mirror of
https://github.com/NetSPI/MicroBurst
synced 2026-06-08 12:01:29 +00:00
Update Get-AzDomainInfo.ps1
Storage Account now only lists public list-able files, container names, and containers with "Blob" permissions. Makes the function friendly for dumping storage account info with the "Reader" role.
This commit is contained in:
Karl Fosaaen
+46
-49
@@ -244,68 +244,60 @@ Function Get-AzDomainInfo
|
||||
Foreach ($storageAccount in $storageAccountLists){
|
||||
$StorageAccountName = $storageAccount.StorageAccountName
|
||||
|
||||
Write-Verbose "`tListing out blob files for the $StorageAccountName storage account..."
|
||||
Write-Verbose "`tListing out public blob files for the $StorageAccountName storage account..."
|
||||
|
||||
# Try to Set Context, Write-Verbose if you don't have the rights
|
||||
Try{
|
||||
# Try to get list of containers, check access level for containers
|
||||
|
||||
Set-AzCurrentStorageAccount –ResourceGroupName $storageAccount.ResourceGroupName -Name $storageAccount.StorageAccountName -ErrorAction Stop | Out-Null
|
||||
$ContainerList = Get-AzRmStorageContainer -StorageAccountName $storageAccount.StorageAccountName -ResourceGroupName $storageAccount.ResourceGroupName | select Name, PublicAccess
|
||||
|
||||
if ($ContainerList -ne $null){
|
||||
$ContainerListFile = (-join ($StorageAccountName,'-Containers.csv'))
|
||||
Write-Verbose "`t`tWriting available containers to $ContainerListFile"
|
||||
$ContainerList | Export-Csv -LiteralPath $folder"\Files\"$ContainerListFile -NoTypeInformation
|
||||
|
||||
|
||||
$strgName = $storageAccount.StorageAccountName
|
||||
$ContainerList | ForEach-Object {
|
||||
if ($_.PublicAccess -eq "Container") {
|
||||
Write-Verbose (-join ("`t`tFound Public Container - ",$_.Name))
|
||||
|
||||
# Create folder for each Storage Account for cleaner output
|
||||
if(Test-Path $folder"\Files\"$strgName){}
|
||||
else{New-Item -ItemType Directory $folder"\Files\"$strgName | Out-Null}
|
||||
# URL for listing publicly available files
|
||||
$uriList = "https://"+(-join ($StorageAccountName,'.blob.core.windows.net/',$_.Name))+"/?restype=container&comp=list"
|
||||
$FileList = (Invoke-WebRequest -uri $uriList -Method Get -Verbose:$False).Content
|
||||
|
||||
# Microsoft includes these characters in the response, Thanks...
|
||||
[xml]$xmlFileList = $FileList -replace ''
|
||||
$foundURL = ""
|
||||
$foundURL = $xmlFileList.EnumerationResults.Blobs.Blob.Name
|
||||
|
||||
# List Containers and Files and Export to CSV
|
||||
$containers = Get-AzStorageContainer | select Name
|
||||
|
||||
foreach ($container in $containers){
|
||||
$containerName = $container.Name
|
||||
Write-Verbose "`t`tListing files for the $containerName container"
|
||||
$pathName = "\Files\"+$strgName+"\Blob_Files_"+$container.Name
|
||||
$blobs = Get-AzStorageBlob -Container $container.Name
|
||||
$blobs | ForEach-Object {$_.ICloudBlob | select @{name="Uri"; expression={$_.Uri}},@{name="StorageUri"; expression={$_.StorageUri}},@{name="SnapshotTime"; expression={$_.SnapshotTime}},@{name="IsSnapshot"; expression={$_.IsSnapshot}},@{name="IsDeleted"; expression={$_.IsDeleted}},@{name="SnapshotQualifiedUri"; expression={$_.SnapshotQualifiedUri}},@{name="SnapshotQualifiedStorageUri"; expression={$_.SnapshotQualifiedStorageUri}},@{name="Name"; expression={$_.Name}},@{name="BlobType"; expression={$_.BlobType}}} | Export-Csv -NoTypeInformation -LiteralPath $folder$pathName".CSV"
|
||||
|
||||
# Check if the container is public, write to PublicFileURLs.txt
|
||||
$publicStatus = Get-AzStorageContainerAcl $container.Name | select PublicAccess
|
||||
