depuis Azure Active Directory et les ressources Azure, puis les injecte dans BloodHound pour l’analyse de chemins d’attaque. Il trouve les chemins d’élévation de privilèges à travers les rôles Azure RBAC, les appartenances de groupe AAD, les service principals et les permissions sur les ressources.

## Authentification

    # Avec nom d'utilisateur et mot de passe (interactif)
    azurehound -u "user@domain.onmicrosoft.com" -p "P@ssw0rd"

    # Avec un service principal (client credentials)
    azurehound -a "<TENANT_ID>" --client-id "<APP_ID>" --client-secret "<SECRET>"

    # Avec un access token existant
    azurehound -t "<ACCESS_TOKEN>"

    # Avec le device code flow (aucun identifiant à saisir interactivement)
    azurehound --device-code

    # Avec un refresh token (depuis AADInternals ou roadtx)
    azurehound -r "<REFRESH_TOKEN>" -a "<TENANT_ID>"

## Collecte de données

    # Collecter toutes les données Azure AD
    azurehound list -t all --tenant "<TENANT_ID>"

    # Collecter des objets spécifiques
    azurehound list users -t "<TENANT_ID>"
    azurehound list groups -t "<TENANT_ID>"
    azurehound list roles -t "<TENANT_ID>"
    azurehound list apps -t "<TENANT_ID>"
    azurehound list service-principals -t "<TENANT_ID>"
    azurehound list devices -t "<TENANT_ID>"

    # Inclure les données des ressources Azure
    azurehound list -t all --tenant "<TENANT_ID>" --subscriptions

## Sortie et import dans BloodHound

    # Collecter et sauvegarder en JSON (à importer dans BloodHound CE)
    azurehound list -t all --tenant "<TENANT_ID>" -o azurehound.json

    # Démarrer BloodHound CE en local
    docker run -p 7474:7474 -p 7687:7687 specterops/bloodhound-ce:latest

    # Importer les données via l'UI BloodHound :
    # Administration → File Ingest → Upload azurehound.json

## Découverte de tenant

    # Trouver l'ID de tenant depuis un domaine
    curl "https://login.microsoftonline.com/<domain.com>/.well-known/openid-configuration" \
      | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['token_endpoint'].split('/')[3])"

    # Lister les souscriptions disponibles après authentification
    azurehound list subscriptions

## Ce que collecte AzureHound

    AAD Objects:
      Users, Groups, Service Principals, Applications
      Device registrations, Role assignments
      Group memberships and ownership
      Conditional Access policies

    Azure Resources:
      Subscriptions and management groups
      Resource groups
      VM instances
      Key Vaults and secrets
      Storage accounts
      App Services and Function Apps

## Chemins d’attaque BloodHound (Azure)

    AZAddMembers          → Add members to groups
    AZOwns                → Ownership gives full control
    AZContributor         → Azure resource contributor role
    AZUserAccessAdministrator → Grant any role
    AZResetPassword       → Reset AAD user password
    AZApplicationAdministrator → Manage all applications
    AZGlobalAdmin         → Full AAD admin

## Conseils

- Combinez avec les données BloodHound on-prem pour les environnements AD hybrides
- `AZContributor` + une ressource avec une MSI peut permettre de rebondir vers d’autres ressources
- Les service principals ayant `AZOwns` sur des app registrations peuvent y ajouter des identifiants
- Cherchez les edges `AZAddSecret` : ils permettent d’ajouter des secrets aux service principals

Obtenir des access tokens (pour azurehound)

    # Using roadtx (token theft toolkit)
    pip install roadtx
    roadtx gettokens --username user@domain.com --password pass

Using AADInternals (PowerShell)

    Get-AADIntAccessTokenForMSGraph -Credentials (Get-Credential) | ConvertFrom-Json

    # Using az CLI
    az login
    az account get-access-token --resource https://graph.microsoft.com