MSAppProxy_utils.ps1
|
# This file contains utility functions related to Microsoft App Proxy # Get's bootstrap configuration # Apr 2nd 2020 function Get-BootstrapConfiguration { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [String]$MachineName, [Parameter(Mandatory=$False)] [String]$ServiceHost="bootstrap.msappproxy.net", [Parameter(Mandatory=$True)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate ) Process { # Get the tenant id and instance id from the certificate $TenantId = $Certificate.Subject.Split("=")[1] $InstanceID = [guid]$Certificate.GetSerialNumberString() # Actually, it is not the serial number but this oid for Private Enterprise Number. Microsoft = 1.3.6.1.4.1.311 foreach($extension in $cert.Extensions) { if($extension.Oid.Value -eq "1.3.6.1.4.1.311.82.1") { $InstanceID = [guid]$extension.RawData } } $OSLanguage="1033" $OSLocale="0409" $OSSku="8" $OSVersion="10.0.17763" $AgentSdkVersion="1.5.1318.0" $AgentVersion="1.1.96.0" $body=@" <BootstrapRequest xmlns="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.SignalerDataModel" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"> <AgentSdkVersion>$AgentSdkVersion</AgentSdkVersion> <AgentVersion>$AgentVersion</AgentVersion> <BootstrapDataModelVersion>$AgentSdkVersion</BootstrapDataModelVersion> <ConnectorId>$InstanceId</ConnectorId> <ConnectorVersion>$AgentSdkVersion</ConnectorVersion> <ConsecutiveFailures>0</ConsecutiveFailures> <CurrentProxyPortResponseMode>Primary</CurrentProxyPortResponseMode> <FailedRequestMetrics xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.BootstrapDataModel"/> <InitialBootstrap>true</InitialBootstrap> <IsProxyPortResponseFallbackDisabledFromRegistry>true</IsProxyPortResponseFallbackDisabledFromRegistry> <LatestDotNetVersionInstalled>461814</LatestDotNetVersionInstalled> <MachineName>$machineName</MachineName> <OperatingSystemLanguage>$OSLanguage</OperatingSystemLanguage> <OperatingSystemLocale>$OSLocale</OperatingSystemLocale> <OperatingSystemSKU>$OSSku</OperatingSystemSKU> <OperatingSystemVersion>$OSVersion</OperatingSystemVersion> <PerformanceMetrics xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.BootstrapDataModel"/> <ProxyDataModelVersion>$AgentSdkVersion</ProxyDataModelVersion> <RequestId>$((New-Guid).ToString())</RequestId> <SubscriptionId>$TenantId</SubscriptionId> <SuccessRequestMetrics xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.BootstrapDataModel"/> <TriggerErrors/> <UpdaterStatus>Running</UpdaterStatus> <UseServiceBusTcpConnectivityMode>false</UseServiceBusTcpConnectivityMode> <UseSpnegoAuthentication>false</UseSpnegoAuthentication> </BootstrapRequest> "@ $url="https://$TenantId.$ServiceHost/ConnectorBootstrap" try { $response = Invoke-WebRequest -UseBasicParsing -Uri $url -Method Post -Certificate $Certificate -Body $body -ContentType "application/xml; charset=utf-8" } catch { Write-Error "Could not get bootstrap: $($_.Exception.Message). Probably expired certificate ($($Certificate.Thumbprint)) or invalid agent ($InstanceID)?" return $null } [xml]$xmlResponse = $response.Content return $xmlResponse.OuterXml } } # Creates a CSR from the scratch # Apr 2nd 2020 function NewCSRforSync { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [String]$MachineName, [Parameter(Mandatory=$True)] [byte[]]$PublicKey ) process { $osVersion="6.2.9200.2" $ADadminUser ="NotYourBusiness!!" $exeName = "AADConnectProvisioningAgentWizard.exe" $pksha1=[System.Security.Cryptography.SHA1CryptoServiceProvider]::new().ComputeHash($PublicKey) # Construct the CSR for signin $CSRToBeSigned=@( Add-DERSequence -Data @( Add-DERInteger -Data 0 0x30, 0x00 Add-DERSequence -Data @( Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # Object Identifier # rsaEncryption (1.2.840.113549.1.1.1) 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01 ) 0x05, 0x00 # Null ) Add-DERTag -Tag 0x03 -Data @( # BitString 0x00 $PublicKey ) ) Add-DERTag -Tag 0xA0 -Data @( # Context specific (block #0) # Attributes: osVersion Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # Object Identifier # osVersion (1.3.6.1.4.1.311.13.2.3) 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x0D, 0x02, 0x03 ) Add-DERSet -Data @( # SET Add-DERIA5String -Text $osVersion ) ) # Extension Request Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # Object Identifier # extensionRequest (1.2.840.113549.1.9.14) 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x0E ) Add-DERSet -Data @( Add-DERSequence -Data @( # Key Usage Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # Object Identifier 0x55, 0x1D, 0x0F # keyUsage (2.5.29.15) ) Add-DERTag 0x01 -Data @(0xFF) # Boolean (true) Add-DERTag 0x04 -Data @(0x03, 0x02, 0x04, 0xF0) # Octet string )# # Ext Key Usage Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # Object Identifier 0x55, 0x1D, 0x25 # extKeyUsage (2.5.29.37) ) Add-DERTag 0x04 -Data @( Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # Object Identifier 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02 # clientAuth (1.3.6.1.5.5.7.3.2) ) ) ) ) # Subject Key Identifier Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # subjectKeyIdentifier (2.5.29.14) 0x55, 0x1D, 0x0E ) Add-DERTag 0x04 -Data @( # Octet string 0x04, 0x14#, 0xEB, 0x4F, 0xD9, 0xFF, 0x3A, 0x20, 0xA9, 0xDB, 0x63, 0xBA, 0x50, 0x2A, 0xF1, 0x5B, 0x96, 0x5F, 0x5C, 0x3C, 0xCD, 0xF4 $pksha1 ) ) ) ) ) # Request Client Info Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # Object Identifier # requestClientInfo (1.3.6.1.4.1.311.21.20) 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x15, 0x14 ) Add-DERSet -Data @( # Set Add-DERSequence -Data @( Add-DERInteger -Data 0x05 Add-DERUtf8String -Tag 0x0C -Text $machineName Add-DERUtf8String -Tag 0x0C -Text $ADadminUser Add-DERUtf8String -Tag 0x0C -Text $exeName ) ) ) # Enrolment CSP Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( # Object Identifier # enrolmentCSP (1.3.6.1.4.1.311.13.2.2) 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x0D, 0x02, 0x02 ) Add-DERSet -Data @( Add-DERSequence -Data @( Add-DERInteger 0x01 Add-DERUnicodeString -Tag 0x1E "Microsoft Enhanced RSA and AES Cryptographic Provider" -LE Add-DERTag -Tag 0x03 -Data 0x00 # Bit string ) ) ) ) ) ) # Sign the CSR $signature = $rsa.SignData($CSRToBeSigned, [System.Security.Cryptography.HashAlgorithmName]::SHA256,[System.Security.Cryptography.RSASignaturePadding]::Pkcs1) # Construct the CSR $CSR = Add-DERSequence -Data @( $CSRToBeSigned Add-DERSequence -Data @( Add-DERTag -Tag 0x06 -Data @( 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B ) 0x05, 0x00 # null ) Add-DERTag -Tag 0x03 -Data @( 0x00 $signature ) ) # return return $CSR } } # Connects to the given bus function Connect-ToBus { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [PSObject]$BootStrap, [Parameter(Mandatory=$False)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$cert ) Process { # Import AMQP.ps1 . "$PSScriptRoot\AMQP.ps1" # Define AMQP messages [byte[]]$AMQP0 = @( 0x41, 0x4D, 0X51, 0X50, # AMQP 0x00, # Protocol 0x01, # Major 0x00, # Minor 0x00) # Revision [byte[]]$AMQP1 = @( 0x41, 0x4D, 0X51, 0X50, # AMQP 0x01, # Protcol = AMQP 0x01, # Major 0x00, # Minor 0x00) # Revision [byte[]]$AMQP2 = @( 0x41, 0x4D, 0X51, 0X50, # AMQP 0x02, # Protcol = TCP 0x01, # Major 0x00, # Minor 0x00) # Revision [byte[]]$AMQP3 = @( 0x41, 0x4D, 0X51, 0X50, # AMQP 0x03, # Protocol = SASL 0x01, # Major 0x00, # Minor 0x00) # Revision [byte[]]$EmptyAMQPHeader = @(0x00, 0x00, 0x00, 0x08, 0x02, 0x00, 0x00, 0x00) Try { # Define some needed variables $NameSpace = $bootStrap.NameSpace $url = "$nameSpace.servicebus.windows.net/`$servicebus/websocket" $connectionId = (New-Guid).ToString() $relayLinkGuid = (New-Guid).ToString() $trackingId = (New-Guid).ToString() if($status) { $Status.status = "Connecting to $url" } else { Write-Verbose "Connecting to $url" } #$connector.Status = "Connecting to $url" # Create the socket $socket = New-Object System.Net.WebSockets.ClientWebSocket # Add wsrelayedamqp as sub protocol $socket.Options.AddSubProtocol("wsrelayedamqp") $socket.Options.ClientCertificates.Add($cert) | out-null # Create the token and open the connection $token = New-Object System.Threading.CancellationToken $connection = $socket.ConnectAsync("wss://$url", $token) While (!$connection.IsCompleted) { Start-Sleep -Milliseconds 5 } if($connection.IsFaulted -eq "True") { Write-Error $connection.Exception return } # # Start the Agent # # Send SASL version header SendToSocket -Socket $socket -Token $token -Bytes ($AMQP3) # DEBUG $relayOpened=$false # Start the loop while($socket.state -eq "Open") { $outMessage = $null $response = ReadFromSocket -Socket $socket -Token $token -KeepAlive $inMessage = Parse-BusMessage $response $close = $false switch($inMessage.Type) { "Protocol SASL" {} # Do nothing "SASL Mechanisms" { # SASL init $outMessage = New-SASLInit -Mechanics EXTERNAL } "SASL Outcome" { # Change protocol to AMQP $outMessage = $AMQP0 } "Protocol AMQP" { # AMQP Open $outMessage = New-AMQPOpen -ContainerId "RelayConnection_$connectionId" -HostName "$nameSpace-relay.servicebus.windows.net" } "AQMP Open" { # AMQP Begin $outMessage = New-AMQPBegin } "AQMP Begin" { # AMQP Attach handle 0 and 1 SendToSocket -Socket $socket -Token $token -Bytes (New-AMQPAttach -Handle 0 -RelayLinkGuid $relayLinkGuid -Direction out -BootStrap $bootStrap -TrackingID $trackingId) SendToSocket -Socket $socket -Token $token -Bytes (New-AMQPAttach -Handle 1 -RelayLinkGuid $relayLinkGuid -Direction in -BootStrap $bootStrap -TrackingID $trackingId) $outMessage = New-AMQPFlow } "AQMP Attach" { # Nothing to do } "AQMP Flow" { # Send an empty AMQP Header $outMessage = $EmptyAMQPHeader if($status) { $Status.status += "`nWaiting for auth requests.." } else { Write-Verbose "Waiting for auth requests.." } } "AQMP Detach" { # Send AMQP Detach $outMessage = New-AMQPDetach -Handle ($inMessage.Handle) Write-Verbose ($inMessage.Error) } "AQMP End" { # Send AMQP End $outMessage = New-AMQPEnd } "AQMP Close" { # Send AMQP Close $outMessage = New-AMQPClose # Close the socket after sending the last message $close = $True # Set the status if($status) { $Status.status += "`nClosed." } else { Write-Verbose "Closed." } } "OnewaySend" { # Send the disposition message SendToSocket -Socket $socket -Token $token -Bytes (New-AMQPDisposition) # Time to create the relay! if($status) { $Status.status += "`nOpening relay to $($inMessage.RelayAddress)" } else { Write-Verbose "Opening relay to $($inMessage.RelayAddress)" } if(!$relayOpened) { $relayOpened = $true Connect-ToAuthRelay -Hostname $inMessage.RelayAddress -Id $inMessage.RelayId -Certificate $cert } } } if($outMessage -ne $null) { SendToSocket -Socket $socket -Token $token -Bytes $outMessage } if($close) { $socket.Abort() } } } catch { $Exception = $error[0] Write-Host $Exception -ForegroundColor Red } Finally{ If ($socket) { Write-Verbose "Closing websocket" $socket.Dispose() } } } } # Creates a SAS token function Get-SASToken { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [String]$Url, [Parameter(Mandatory=$True)] [String]$Key, [Parameter(Mandatory=$True)] [String]$KeyName, [Parameter(Mandatory=$False)] [DateTime]$Expires=(Get-Date).AddDays(1) ) Process { # Create the HMAC object $keyBytes=[Text.Encoding]::UTF8.GetBytes($Key) $hmac = [System.Security.Cryptography.HMACSHA256]::new($keyBytes) # Convert to UNIX time $exp=([System.DateTimeOffset]$Expires.ToUniversalTime()).ToUnixTimeSeconds() # Form