if (($publicStatus.PublicAccess -eq "Blob")){
|
||||
|
||||
#Write public file URL to list
|
||||
$blobName = Get-AzStorageBlob -Container $container.Name | select Name
|
||||
|
||||
$pubfileName = $blobName.Name
|
||||
|
||||
if ($pubfileName -eq $null){$pubfileName = "Empty_Container_Folder"}
|
||||
Write-Verbose "`t`t`tPublic File Found - $pubfileName"
|
||||
|
||||
$blobName.Name | ForEach-Object{
|
||||
$blobUrl = (-join ("https://$StorageAccountName.blob.core.windows.net/$containerName/",$_))
|
||||
# Write out available files within "Blob" containers
|
||||
$blobUrl >> $folder"\Files\BlobFileURLs.txt"
|
||||
}
|
||||
# Parse the XML results
|
||||
if($foundURL.Length -gt 1){
|
||||
foreach($url in $foundURL){Write-Verbose "`t`t`tPublic File Available: $url"; -join("https://",$StorageAccountName,'.blob.core.windows.net/',$_.Name,"/",$url) | Out-File -LiteralPath $folder"\Files\Container_Files.txt" -Append}
|
||||
}
|
||||
else{Write-Verbose "`t`tEmpty Public Container Available: $uriList";$uriList | Out-File -LiteralPath $folder"\Files\Empty_Containers.txt" -Append}
|
||||
}
|
||||
if ($_.PublicAccess -eq "Blob") {
|
||||
Write-Verbose (-join ("`t`tFound Blob Permissioned Container - ",$_.Name))
|
||||
"https://"+(-join ($StorageAccountName,'.blob.core.windows.net/',$_.Name)) | Out-File -LiteralPath $folder"\Files\Blob_Containers.txt" -Append
|
||||
|
||||
if ($publicStatus.PublicAccess -eq "Container"){
|
||||
Write-Verbose "`t`t`t$containerName Container is Public"
|
||||
#Write public container URL to list
|
||||
$blobName = Get-AzStorageBlob -Container $container.Name | select Name
|
||||
$blobUrl = "https://$StorageAccountName.blob.core.windows.net/$containerName/"
|
||||
$blobUrl >> $folder"\Files\PublicContainers.txt"
|
||||
# Write out available files within "Container" containers
|
||||
foreach ($blobfile in $blobName){
|
||||
$blobUrl = "https://$StorageAccountName.blob.core.windows.net/$containerName/"+$blobfile.Name
|
||||
$blobUrl >> $folder"\Files\ContainersFileUrls.txt"
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
else{Write-Verbose "`t`tNo containers to list in the storage account"}
|
||||
|
||||
# Attempt to list File Shares and Tables - typically requires contributor permissions
|
||||
Try{
|
||||
Set-AzCurrentStorageAccount –ResourceGroupName $storageAccount.ResourceGroupName -Name $storageAccount.StorageAccountName -ErrorAction Stop | Out-Null
|
||||
$strgName = $storageAccount.StorageAccountName
|
||||
|
||||
#Go through each File Service endpoint
|
||||
Try{
|
||||
$AZFileShares = Get-AzStorageShare -ErrorAction Stop | select Name
|
||||
if($AZFileShares.Length -gt 0){
|
||||
|
||||
# Create folder for each Storage Account for cleaner output
|
||||
if(Test-Path $folder"\Files\"$strgName){}
|
||||
else{New-Item -ItemType Directory $folder"\Files\"$strgName | Out-Null}
|
||||
|
||||
Write-Verbose "`tListing out File Service files for the $StorageAccountName storage account..."
|
||||
foreach ($share in $AZFileShares) {
|
||||
$shareName = $share.Name
|
||||
@@ -326,6 +318,11 @@ Function Get-AzDomainInfo
|
||||
Try{
|
||||
$tableList = Get-AzStorageTable -ErrorAction Stop
|
||||
if ($tableList.Length -gt 0){
|
||||
|
||||
# Create folder for each Storage Account for cleaner output
|
||||
if(Test-Path $folder"\Files\"$strgName){}
|
||||
else{New-Item -ItemType Directory $folder"\Files\"$strgName | Out-Null}
|
||||
|
||||
$tableList | Export-Csv -NoTypeInformation -LiteralPath $folder"\Files\"$strgName"\Data_Tables.CSV"
|
||||
Write-Verbose "`tListing out Data Tables for the $StorageAccountName storage account..."
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user