watahani

import ecdsa
from ecdsa import SECP256k1
from ecdsa.keys import SigningKey, VerifyingKey
from math import log2
import hmac
import hashlib
import secrets

CURVE_ORDER = SECP256k1.order

watahani

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="windowsPE">
        <component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
            <SetupUILanguage> 
                <UILanguage>ja-JP</UILanguage> 
            </SetupUILanguage> 
            <UILanguage>ja-JP</UILanguage> 
        </component>
    </settings>

watahani

We couldn’t find that file to show.

watahani

# use this script only for debug purpose.

param(
	[Parameter(Position=0,Mandatory=$true)]
	[string]
	$NewCertThumbprint,

    [Parameter(Position=1,Mandatory=$true)]
	[string]
	$CertFriendlyName,

watahani

import * as express from "express";
import * as request from "request";
import * as crypto from "crypto"
import config from "./config"

const app = express();
const port = 3000;
const baseUri = "https://api.authlete.com/api/auth/"

const serviceId = config.serviceId

watahani

# Get all OAuth scopes

try {
$allAuth2PermissionsGrants = Get-AzureADOAuth2PermissionGrant -All $true

$allServicePrincipals = Get-AzureADServicePrincipal -All $true

$allUsers = Get-AzureADUser -All $true

$servicePrincipalScope  = New-Object System.Collections.ArrayList

watahani

$mcMaxExport = 50000
$mcMaxImport = 50000
$mcStartTime = '2019/01/01 00:00'

$mcFiles = Get-ChildItem -Path $mcEvtPath | Where-Object { $_.name -clike '*.evtx' } 

$SignInLogs = @()
$SignInEvents = @{ }
foreach ($mcFile in $mcFiles) {
    $mc412s = Get-WinEvent -FilterHashtable @{Path = $mcfile.FullName; LogName = "AD FS Auditing"; Level = 0; StartTime = $mcStartTime; id = "412" } -MaxEvents $mcMaxExport -ErrorAction SilentlyContinue | Sort-Object -Property TimeCreated

watahani

AAD Event Log

CTAP コマンドの送信は 210x 番台、生データが入ってんのは 110x 番台っぽい。

210x 番台のログで GetAssertion か MakeCredential を探して、そのあとの 110x 番台のログ見れば、中身が見える。

Make Credential

Request (make credential)

watahani

param(
    [Parameter(Mandatory = $false)]
    [string]
    $zoneName,
    
    [Parameter(Mandatory = $false)]
    [string]
    $resourceGroupName,

    [Parameter(Mandatory = $false)]

watahani

-----BEGIN CERTIFICATE-----
MIIDsjCCApqgAwIBAgIQcLzFKr72oLNJOdc+nGG3ITANBgkqhkiG9w0BAQsFADBn
MSswKQYDVQQLDCJDcmVhdGVkIGJ5IGh0dHA6Ly93d3cuZmlkZGxlcjIuY29tMRUw
EwYDVQQKDAxET19OT1RfVFJVU1QxITAfBgNVBAMMGERPX05PVF9UUlVTVF9GaWRk
bGVyUm9vdDAeFw0xODA3MzAwNDAxMzFaFw0yMTEwMjgwNDAxMzFaMGcxKzApBgNV
BAsMIkNyZWF0ZWQgYnkgaHR0cDovL3d3dy5maWRkbGVyMi5jb20xFTATBgNVBAoM
DERPX05PVF9UUlVTVDEhMB8GA1UEAwwYRE9fTk9UX1RSVVNUX0ZpZGRsZXJSb290
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2vsXCjwlWdjFYxffxJk
IdX9GJ12YBdXZyRayf7oRCFUGGEjmMrrb4t5MBwSDUkLxz/kvVO+jhN50mSKEUBG
1um4PYtzsLIThFCfrvRKRjUkgxpptPH8GukSxm60oi5VazWmzXsxnawKvL7QDZEP