roadrecon 1.6.1__py3-none-any.whl → 1.7.0__py3-none-any.whl

roadtools/roadrecon/gather.py

@@ -723,8 +723,17 @@ def main(args=None):
             dburl = 'sqlite:///' + args.database
     else:
         dburl = args.database
+    try:
+        _, tokendata = Authentication.parse_accesstoken(token['accessToken'])
+    except KeyError:
+        print('No access token found in tokenfile')
+        return
+    if tokendata['aud'] not in ('https://graph.windows.net', 'https://graph.windows.net/', '00000002-0000-0000-c000-000000000000'):
+        print(f"Wrong token audience, got {tokendata['aud']} but expected https://graph.windows.net")
+        print("Make sure to request a token with -r https://graph.windows.net")
+        return
 
-    headers['Authorization'] = '%s %s' % (token['tokenType'], token['accessToken'])
+    headers['Authorization'] = f"Bearer {token['accessToken']}"
 
     seconds = time.perf_counter()
     loop = asyncio.get_event_loop()

roadtools/roadrecon/main.py

@@ -65,6 +65,11 @@ def main():
     gui_parser.add_argument('--profile',
                             action='store_true',
                             help='Enable flask profiler')
+    gui_parser.add_argument('--host',
+                            type=str,
+                            action='store',
+                            help='HTTP Server host to bind to (default=127.0.0.1)',
+                            default='127.0.0.1')
     gui_parser.add_argument('--port',
                             type=int,
                             action='store',
@@ -129,4 +134,4 @@ def main():
         check_database_exists(args.database)
         plugin_module.main(args)
 if __name__ == '__main__':
-    main()
+    main()

roadtools/roadrecon/plugins/policies.py

@@ -229,22 +229,26 @@ class AccessPoliciesPlugin():
             if ctype == 'Acrs':
                 ot += 'Action: '
                 ot += ', '.join([escape(action) for action in clist])
+            elif ctype == 'NetworkAccess':
+                # clist should be a dict, for example {"TrafficProfiles":"Internet"}
+                ot += 'Network access: '
+                ot += ', '.join([f"{escape(action)}: {escape(target)}" for action, target in clist.items()])
             else:
                 if 'All' in clist:
-                    ot += 'All applications'
+                    ot += 'All resources'
                     break
                 if 'None' in clist:
                     ot += 'None'
                     break
                 if 'Office365' in clist:
-                    ot += 'All Office 365 applications'
+                    ot += 'All Office 365 applications '
                 if 'MicrosoftAdminPortals' in clist:
-                    ot += 'All Microsoft Admin Portals'
+                    ot += 'All Microsoft Admin Portals '
                 objects = self._get_application(clist)
                 if objects is not None: 
                     if len(objects) > 0:
                         if ctype == 'Applications':
-                            ot += 'Applications: '
+                            ot += 'Resources: '
                             ot += ', '.join([escape(uobj.displayName) for uobj in objects])
         return ot
 
@@ -491,10 +495,26 @@ class AccessPoliciesPlugin():
     def _parse_sessioncontrols(self, cond):
         if not 'SessionControls' in cond:
             return ''
-        ucond = cond['SessionControls']
+        ucond = []
+        for condition in cond['SessionControls']:
+            if condition == 'SignInFrequency':
+                siftype = cond.get('SignInFrequencyType')
+                if not siftype:
+                    ucond.append('SignInFrequency (Unknown setting)')
+                elif siftype == 30:
+                    ucond.append('SignInFrequency (Every time)')
+                elif siftype == 10:
+                    sifduration = cond.get('SignInFrequencyTimeSpan', '')
+                    ucond.append(f'SignInFrequency (Every {sifduration})')
+                else:
+                    ucond.append(f'SignInFrequency (Unknown SIF type {siftype})')
+            elif condition == 'PersistentBrowserSessionMode':
+                pbmode = cond.get('PersistentBrowserSessionMode')
+                ucond.append(f'PersistentBrowserSession: {pbmode}')
+            else:
+                ucond.append(condition)
         return ', '.join(ucond)
 