the string to sign (urlencoded uri + \n + expires) $namespace = $url.split("/")[2] $urlToSign = [System.Web.HttpUtility]::UrlEncode($url) + "`n" + [string]$exp $byteUrl=[Text.Encoding]::UTF8.GetBytes($urlToSign) # Calculate the signature $byteHash = $hmac.ComputeHash($byteUrl) $signature = [System.Convert]::ToBase64String($byteHash) # Form the token $SASToken = "SharedAccessSignature sr=" + [System.Web.HttpUtility]::UrlEncode($Url) + "&sig=" + [System.Web.HttpUtility]::UrlEncode($signature) + "&se=" + $exp + "&skn=" + $KeyName return $SASToken } } function Connect-ToAuthRelay { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [String]$Hostname, [Parameter(Mandatory=$True)] [String]$Id, [Parameter(Mandatory=$True)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate ) Process { Try { $url = "$Hostname/`$servicebus/websocket" # Create the socket $socket = New-Object System.Net.WebSockets.ClientWebSocket # Add wsrelayedamqp as sub protocol $socket.Options.AddSubProtocol("wsrelayedconnection") $socket.Options.ClientCertificates.Add($Certificate) | out-null # Create the token and open the connection $token = New-Object System.Threading.CancellationToken $connection = $socket.ConnectAsync("wss://$url", $token) While (!$connection.IsCompleted) { Start-Sleep -Milliseconds 5 } if($connection.IsFaulted -eq "True") { Write-Error $connection.Exception return } # Send the two initial messages SendToSocket -Socket $socket -Token $token -Bytes (New-RelayConnect) SendToSocket -Socket $socket -Token $token -Bytes (New-RelayAccept -id $id) # Start the conversation loop if($status) { #$Status.status += "`nSocket: $($socket.state)" } # Define variables $SomeId = $null $SequenceId = $null $ConnectionId = New-Guid $RelayUrl = $null $ProxyUrl = $null $ProxyId = $null $SomeId2 = $null $ConId = $null while($socket.state -eq "Open") { Remove-Variable outMessage $outMessage = $null $response = ReadFromSocket -Socket $socket -Token $token -TimeOut if($response -eq $null) { return } $inMessage = Parse-RelayMessage $response if($status) { # $Status.status += "`n$hostname InMessage: $($inMessage.Type) $($inMessage.Size). Response: $($response.length)" } $close = $false switch($inMessage.Type) { "Relay AcceptReply" {} # Do nothing "Relay ConnectReply" {} # Do nothing "Relay Name" { # Reply SendToSocket -Socket $socket -Token $token -Byte (New-RelayNameReply) } "Relay Ids" { if($status) { $Status.status += "`nExtracting variables" } # Extract variables $SomeId = $inMessage.SomeId $SequenceId = $inMessage.SequenceId $RelayUrl = $inMessage.Relay if($status) { $Status.status += "`nSending outmessage. SomeId: $someId ConnectionId $ConnectionId SequenceId: $SequenceId Relay $RelayUrl" } # Reply $outMessage = New-RelayIdsReply -SomeId $SomeId -ConnectionId $ConnectionId -Relay $RelayUrl } "Relay ProxyConnect" { # Extract variables $ProxyUrl = $inMessage.ProxyUrl $ProxyId = $inMessage.ProxyId $SomeId2 = $inMessage.SomeId2 $ConId = $inMessage.ConId $ConnectionId = $inMessage.ConnectionId if($status) { $Status.status += "`nProxy. SomeId2: $someId2 SequenceId: $SequenceId ConnectionId: $ConnectionId " } # Reply $outMessage = New-RelayProxyConnectReply -SequenceId $SequenceId -SomeId2 $SomeId2 -ConnectionId $ConnectionId # Send NetRemote SendToSocket -Socket $socket -Token $token -Bytes New-RelayNetRemote } "Relay NetRemoteReply" { # Try to connect to the proxy! # Get the ids.. $SubscriptionId=([System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate).GetNameInfo([System.Security.Cryptography.X509Certificates.X509NameType]::SimpleName,$false) $ConnectorId=([guid]([System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate).Extensions["1.3.6.1.4.1.311.82.1"].RawData).ToString() $url="https://$proxyUrl/subscriber/websocketconnect?requestId=$((New-Guid).ToString())" # Create