nccgroup · x4v13r64 · Jun 26, 2019 · May 19, 2019 · May 19, 2019 · May 19, 2019
diff --git a/.gitignore b/.gitignore
@@ -44,7 +44,6 @@ nosetests.xml
 
 # In case people do a `git add .` ...
 *.csv
-tests/data/ruleset-test.json
 
 # Data folder and files
 scoutsuite-report*

diff --git a/README.md b/README.md
@@ -16,7 +16,7 @@ environments. Using the APIs exposed by cloud providers, Scout Suite gathers con
 and highlights risk areas. Rather than going through dozens of pages on the web consoles, Scout Suite presents a clear 
 view of the attack surface automatically.
 
-Scout Suite is stable and actively maintained, but a number of features and internals may change. As such, please bare
+Scout Suite is stable and actively maintained, but a number of features and internals may change. As such, please bear
 with us as we find time to work on, and improve, the tool. Feel free to report a bug with details (please provide
 console output using the `--debug` argument), request a new feature, or send a pull request.
 

diff --git a/ScoutSuite/__init__.py b/ScoutSuite/__init__.py
@@ -1,5 +1,5 @@
 __author__ = 'NCC Group'
-__version__ = '5.1.0'
+__version__ = '5.2.0'
 
 ERRORS_LIST = []
 

diff --git a/ScoutSuite/__main__.py b/ScoutSuite/__main__.py
@@ -24,40 +24,53 @@ def run_from_cli():
     # Get the dictionary to get None instead of a crash
     args = args.__dict__
 
-    return run(args.get('provider'),
-               args.get('profile'),
-               args.get('user_account'), args.get('service_account'),
-               args.get('cli'), args.get('msi'), args.get('service_principal'), args.get('file_auth'), args.get('tenant_id'),
-               args.get('subscription_id'),
-               args.get('client_id'), args.get('client_secret'),
-               args.get('username'), args.get('password'),
-               args.get('project_id'), args.get('folder_id'), args.get('organization_id'), args.get('all_projects'),
-               args.get('report_name'), args.get('report_dir'),
-               args.get('timestamp'),
-               args.get('services'), args.get('skipped_services'),
-               args.get('result_format'),
-               args.get('database_name'),
-               args.get('host_ip'),
-               args.get('host_port'),
-               args.get('max_workers'),
-               args.get('regions'),
-               args.get('fetch_local'), args.get('update'),
-               args.get('ip_ranges'), args.get('ip_ranges_name_key'),
-               args.get('ruleset'), args.get('exceptions'),
-               args.get('force_write'),
-               args.get('debug'),
-               args.get('quiet'),
-               args.get('log_file'),
-               args.get('no_browser'))
+    try:
+        return run(provider=args.get('provider'),
+                   # AWS
+                   profile=args.get('profile'),
+                   # Azure
+                   user_account=args.get('user_account'), service_account=args.get('service_account'),
+                   cli=args.get('cli'), msi=args.get('msi'), service_principal=args.get('service_principal'), file_auth=args.get('file_auth'),
+                   tenant_id=args.get('tenant_id'), subscription_id=args.get('subscription_id'),
+                   client_id=args.get('client_id'), client_secret=args.get('client_secret'),
+                   username=args.get('username'), password=args.get('password'),
+                   # GCP
+                   project_id=args.get('project_id'), folder_id=args.get('folder_id'), organization_id=args.get('organization_id'), all_projects=args.get('all_projects'),
+                   # General
+                   report_name=args.get('report_name'), report_dir=args.get('report_dir'),
+                   timestamp=args.get('timestamp'),
+                   services=args.get('services'), skipped_services=args.get('skipped_services'),
+                   result_format=args.get('result_format'),
+                   database_name=args.get('database_name'),
+                   host_ip=args.get('host_ip'),
+                   host_port=args.get('host_port'),
+                   max_workers=args.get('max_workers'),
+                   regions=args.get('regions'),
+                   fetch_local=args.get('fetch_local'), update=args.get('update'),
+                   ip_ranges=args.get('ip_ranges'), ip_ranges_name_key=args.get('ip_ranges_name_key'),
+                   ruleset=args.get('ruleset'), exceptions=args.get('exceptions'),
+                   force_write=args.get('force_write'),
+                   debug=args.get('debug'),
+                   quiet=args.get('quiet'),
+                   log_file=args.get('log_file'),
+                   no_browser=args.get('no_browser'),
+                   programmatic_execution=False)
+    except (KeyboardInterrupt, SystemExit):
+        print_info('Exiting')
 
