Azure & MSGraph - OsbornePro

Sending Emails

Discover Emails

# The below finds email addresses associated with a domain
theharvester -d osbornepro.com -l 500 -b all

# Get MX records for a domain
dig +short mx osbornepro.com
nslookup -type=mx osbornepro.com

# Connect to SMTP Server over SSL
openssl s_client -crlf -connect smtp.osbornepro.com:465 # SMTPS uses SSL/TLS without starttls command
openssl s_client -starttls smtp -crlf -connect smtp.osbornepro.org:587 # STARTTLS

# Authenticate to SMTP Server
root@kali: telnet osbornepro.com 587 
220 osbornepro.com SMTP Server Banner 
>> HELO 
250 osbornepro.com Hello [x.x.x.x] 
>> AUTH NTLM 334 
NTLM supported 
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA= 
334 TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA

# Enum Emails using VRFY
$ telnet 127.0.0.1
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 localhost ESMTP Sendmail 8.9.3
HELO
501 HELO requires domain address
HELO x
250 localhost Hello [127.0.0.1], pleased to meet you
VRFY root
250 Super-User root@myhost
VRFY blah
550 blah... User unknown

# Metasploit SMTP Enumeration
Metasploit: auxiliary/scanner/smtp/smtp_enum
smtp-user-enum: smtp-user-enum -M vrfy -u root -t 127.0.0.1
Nmap: nmap --script smtp-enum-users 127.0.0.1

# EXPN Enum Method
$ telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
HELO
501 HELO requires domain address
HELO x
EXPN test
550 5.1.1 test... User unknown
EXPN root
250 2.1.5 tobor@localhost
EXPN sshd
250 2.1.5 sshd privsep sshd@localhost

# RCPT TO AUTOCOMPLETE METHOD
$ telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 osbornepro.com ESMTP Sendmail 8.9.3
HELO x
250 osbornepro.com Hello [127.0.0.1], pleased to meet you
MAIL FROM:tobor@osbornepro.com
250 2.1.0 tobor@osbornepro.com... Sender ok
RCPT TO:test
550 5.1.1 test... User unknown
RCPT TO:admin
550 5.1.1 admin... User unknown
RCPT TO:tobor
250 2.1.5 tobor... Recipient ok

Exchange Online Command Reference

Install-Module ExchangeOnlineManagement
Connect-ExchangeOnline

Import-Module MSOnline
Connect-MSOnline

# Remove permissions to a shared mailbox
Remove-MailboxPermission -Identity finance@osbornepro.com -User rosborne@osbornepro.com -AccessRights FullAccess

# To keep permissions on the above mailbox for the user without mapping it do this afterwards
Add-MailboxPermission -Identity finance@osbornepro.com -User rosborne@osbornepro.com -AccessRights FullAccess -AutoMapping $False

# Adding SendAs Permission to user $Identity for shared mailbox $Mailbox"
Add-RecipientPermission -Identity $Identity -Trustee $Mailbox -AccessRights 'SendAs'

# Adding full permissions for $Identity to shared mailbox $Mailbox"
Add-MailboxPermission -Identity $Identity -User $Mailbox -AccessRights 'FullAccess' -InheritanceType 'All'

# Change a user mailbox to a shared mailbox
Set-Mailbox -Identity user1@osbornepro.com -Type Shared

# Get a list of Shared Mailboxes and Member Permissions on them
Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize:Unlimited | Get-MailboxPermission | Select-Object -Property Identity,User,AccessRights | Where-Object -FilterScript { ($_.user -like '*@*') }

# Get forwarding rules applied to a specific email address
Get-Mailbox -Identity rosborne | Select-Object -Property UserPrincipalName,ForwardingSmtpAddress,DeliverToMailboxAndForward

# Get list of mailboxes forwarding to an external domain
Get-Mailbox -Filter {ForwardingAddress -ne $Null} | Select-Object -Property UserPrincipalName,ForwardingSmtpAddress,DeliverToMailboxAndForward

# Enable Send As permissions on a mailbox for a user
Add-RecipientPermission -Identity "Help Desk" -AccessRights SendAs -Trustee "Robert Osborne"

# Remove Send As permissions on a mailbox for a user
Remove-RecipientPermission -Identity "Help Desk" -AccessRights SendAs -Trustee "Robert Osborne"

# Grant rosborne Owner permissions to the Marketing folder in user1's mailbox
Add-MailboxFolderPermission -Identity user1@osbornepro.com:\Marketing -User rosborne@osbornepro.com -AccessRights Owner

# Add rosborne as a calendar delegate to User1's mailbox without access to private items
Add-MailboxFolderPermission -Identity user1@osbornepro.com:\Calendar -User rosborne@osbornepro.com -AccessRights Editor -SharingPermissionFlags Delegate

# Add rosborne as a calendar delegate to User1's mailbox with access to private items
Add-MailboxFolderPermission -Identity user1@osbornepro.com:\Calendar -User rosborne@osbornepro.com -AccessRights Editor -SharingPermissionFlags Delegate,CanViewPrivateItems