-
     def _parse_compressed_cidr(self,detail):
         if not 'CompressedCidrIpRanges' in detail:
             return ''
@@ -521,9 +541,9 @@ class AccessPoliciesPlugin():
                 print(policy.objectId)
             detail = json.loads(policy.policyDetail[0])
             if detail['State'] == 'Reporting':
-                out['name'] += ' (<strong>Report only</strong>)'
+                out['name'] += ' (<i>Report only</i>)'
             elif detail['State'] != 'Enabled':
-                out['name'] += ' (<strong>Disabled</strong>)'
+                out['name'] += ' (<i>Disabled</i>)'
             if should_print:
                 pp.pprint(detail)
             try:
@@ -535,6 +555,7 @@ class AccessPoliciesPlugin():
                     print('Invalid policy - no conditions')
                 continue
             out['who'] = self._parse_who(conditions)
+            out['status'] = escape(detail['State'])
             out['applications'] = self._parse_application(conditions)
             out['authflows'] = self._parse_authflows(conditions)
             out['platforms'] = self._parse_platform(conditions)
@@ -612,7 +633,9 @@ class AccessPoliciesPlugin():
         for out in ol:
             table = '<thead><tr><td colspan="2">{0}</td></tr></thead><tbody>'.format(out['name'])
             table += '<tr><td>Applies to</td><td>{0}</td></tr>'.format(out['who'])
-            table += '<tr><td>Applications</td><td>{0}</td></tr>'.format(out['applications'])
+            if out['status'] != 'Enabled':
+                table += '<tr><td>Policy state</td><td>{0}</td></tr>'.format(out['status'])
+            table += '<tr><td>Resources</td><td>{0}</td></tr>'.format(out['applications'])
             if out['platforms'] != '':
                 table += '<tr><td>On platforms</td><td>{0}</td></tr>'.format(out['platforms'])
             if out['devices'] != '':

roadtools/roadrecon/server.py

@@ -507,9 +507,24 @@ def get_allroles():
                 'scopeNames': snames,
                 'scopeIds': sids
             }
-            _, principal = resolve_objectid(assignment.principalId)
+            principalType, principal = resolve_objectid(assignment.principalId)
             aobj['principal'] = principal
+
             roleobj['assignments'].append(aobj)
+            if principalType == 'Group':
+                group = db.session.get(Group, assignment.principalId)
+                for member in group.memberUsers:
+                    mp = users_schema.dump([member])[0]
+                    mp['displayName'] = f"{principal['displayName']} member: {mp['displayName']}"
+                    roleobj['assignments'].append({
+                        'type': 'assignment',
+                        'scope': assignment.resourceScopes,
+                        'scopeTypes': stypes,
+                        'scopeNames': snames,
+                        'scopeIds': sids,
+                        'principal': mp
+                    })
+
         for assignment in role.eligibleAssignments:
             stypes, snames, sids = translate_rolescopes(assignment.resourceScopes)
             aobj = {
@@ -519,9 +534,22 @@ def get_allroles():
                 'scopeNames': snames,
                 'scopeIds': sids
             }
-            _, principal = resolve_objectid(assignment.principalId)
+            principalType, principal = resolve_objectid(assignment.principalId)
             aobj['principal'] = principal
             roleobj['assignments'].append(aobj)
+            if principalType == 'Group':
+                group = db.session.get(Group, assignment.principalId)
+                for member in group.memberUsers:
+                    mp = users_schema.dump([member])[0]
+                    mp['displayName'] = f"{principal['displayName']} member: {mp['displayName']}"
+                    roleobj['assignments'].append({
+                        'type': 'eligible',
+                        'scope': assignment.resourceScopes,
+                        'scopeTypes': stypes,
+                        'scopeNames': snames,
+                        'scopeIds': sids,
+                        'principal': mp
+                    })
         allroles.append(roleobj)
     return jsonify(allroles)
 
@@ -583,6 +611,11 @@ def main(args=None):
         parser.add_argument('--profile',
                             action='store_true',
                             help='Enable flask profiler')
+        parser.add_argument('--host',
+                            type=str,
+                            action='store',
+                            help='Host IP to bind to (default=127.0.0.1)',
+                            default='127.0.0.1')
         parser.add_argument('--port',
                             type=int,
                             action='store',
@@ -600,7 +633,7 @@ def main(args=None):
     if args.profile:
         from werkzeug.middleware.profiler import ProfilerMiddleware
         app.wsgi_app = ProfilerMiddleware(app.wsgi_app, restrictions=[5])
-    app.run(debug=args.debug, port=args.port)
+    app.run(host=args.host, port=args.port, debug=args.debug)
 
 if __name__ == '__main__':
-    main()
+    main()