Support for graph.microsoft.com

[mgeeky]

Yet another question (or maybe issue while running roadrecon) - sorry for being a bother! :)

Are there any plans for adding support for https://graph.microsoft.com based enumeration?

My use case is that I came in possession of access token scoped precisely for that client with User.Read User.ReadBasic.All scope and found that ROADtools are not able to help me pull data using this token.
Ultimately I guess I need to poke around manually?

(Invoke-RestMethod @{Uri="https://graph.microsoft.com";Headers=@{'Authorization'="Bearer $token"}; Method='GET'}).value

Regards,
Mariusz.

[dirkjanm]

I may at some point, but the Microsoft graph has a completely different API schema, so the entire setup of the database/collection/api/frontend would have to change as well.
Note that the token you have only allows to read info of the current user, so you couldn't really enumerate anything beyond the current user.

[mgeeky]

Yes, I'm aware of my permission limitations. It would be cool if that was added.

Using the occassion, can I somehow make roadrecon add new records to the existing database, rather than wiping it and starting from scratch during gather? I would like to collect recon data using multiple access tokens collected from various prinicipals and have all results collected to the same database.

Is this even possible?

[dirkjanm]

Not without editing the code. You could comment out various tasks in gather.py and modify it to not wipe the database. Duplicate data will cause errors in that case though.

[FuzzySecurity]

➕

[TH3xACE]

a nice have to be able to support msgraph for enumeration that will future proof also when aadgraph will be out of service.

[tyler-collins-expel]

Per Microsoft documentation, Azure Active Directory (Azure AD) Graph is deprecated meaning the gather capability is no longer functioning whatsoever, from what I understand.

[realalexandergeorgiev]

Damn, I fell for this as well. Ofc the usual suspects were here already (I mean you @mgeeky et al :))

The raw error message (in case it helps some lost soul):

14:40 root@kaliope test $ roadrecon gather
Wrong token audience, got https://graph.microsoft.com/ but expected https://graph.windows.net
Make sure to request a token with -r https://graph.windows.net

[l33tluigi]

use -c msbroker

[realalexandergeorgiev]

use -c msbroker

Thank you. Cannot test right now (Error during authentication: AADSTS53003: Access has been blocked by Conditional Access policies...), but will keep it in mind