elastic / SWAT

Simple Workspace Attack Tool (SWAT) is a tool for simulating malicious behavior against Google Workspace in reference to the MITRE ATT&CK framework.
Apache License 2.0
161 stars 7 forks source link

[Maintenance] Adjust `authenticate.py` to expose credential stored and service account usage #39

Closed terrancedejesus closed 1 year ago

terrancedejesus commented 1 year ago

Overview

This PR adds services accounts as a capability within SWAT for authentication. The reason being for adversary emulation/simulation with another Google Account. The main SWAT tool will use OAuth, thus requiring the OAuth workflow and consent.

It also cleans up main.py and removes the need to start the shell with credentials so a user can just start the shell by calling swat. Once in, use authenticate --help to understand what is possible.

_authenticate_service_account can be used to return creds necessary in an emulation module to build a service client for one of Google Workspace's services. SWAT will also check environment variables first for credentials or a token before referencing a file.

We will need to update the docs for this. I avoided using service accounts only for SWAT as it would make this tool an "off-the-shelf" target by skiddies whom may have simply compromised service account credentials.

brokensound77 commented 1 year ago

image

Remaining bug to solve

image

When the file is loaded from disk, it is not fully loading the types expected for the dataclass (cred_store)