From 6cbd05960559229e6a55e16a1b0e7ce27b61585a Mon Sep 17 00:00:00 2001
From: AvishaiEZen <152059625+AvishaiEZen@users.noreply.github.com>
Date: Sat, 23 Nov 2024 16:39:13 +0200
Subject: [PATCH] Added all initial changes
---
init_repo.py | 42 ++++++++++++++++++----------
readme.md | 27 +++++++++++-------
src/powerpwn/powerpages/__init__.py | 0
zenity_logo.png | Bin 0 -> 78243 bytes
zenity_logo.svg | 1 -
5 files changed, 44 insertions(+), 26 deletions(-)
create mode 100644 src/powerpwn/powerpages/__init__.py
create mode 100644 zenity_logo.png
delete mode 100644 zenity_logo.svg
diff --git a/init_repo.py b/init_repo.py
index 7744f8d..97dddac 100644
--- a/init_repo.py
+++ b/init_repo.py
@@ -8,37 +8,49 @@ def log(message: str) -> None:
def check_python_version() -> bool:
+ """
+ Check if the current Python version is between 3.6 and 3.8 inclusive.
+ """
version_info = sys.version_info
if version_info.major != 3:
return False
if version_info.minor < 6 or version_info.minor > 8:
return False
-
return True
+def find_python() -> str:
+ """
+ Get the path of the currently running Python executable.
+ """
+ return sys.executable
+
+
def main() -> None:
- if check_python_version():
- log("Creating virtual environment")
- subprocess.run("python -m venv .venv") # nosec
+ if not check_python_version():
+ log("Error: Supported Python versions are between 3.6 and 3.8.")
+ log(f"Detected Python version: {sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}")
+ sys.exit(1)
- log("Installing python packages")
- py_path = os.path.join(".venv", "Scripts", "python")
+ python_executable = find_python()
+ log(f"Using Python executable: {python_executable}")
- if not sys.platform.startswith("win"):
- py_path = os.path.join(".venv", "bin", "python")
+ log("Creating virtual environment")
+ subprocess.run(f"{python_executable} -m venv .venv", shell=True) # nosec
- subprocess.run(f"{py_path} -m pip install --upgrade pip", shell=True) # nosec
+ log("Installing Python packages")
+ py_path = os.path.join(".venv", "bin", "python")
- # install packages
- subprocess.run(f"{py_path} -m pip install -r requirements.txt", shell=True) # nosec
+ if sys.platform.startswith("win"):
+ py_path = os.path.join(".venv", "Scripts", "python")
- log("Python packages installed successfully")
+ subprocess.run(f"{py_path} -m pip install --upgrade pip", shell=True) # nosec
- log("DONE!")
+ # Install packages from requirements.txt
+ subprocess.run(f"{py_path} -m pip install -r requirements.txt", shell=True) # nosec
- else:
- log("Supported python versions are 3.6-3.8")
+ log("Python packages installed successfully")
+ log("DONE!")
if __name__ == "__main__":
diff --git a/readme.md b/readme.md
index 7b24cc9..a786ced 100644
--- a/readme.md
+++ b/readme.md
@@ -4,9 +4,9 @@
-
+
-
+
git Empower your business, not the adversaries.
