Legacy-AzureHound.ps1
Legacy-AzureHound.ps1 copied to clipboard
Fix $SPOS variable for application to service principal relations
Thanks for AzureHound, a really interesting tool. I've been playing with and debugging the code and think I found an issue.
In this section of code listed below that is "processing the application to service principal relations", it looks like the $SPOS
variable is supposed to return the data, but in fact it isn't being set:
https://github.com/BloodHoundAD/AzureHound/blob/master/AzureHound.ps1#L1359-L1370
$SPOS
is being used later in the script to gather the application administrators and filter ServicePrincipalID
, so the intent must be to use it. For example, here $SPOS
is used:
https://github.com/BloodHoundAD/AzureHound/blob/master/AzureHound.ps1#L1398
Here is a suggestion to make $SPOS
populate the $ServicePrincipals
. This sets $SPOS
to what is added for the $Coll
Array:
$Coll = New-Object System.Collections.ArrayList
Write-Info "Processing application to service principal relations"
$SPOS = Get-AzADApplication | Get-AzADServicePrincipal | %{
$ServicePrincipals = [PSCustomObject]@{
AppId = $_.AppId
AppName = $_.DisplayName
ServicePrincipalId = $_.Id
}
$null = $Coll.Add($ServicePrincipals)
}
$SPOS = $Coll
I tried to create a PR for this but it doesn't look like you allow random people to contribute. All good. Thanks!
I can indeed a confirm a bug when it comes to timestamp-azapplicationtosp.json
, mine shows some null
values which therefore affect the data completeness of BloodHound
, see:
{
"AppId": null,
"AppName": "REDACTED",
"ServicePrincipalId": "REDACTED",
"ServicePrincipalType": null
},
We appreciate the PR. Just letting you know that we're about to release an update to AzureHound that addresses this and several other things.