diff --git a/init_repo.py b/init_repo.py index 7744f8d..97dddac 100644 --- a/init_repo.py +++ b/init_repo.py @@ -8,37 +8,49 @@ def log(message: str) -> None: def check_python_version() -> bool: + """ + Check if the current Python version is between 3.6 and 3.8 inclusive. + """ version_info = sys.version_info if version_info.major != 3: return False if version_info.minor < 6 or version_info.minor > 8: return False - return True +def find_python() -> str: + """ + Get the path of the currently running Python executable. + """ + return sys.executable + + def main() -> None: - if check_python_version(): - log("Creating virtual environment") - subprocess.run("python -m venv .venv") # nosec + if not check_python_version(): + log("Error: Supported Python versions are between 3.6 and 3.8.") + log(f"Detected Python version: {sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}") + sys.exit(1) - log("Installing python packages") - py_path = os.path.join(".venv", "Scripts", "python") + python_executable = find_python() + log(f"Using Python executable: {python_executable}") - if not sys.platform.startswith("win"): - py_path = os.path.join(".venv", "bin", "python") + log("Creating virtual environment") + subprocess.run(f"{python_executable} -m venv .venv", shell=True) # nosec - subprocess.run(f"{py_path} -m pip install --upgrade pip", shell=True) # nosec + log("Installing Python packages") + py_path = os.path.join(".venv", "bin", "python") - # install packages - subprocess.run(f"{py_path} -m pip install -r requirements.txt", shell=True) # nosec + if sys.platform.startswith("win"): + py_path = os.path.join(".venv", "Scripts", "python") - log("Python packages installed successfully") + subprocess.run(f"{py_path} -m pip install --upgrade pip", shell=True) # nosec - log("DONE!") + # Install packages from requirements.txt + subprocess.run(f"{py_path} -m pip install -r requirements.txt", shell=True) # nosec - else: - log("Supported python versions are 3.6-3.8") + log("Python packages installed successfully") + log("DONE!") if __name__ == "__main__": diff --git a/readme.md b/readme.md index 7b24cc9..00165c4 100644 --- a/readme.md +++ b/readme.md @@ -4,7 +4,7 @@

- +

Empower your business, not the adversaries. @@ -40,22 +40,22 @@ An review of the tool's basic modules is available here: - [CopilotM365](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-Connector-and-Automator) ## Quick Guide for Developers -Clone the repository and setup a virtual environment in your IDE. Install python packages by running: +1. Clone the repository and setup a virtual environment in your IDE. Install python packages by running: ``` -python init_repo.py + python init_repo.py ``` -To activate the virtual environment (.venv) run: +2. If not active already, run the folloeing to activate the virtual environment (.venv): ``` -.\.venv\Scripts\activate (Windows) + .\.venv\Scripts\activate (Windows) -./.venv/bin/activate (Linux) + source .venv/bin/activate (Linux & MacOS) ``` -Run: +3. Verify all dependencies are installed: ``` -pip install . + pip install . ``` **Notes**: @@ -68,5 +68,12 @@ pip install . 4. When pushing PR, you can run `black -C -l 150 {file to path}` to fix any formatting issues related to _black_. # Usage +## Quick Start 1. For quickly getting started with scanning your tenant, please check the [powerdump](https://github.com/mbrg/power-pwn/wiki/Modules:-PowerDump) module here. -2. Please check out the relevant [Wiki](https://github.com/mbrg/power-pwn/wiki) page for each module for further information. +2. For testing your M365 Copilot for retrieval of internal information (e.g., via a compromised user), please check the C365 modules: + * [whoami](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-M365-%E2%80%90-Whoami) + * [C365 dump](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-M365-%E2%80%90-Dump) +3. For testing misconfigured Copilot Studio bots available to unauthenticated users please check the Copilot Hunter _deep-scan_ module [here](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-Studio-Hunter-%E2%80%90-Deep-Scan). +4. To test misconfigured Power Pages which could allow for Dataverse tables to be leak, please check the [powerpages](https://github.com/mbrg/power-pwn/wiki/Modules:-Power-Pages) module. + +Please review the [Wiki](https://github.com/mbrg/power-pwn/wiki) for a full module list and detailed usage. diff --git a/src/powerpwn/powerpages/__init__.py b/src/powerpwn/powerpages/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/zenity_logo.png b/zenity_logo.png new file mode 100644 index 0000000..bda2f2e Binary files /dev/null and b/zenity_logo.png differ diff --git a/zenity_logo.svg b/zenity_logo.svg deleted file mode 100644 index 63dc4aa..0000000 --- a/zenity_logo.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file