andyrobbins

apiVersion: v1
kind: Pod
metadata:
  name: command-demo-2
  labels:
    purpose: demonstrate-command
spec:
  containers:
  - name: command-demo-container
    image: debian

andyrobbins

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:1.14.2
    ports:
    - containerPort: 8123

andyrobbins

# Function for getting an MS Graph Token
Function Get-MSGraphToken {
    <#
    .DESCRIPTION
    Requests a token from STS with the MS Graph specified as the resource/intended audience
    #>
    [cmdletbinding()]
    param(
        [Parameter(Mandatory = $True)]
        [string]

andyrobbins

Function Get-ARMAPIToken {
    <#
    .DESCRIPTION
    Requests a token from STS with the MS Graph specified as the resource/intended audience
    #>
    [cmdletbinding()]
    param(
        [Parameter(Mandatory = $True)]
        [string]
        $ClientID,

andyrobbins

$psversiontable

andyrobbins

## Granting Global Admin rights by chaining AppRoleAssignment.ReadWrite.All into RoleManagement.ReadWrite.Directory

# Helper function to let us parse Azure JWTs:
function Parse-JWTtoken {
    <#
    .DESCRIPTION
    Decodes a JWT token. This was taken from link below. Thanks to Vasil Michev.
    .LINK
    https://www.michev.info/Blog/Post/2140/decode-jwt-access-and-id-tokens-via-powershell
    #>

andyrobbins

## Find dangerous API permissions as a user

$AzureTenantID = '<Your tenant ID>'
$AccountName = '<Username>@<Domain.com>'
$Password = ConvertTo-SecureString '<Your password>' -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential($AccountName, $Password)
Connect-AzAccount -Credential $Credential -TenantID $AzureTenantID

function Get-AzureGraphToken
{

andyrobbins

andyrobbins

andyrobbins