Andy Robbins Profile picture
Product Architect of BloodHound Enterprise. Co-creator of BloodHound. Please donate to MDA: https://t.co/wtLm1eFzRc. He/him. @SpecterOps. Mstdn: @wald0@infosec.exchange

Feb 17, 2023, 8 tweets

This week I added 5 new functions to #BARK. A quick thread explaining each one with examples:

Get-ServicePrincipalOwner

List the current owner(s) of a specified #Azure AD Service Principal.

Example:

New-ServicePrincipalOwner

Add a new owner to an AAD Service Principal. Owners can add credentials to SPs and then auth as them.

Example:

Get-AllAzureRMWebApps

Retrieve all Web Apps under a given subscription. Does not return Function Apps.

Example:

Get-AzureRMWebAppPublishingCredentials

Retrieve the credentials needed to publish web app code to an Azure Web App. These creds are also valid for accessing the Kudu API endpoints.

Example:

Invoke-AzureRMWebAppShellCommand

Takes either an AzureRM-scoped token or Web App Publishing Credentials and executes a command on the Web App container via the Kudu API.

Prior work by @passthehashbrwn, details in reply below

Example:

Prior work: @passthehashbrwn committed Invoke-AzAppServicesCMD to the MicroBurst project in September 2021 - github.com/NetSPI/MicroBu…

Share this Scrolly Tale with your friends.

A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.

Keep scrolling