# Create a distribtion list in Office365 that anyone can join
New-DistributionGroup -Name "Company Employees" -Alias employees -MemberJoinRestriction open

# Change main email address of a distribution group tp co.employees@osbornepro.com from colorado@osbornepro.com
Set-DistributionGroup "Colorado Employees" -EmailAddresses SMTP:co.employees@osbornepro.com,smtp:colorado@osbornepro.com

# Get the members of a distribution group in Office365
Get-DistributionGroupMember -Identity co.employees@osbornepro.com

# Create a conference room list
New-DistributionGroup -Name "Building 32 Conference Rooms" -OrganizationalUnit "osbornepro.com/rooms" -RoomList

# Create a Conference Room Resource Mailbox
New-Mailbox -Name ConfRoom1 -DisplayName "Conference Room 1" -Room

# Add a conference room resource to your conference room list
Add-DistributionGroupMember -Identity "Building 32 Conference Rooms" -Member ConfRoom1@osbornepro.com

# Disable SMTP AUTH for an organization
Set-TransportConfig -SmtpClientAuthenticationDisabled $True

# Enable SMTP AUTH for a specific user
Set-CASMailbox -Identity rosborne@osbornepro.com -SmtpClientAuthenticationDisabled $False

# Disable SMTP AUTH for a specific user
Set-CASMailbox -Identity rosborne@osbornepro.com -SmtpClientAuthenticationDisabled $True

# Enable SMTP AUTH for an organization
Set-TransportConfig -SmtpClientAuthenticationDisabled $False

# Disable SMTP AUTH for a list of users
$DisableSmtpAuthForTheseUsers | ForEach-Object { Set-CASMailbox -Identity $_ -SmtpClientAuthenticationDisabled $True }

# View SMTP AUTH Settings for each mailbox in an organization
Get-TransportConfig | Format-List -Property SmtpClientAuthenticationDisabled

# Get Organization Info
Get-MSolCompanyInformation

# Get All Users
Get-MSolUser -All

# Get All Groups
Get-MSolGroup -All

# Get All Service Principals
Get-MsolServicePrincipal

Azure Commands

# Install Azure Module
Install-Module -Name Az -Force
Connect-AzAccount -Credential $LiveCred

# Get Tenant ID
$AzureContexts = Get-AzContext -ListAvailable
$AzureContexts.Tenant.id

# Get Azure VMs
Get-AzVM

# Get Azure AD Applications
Get-AzAdApplication

# Get Azure Virtual Network Info
Get-AzVirtualNetwork
Get-AzPublicIpAddress
Get-AzExpressRouteCircuit
Get-AzVpnConnection

# Get Azure SQL Servers
$AzureSQL = Get-AzSQLServer
$AzureSQL

# Get Azure SQL Databases
Get-AzSqlDatabase -ServerName $AzureSQL[0].ServerName -ResourceGroupName $AzureSQL[0].ResourceGroupName

# Get Azure SQL Firewall Rules
Get-AzSqlServerFirewallRule –ServerName $AzureSQL[0].ServerName -ResourceGroupName $AzureSQL[0].ResourceGroupName

# Get Azure SQL Admins
Get-AzSqlServerActiveDirectoryAdminstrator -ServerName $AzureSQL[0].ServerName -ResourceGroupName $AzureSQL[0].ResourceGroupName

# Get Azure Subscription Info
Get-AzSubscription

# Get Azure Resources
Get-AzResource

# Get Azure Resource Groups
Get-AzResourceGroup

# Get Azure Storage Accounts
$AzureResourceGroups = Get-AzResourceGroup
$AzureResourceGroups | ForEach-Object { Get-AzStorageAccount -ResourceGroupName $_.ResourceGroupName }

# Get Azure Web Apps
$AzureResourceGroups = Get-AzResourceGroup
$AzureResourceGroups | ForEach-Object { Get-AzWebApp -ResourceGroupName $_.ResourceGroupName }

# Sync Azure AD with On Premise AD
Start-ADSyncSyncCycle -PolicyType Initial
Start-ADSyncSyncCycle -PolicyType Delta

# Reset Kerberos Keys for Azure
# Importing AzureADSSO.psd1 from directory $AzureFile
$AzureFile = (Get-ChildItem -Path "C:\" -Filter "AzureADSSO.psd1" -Recurse -Force -ErrorAction SilentlyContinue).FullName
Import-Module "$AzureFile" -Force
New-AzureADSSOAuthenticationContext -CloudCredentials $LiveCred

# Checking for errors
Update-AzureADSSOForest -OnPremCredentials $cred1

Azure & MSGraph Commands

Sending Emails

Discover Emails

Exchange Online Command Reference

Azure Commands

Site Links

Contact Info

Azure & MSGraph Commands

Sending Emails

Discover Emails

Exchange Online Command Reference

Azure Commands

Site Links

Contact Info

Subscribe to OsbornePro TV