Legacy-AzureHound.ps1 icon indicating copy to clipboard operation
Legacy-AzureHound.ps1 copied to clipboard

Fix $SPOS variable for application to service principal relations

Open iknowjason opened this issue 2 years ago • 2 comments

Thanks for AzureHound, a really interesting tool. I've been playing with and debugging the code and think I found an issue.

In this section of code listed below that is "processing the application to service principal relations", it looks like the $SPOS variable is supposed to return the data, but in fact it isn't being set:

https://github.com/BloodHoundAD/AzureHound/blob/master/AzureHound.ps1#L1359-L1370

$SPOS is being used later in the script to gather the application administrators and filter ServicePrincipalID, so the intent must be to use it. For example, here $SPOS is used: https://github.com/BloodHoundAD/AzureHound/blob/master/AzureHound.ps1#L1398

Here is a suggestion to make $SPOS populate the $ServicePrincipals. This sets $SPOS to what is added for the $Coll Array:

   $Coll = New-Object System.Collections.ArrayList
   Write-Info "Processing application to service principal relations"
   $SPOS = Get-AzADApplication | Get-AzADServicePrincipal | %{

    $ServicePrincipals = [PSCustomObject]@{
        AppId                   = $_.AppId
        AppName                 = $_.DisplayName
        ServicePrincipalId      = $_.Id
    }

    $null = $Coll.Add($ServicePrincipals)


    }

    $SPOS = $Coll

I tried to create a PR for this but it doesn't look like you allow random people to contribute. All good. Thanks!

iknowjason avatar Jun 14 '22 17:06 iknowjason

I can indeed a confirm a bug when it comes to timestamp-azapplicationtosp.json, mine shows some null values which therefore affect the data completeness of BloodHound, see:

    {
        "AppId":  null,
        "AppName":  "REDACTED",
        "ServicePrincipalId":  "REDACTED",
        "ServicePrincipalType":  null
    },

aress31 avatar Jul 20 '22 00:07 aress31

We appreciate the PR. Just letting you know that we're about to release an update to AzureHound that addresses this and several other things.

rvazarkar avatar Jul 20 '22 01:07 rvazarkar