@@ -40,22 +40,22 @@ An review of the tool's basic modules is available here: - [CopilotM365](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-Connector-and-Automator) ## Quick Guide for Developers -Clone the repository and setup a virtual environment in your IDE. Install python packages by running: +1. Clone the repository and setup a virtual environment in your IDE. Install python packages by running: ``` -python init_repo.py + python init_repo.py ``` -To activate the virtual environment (.venv) run: +2. If not active already, run the folloeing to activate the virtual environment (.venv): ``` -.\.venv\Scripts\activate (Windows) + .\.venv\Scripts\activate (Windows) -./.venv/bin/activate (Linux) + source .venv/bin/activate (Linux & MacOS) ``` -Run: +3. Verify all dependencies are installed: ``` -pip install . + pip install . ``` **Notes**: @@ -68,5 +68,12 @@ pip install . 4. When pushing PR, you can run `black -C -l 150 {file to path}` to fix any formatting issues related to _black_. # Usage +## Quick Start 1. For quickly getting started with scanning your tenant, please check the [powerdump](https://github.com/mbrg/power-pwn/wiki/Modules:-PowerDump) module here. -2. Please check out the relevant [Wiki](https://github.com/mbrg/power-pwn/wiki) page for each module for further information. +2. For testing your M365 Copilot for retrieval of internal information (e.g., via a compromised user), please check the C365 modules: + * [whoami](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-M365-%E2%80%90-Whoami) + * [C365 dump](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-M365-%E2%80%90-Dump) +3. For testing misconfigured Copilot Studio bots available to unauthenticated users please check the Copilot Hunter _deep-scan_ module [here](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-Studio-Hunter-%E2%80%90-Deep-Scan). +4. To test misconfigured Power Pages which could allow for Dataverse tables to be leak, please check the [powerpages](https://github.com/mbrg/power-pwn/wiki/Modules:-Power-Pages) module. + +Please review the [Wiki](https://github.com/mbrg/power-pwn/wiki) for a full module list and detailed usage. diff --git a/src/powerpwn/powerpages/__init__.py b/src/powerpwn/powerpages/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/zenity_logo.png b/zenity_logo.png new file mode 100644 index 0000000000000000000000000000000000000000..bda2f2e21465cc8f3fb54271b78308862a081ea7 GIT binary patch literal 78243 zcmeFY>0gpv_daaXrHwXNnFD5CR$6LyH928vX=O<{=R{>zYK}M|0u7p7mC~SM4v-n) zkdmb$DqvbsVq%hFqT+-&BLX5I_~8A$e{Y|^;67i-2T#s@?zQ&b$3E7v*8caBtMkTn zI_uQb)Ha?wd)iG+O}$-BZPl2@U#kB+3=A$+TVWY`?(`{-#1&J0eHF&ES9?bv9sIe_ z-teHm;r>nco$XTxv}M0%b2`=k+R%J4TBmQ-wX3i9uX?yq+sVBn|4H5bo8WuJ5I<9W zU5D_#6};bLzJt|=hj~wY!rU`YpYw#-qdcmWhyU4QwDU@y_}k7`TUGD<-}OHa{Lcgb z^T7W+@IMdy&jbJS!2dk(KM(xR1OGoBNY0B{xqMqW0)+BA`=o;pn4d&}=29v!D>gw% zudCP1LwL4PYw~A6C5sb(OvtuW$=oM2ACaY|b~iFhP5(a+uWq|1wc({{(zBOjdXJEa z2&JpcF%$9(L#N)si=u5oOHE)Z
z6R~^1+`UlJxrIPWwsXzz+dR+iGO&qRyOUR^%XPBF8Z4~5C{Jr|s5tfkCCR3Vp4N=O
zCTBlp!WHjSw6TiPpX;&Nw3EofFKaRYw7cxEo#CJGe^rAxq#8t&e;LrgbI|#u-sAVo
zVjT-hfAitMcDuAG>8!`)eiZ!RX~b0Q;^Qy^DqQ#-$+A6Sk@eFh@XFjGV(nl;8OEYK
zmQoFY_Qo8XrEI#_41Lf4dTy2T2e4C?bn6#T^&fc8DfvM!9xsG5-VlSS-?nYmZ!nr7
zJ)&ps5sBa2z{yRHTJ*9=Zh?GkxNx<$`fYMAGCDxq=W2oacfConU6b1?m*eMs_lEYC
z?lw5k!Rk~ypKD4Vewv I8!n-O+M>-x*`lknisd#o_(xRl kdn&huVyd}ec)
zDhhr^JYjB*%y(>tNsTd5Zb`V?sXM3>&AEQ#RF^MtN%4$Ezo8EeTh03+-5I{E!&e*c
zJJyAJx(pUJ9Ibr1Y5U~S4b?^hg8o^ZIK2pqfb<_;+ZsigK8s}$dWHK2k39E*a-CN!
