az tokens

winPEAS/winPEASexe/winPEAS/Checks/CloudInfo.cs

@@ -21,7 +21,7 @@ namespace winPEAS.Checks
             {
                new AWSInfo(),
                new AzureInfo(),
-               new AzureCliInfo(),
+               new AzureTokensInfo(),
                new GCPInfo(),
                new GCPJoinedInfo(),
                new GCDSInfo(),

winPEAS/winPEASexe/winPEAS/Info/CloudInfo/AzureTokensInfo.cs

@@ -19,21 +19,33 @@ using System.Text.Json.Nodes;
 
 namespace winPEAS.Info.CloudInfo
 {
-    internal class AzureCliInfo : CloudInfoBase
+    internal class AzureTokensInfo : CloudInfoBase
     {
-        public override string Name => "Azure Cli";
+        public override string Name => "Azure Tokens";
 
-        public override bool IsCloud => CheckIfAzureCliInstalled();
+        public override bool IsCloud => CheckIfAzureTokensInstalled();
 
         private Dictionary<string, List<EndpointData>> _endpointData = null;
 
-        public static bool CheckIfAzureCliInstalled()
+        public static bool CheckIfAzureTokensInstalled()
         {
             string homeDirectory = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
             string AzureFolderPath = Path.Combine(homeDirectory, ".Azure");
             string azureFolderPath = Path.Combine(homeDirectory, ".azure");
 
-            return Directory.Exists(AzureFolderPath) || Directory.Exists(azureFolderPath);
+            string identityCachePath = Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+                "Microsoft",
+                "IdentityCache"
+            );
+
+            string tokenBrokerPath = Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+                "Microsoft",
+                "TokenBroker"
+            );
+
+            return Directory.Exists(AzureFolderPath) || Directory.Exists(azureFolderPath) || Directory.Exists(identityCachePath) || Directory.Exists(tokenBrokerPath);
         }
 
         public static string TBRESDecryptedData(string filePath)
@@ -79,6 +91,9 @@ namespace winPEAS.Info.CloudInfo
                 azureHomePath = AzureFolderPath;
             };
 
+            if (Directory.Exists(azureHomePath))
+            {
+
                 // Files that doesn't need decryption
                 string[] fileNames = {
                 @"azureProfile.json",
@@ -107,6 +122,7 @@ namespace winPEAS.Info.CloudInfo
                         }
                     }
                 }
+            }
 
 
 
@@ -136,13 +152,6 @@ namespace winPEAS.Info.CloudInfo
             }
             
 
-            // Get the IdentityCache directory path and encrypted files with tokens
-            string tokenBrokerPath = Path.Combine(
-                Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
-                "Microsoft",
-                "TokenBroker"
-            );
-
             // Files that need decryption
             string[] fileNamesEncrp = {
                 @"service_principal_entries.bin",
@@ -189,6 +198,11 @@ namespace winPEAS.Info.CloudInfo
 
 
             //TBRES files
+            string tokenBrokerPath = Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+                "Microsoft",
+                "TokenBroker"
+            );
 
             string[] tbFiles = { };
 

winPEAS/winPEASexe/winPEAS/winPEAS.csproj

@@ -1226,7 +1226,7 @@
     <Compile Include="Info\CloudInfo\AWSInfo.cs" />
     <Compile Include="Info\CloudInfo\AzureInfo.cs" />
     <Compile Include="Info\CloudInfo\EndpointData.cs" />
-    <Compile Include="Info\CloudInfo\AzureCliInfo.cs" />
+    <Compile Include="Info\CloudInfo\AzureTokensInfo.cs" />
     <Compile Include="Info\CloudInfo\GPSInfo.cs" />
     <Compile Include="Info\CloudInfo\GCDSInfo.cs" />
     <Compile Include="Info\CloudInfo\GWorkspaceInfo.cs" />