From ec00a5ff93e5ec5c38776e61416627c6f58dabc2 Mon Sep 17 00:00:00 2001 From: Karim El-Melhaoui Date: Fri, 21 Oct 2022 17:39:44 +0200 Subject: [PATCH] Added function to enable Elevated Access Toggle --- REST/Invoke-AzElevatedAccessToggle.ps1 | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 REST/Invoke-AzElevatedAccessToggle.ps1 diff --git a/REST/Invoke-AzElevatedAccessToggle.ps1 b/REST/Invoke-AzElevatedAccessToggle.ps1 new file mode 100644 index 0000000..aa47897 --- /dev/null +++ b/REST/Invoke-AzElevatedAccessToggle.ps1 @@ -0,0 +1,23 @@ +Function Invoke-AzElevatedAccessToggle { + + # Author: Karim El-Melhaoui(@KarimMelhaoui), O3 Cyber + # Description: PowerShell function for invoking Elevated Access Toggle + # https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin + # https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT402/AZT402/ + + try { + + $Token = Get-AzAccessToken + $Headers = @{Authorization = "Bearer $($Token.Token)" } + $ElevatedAccessToggle = Invoke-RestMethod -Method POST -Uri "https://management.azure.com/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01" -Headers $Headers + + $ElevatedAccessToggle + Write-Output "Granting current principal at User Access Administrator at Root level." + + } + catch { + Write-Output "Something went wrong. : $_" + Write-Output "`nThis is likely because the principal is not Global Administrator." + } + +} \ No newline at end of file