the socket $socket2 = New-Object System.Net.WebSockets.ClientWebSocket $socket2.options.SetRequestHeader("x-cwap-dnscachelookup-result" , "NotUsed") $socket2.options.SetRequestHeader("x-cwap-connector-usesdefaultproxy" , "InUse") $socket2.options.SetRequestHeader("x-cwap-connector-version" , "1.5.1542.0") $socket2.options.SetRequestHeader("x-cwap-datamodel-version" , "1.5.1542.0") $socket2.options.SetRequestHeader("x-cwap-connector-sp-connections" , "0") $socket2.options.SetRequestHeader("x-cwap-transid" , $id) $socket2.options.ClientCertificates.Add($cert) # Create the token and open the connection $token2 = New-Object System.Threading.CancellationToken $connection2 = $socket2.ConnectAsync("wss://$($url.Substring(8))", $token2) While (!$connection2.IsCompleted) { Start-Sleep -Milliseconds 5 } if($connection2.IsFaulted -eq "True") { Write-Error $connection2.Exception return } Write-Host "Connected to $Url" -ForegroundColor Yellow # Send the message $message = [text.encoding]::UTF8.GetBytes( "{`"ConnectionId`":`"$connectionId`",`"MessageType`":0}" ) SendToSocket -Socket $socket2 -Token $token -Bytes ($message) # Loop while($true) { # Get the authentication message $response = ReadFromSocket -Socket $socket2 -Token $token2 -ArraySize 2048 # Debug -Step ($step++) -NameSpace $Hostname -Bytes $response -Direction in $authRequest = [text.encoding]::UTF8.GetString($response) Write-Verbose $authRequest $credentials = Decode-PTACredential -AuthRequest $authRequest -Certificate $cert $credentials Write-Verbose "Trying to send authentication response" $username="danj@highlandwhiskey.myo365.site" $userClaim="[{`"ClaimType`":`"http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/authentication`",`"Resource`":true,`"Right`":`"http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/right\/identity`"},{`"ClaimType`":`"http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/name`",`"Resource`":`"$username`",`"Right`":`"http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/right\/identity`"}]" $backEndResponse = [convert]::ToBase64String([text.encoding]::UTF8.GetBytes($userClaim)) $headers = [ordered]@{ "x-cwap-dnscachelookup-result"="NotUsed" "x-cwap-connector-usesdefaultproxy"="InUse" "x-cwap-connector-version"="1.5.1542.0" "x-cwap-datamodel-version"="1.5.1542.0" "x-cwap-connector-sp-connections"="1" "x-cwap-transid" = $id "x-cwap-sessionid"="00000000-0000-0000-0000-000000000000" "x-cwap-certificate-authentication"="notProcessed" "x-cwap-headers-size"="0" "x-cwap-connector-be-latency-ms"="27" "x-cwap-payload-total-attempts"="0" "x-cwap-connector-loadfactor"="0" "x-cwap-response-total-attempts"="1" "x-cwap-connector-all-latency-ms"="70" "x-cwap-backend-response" = $backEndResponse "User-Agent"="" } $url="https://$proxyUrl/subscriber/connection?requestId=$((New-Guid).ToString())" # The cert must be "linked" to this web page by IE + it needs to be installed in the personal store. try { Invoke-RestMethod -Uri $url -Method Post -Certificate $cert -Headers $headers -ContentType "" -ErrorAction SilentlyContinue #$response = Invoke-WebRequest -UseBasicParsing -Uri $url -Method Post -Certificate $cert -Headers $headers -ContentType "" -ErrorAction SilentlyContinue } catch { Write-Error $_.Exception.Message } } } } if($outMessage -ne $null) { if($status) { #$Status.status += "`nSendToSocket. $($outMessage.length). $($outMessage.GetType())" } SendToSocket -Socket $socket -Token $token -Bytes ([byte[]]$outMessage) } if($close) { $socket.Abort() } } } catch { $Exception = $error[0] Write-Host $_ Write-Host $Exception -ForegroundColor Red if($status) { $Status.status += "`n$($exception.toString())" } } Finally{ If ($socket) { Write-Verbose "Closing websocket $Namespace" $socket.Dispose() } } } } |