Azure / SimuLand

Understand adversary tradecraft and improve detection strategies
MIT License
694 stars 79 forks source link

Issue on page /environments/aadHybridIdentityADFS/README.html #34

Closed eepyaich closed 1 year ago

eepyaich commented 1 year ago

The command listed at the bottom of the "Elevate Account Access" section didn't work for me (I received an "argument --assignee-object-id: expected one argument" error). I think this is because the "az ad signed-in-user" command didn't return an "objectId", just an "Id". [I'm using azure CLI version 2.39.0]

I guess that replacing the following:

az role assignment create --scope '/' --role 'Owner' --assignee-object-id $(az ad signed-in-user show --query objectId) --assignee-principal-type User

with:

az role assignment create --scope '/' --role 'Owner' --assignee-object-id $(az ad signed-in-user show --query Id) --assignee-principal-type User

is the correct fix, but it would be good for someone more familiar with the lab to confirm.

Cyb3rWard0g commented 1 year ago

With azure cli 2.24.2, ObjectId works

image

Cyb3rWard0g commented 1 year ago

welp. Az CLI 2.46 does not like Upper case Id. image

Cyb3rWard0g commented 1 year ago

I believe the following would be better to avoid "Id" case.

az ad signed-in-user show | ConvertFrom-Json | Select -ExpandProperty Id