zm&J>+Kv#&NIh@#H?&|m}Drvc9-y+M6hkYhAU>kgYjjqHo=k0w2LkdBkv~N)G{jo{2
zfS{vhsKj`)z`OO_-AS%^ky-pr)86+Q6%g}EO7j{K%fL$?hRsxCTIG6N*Ua8U;Wg@{
zHEA|;YN1crQ*-dNyVz1u?#RD9)OarKkSA?-K8BYcyEe>g&7+_=)LUZRtPXKP#Kv*@szSxwbR>iS-xJP&
z62%S;M#nzqYADn>Co#PI{E|SGRI?Ry{rj0jkh1E+IMA2QD&H(CKTns>OpL&Qo(cFP
zrT@YP^oAyORPjyt0IT`VPM1w=QPA6GF9DL-h(F^dqfhLfX%
}gkkXZ#q(XB$oq;NiOy^{Y#E1pv{gw6?i}~Ud&qs#7Sn_)S4Y?A(?@-DEu-&g
z{8D#%?UJynyvOx!VRlaP(kBt@l*8<68L!mu+>cwrhvU|~cT#g3`y8bg3fKX2A_10x
z!^dqmfwgD#9AfHZ%V6z%wA~x=uf~XA&Wjw|a6kMXWIqhqA}@gVoed_(uL`1X?$5M{
z%cBEm)6qSo0{=t*z5md^(irL$`OuHo;%Si9eqq?b*A+2S)2kA2CCmA>bTy!#{d7sy
zb^1;&HV!e_TYh2B(?Rd|kVSQZHGbo6Vf#zY)SeO#sl3Xkb8b>!u`38ltf!BuCpNud
zuWn-oo}4=ck5ea}AO^8B8lsZzaai+^OMaZ2?`14M4v9y4z&c?+M9tVjsOuHq6{TMO
z`l2@M^PLBi%Suyc;7{c&+=i$$t{dm^*W6Y5VQ(AS#6({0zH3=oo)-0RP2IL<$NP12
zZH9uz?s^lmI|oHhh$Mh-<>(#+?8IblvQJI95OFpZEIgD<13jAA8bbX~1jzCHrTuL4
zq9M;w^0mvuJXY>cWy~k6KXOSb3N%m;DtbTj&9lA*S(Z00t9BDKexUha7BhEYSzXLE
zL~#&s3L%HSiI$z|=z(ZXsq?ufCwY(HmpZ|*5#XkIO8@{WrCu8NM*fqR>bE)aasJxC
zd#ws44EB`Cu$?a%!9(nq0
?|tR3GZ8Gh3rcxUrDj#uW*DsUZEkXDVa@#N
zCiac494bsHHA%6gB2ynN6s1}n7Iv_=u;~Goo%45BF{}DY!%Ooff+~@n52fitfveC1
zN^qo!d74^{#C|ZPr04ciIw31%|ItfWdCXjADtrdwtPtz+XC3lY9tYTc7@65Q@aQS-
z%9?@=8n`LEQ1LSmp~2G@!&y>hLd9LTgKaQr5lMk^SoDi$Z*Kn*Ej&RyPzSsuT{@Fv
z5FTG;mi+0f(EYYAmBN3@^^Sj=BA^pEM9CXVvU>bziQ()PUc>eT=zaY0+`PBmADxc%
z|4-`lzEpkvn1Xlet8-dA^rU@;hbmZ&aEG_AXMHJQ^16VVSdIOKm+X>!F-$D*n+=M`
zo~+mh1feHYeE)*6-8346@e-ecKga56AuW|EtfGaH`)BZHUxPPfSQ_6fDGZWr%=Hve
z96x&5UR^3}sBMX4HI^4?Fv`_S{5@Hp+*Nda^<>)n;`WRyZKkKf9>5UEgj0(pV;{jk
z3hOdGqj`de{0?hXS^T
z$SC=J_B
Xhh#{Gu~#@p32z&LjmA^+D`$^>9A<*&
zt9Clg5Upy;Z`Aw86T6s4G$ctz44nPE;_hU!YmbrLv->paWx(Z5lZMVN0tZ8Pd=ei6
zc!w0+>}7T|5&(12GMP!`HIax**`WEMlLaWX!hE|FoIkjPC-zJs&)$7lLqxHNR@;ge
zL%JeSI+U!j>whLN>!SwP^>vG+|DtLXRcLOSvI(kZU|o!C!V|9X{rAJ-k^o+5_6^W@
z`?*mY$Ha;l+
_
zwsIxd)w!-)>dv!yG%&p7`~XvS-Pv1xd_!5tT@{iGZaeo2fXM16UNQmlvBGKWR0)O_
zh`mOtv5Dqfu111SJ4LOXEK0bAXeC^W=if-Nc?$W0sjp!y;Ygu)QU0u_G&g>OC?og|TtlEJ%=LSsvM8;`ipm&7+`@g}X2hdLn+XB%!;bw6b(
zpFEIRR8gR=*$T}Q=oK$o(kS+oJZD|;p7s)