 
 def run(provider,
+        # AWS
         profile=None,
+        # Azure
         user_account=False, service_account=None,
-        cli=False, msi=False, service_principal=False, file_auth=None, tenant_id=None, subscription_id=None,
+        cli=False, msi=False, service_principal=False, file_auth=None,
+        tenant_id=None, subscription_id=None,
         client_id=None, client_secret=None,
         username=None, password=None,
+        # GCP
         project_id=None, folder_id=None, organization_id=None, all_projects=False,
+        # General
         report_name=None, report_dir=None,
         timestamp=False,
         services=[], skipped_services=[],
@@ -72,7 +85,8 @@ def run(provider,
         debug=False,
         quiet=False,
         log_file=None,
-        no_browser=False):
+        no_browser=False,
+        programmatic_execution=True):
     """
     Run a scout job in an async event loop.
     """
@@ -85,12 +99,16 @@ def run(provider,
 
 
 async def _run(provider,
+               # AWS
                profile,
+               # Azure
                user_account, service_account,
                cli, msi, service_principal, file_auth, tenant_id, subscription_id,
                client_id, client_secret,
                username, password,
+               # GCP
                project_id, folder_id, organization_id, all_projects,
+               # General
                report_name, report_dir,
                timestamp,
                services, skipped_services,
@@ -105,6 +123,7 @@ async def _run(provider,
                quiet,
                log_file,
                no_browser,
+               programmatic_execution,
                **kwargs):
     """
     Run a scout job.
@@ -130,7 +149,8 @@ async def _run(provider,
                                                  client_id=client_id,
                                                  client_secret=client_secret,
                                                  username=username,
-                                                 password=password)
+                                                 password=password,
+                                                 programmatic_execution=programmatic_execution)
 
         if not credentials:
             return 401

diff --git a/ScoutSuite/core/cli_parser.py b/ScoutSuite/core/cli_parser.py
@@ -274,7 +274,16 @@ def parse_args(self, args=None):
         # Cannot simply use required for backward compatibility
         if not args.provider:
             self.parser.error('You need to input a provider')
+
         # If local analysis, overwrite results
         if args.__dict__.get('fetch_local'):
             args.force_write = True
+
+        # Test conditions
+        v = vars(args)
+        if v.get('tenant_id') and not v.get('service_principal'):
+            self.parser.error('--tenant can only be set when using --service-principal')
+        # TODO add more conditions
+
         return args
+
diff --git a/ScoutSuite/core/console.py b/ScoutSuite/core/console.py
@@ -1,11 +1,11 @@
+import logging
 import os
 import sys
 import traceback
 
+import coloredlogs
 from six.moves import input
 
-import coloredlogs, logging
-
 from ScoutSuite import ERRORS_LIST
 
 ########################################
@@ -15,20 +15,25 @@
 verbose_exceptions = False
 logger = logging.getLogger('scout')
 
+
 def set_logger_configuration(is_debug=False, quiet=False, output_file_path=None):
     """
     Configure whether full stacktraces should be dumped in the console output
     """
+
+    # set debug level
     global verbose_exceptions
     verbose_exceptions = is_debug
+
     # if "quiet" is set, don't output anything
-    if not quiet:
+    if quiet:
+        coloredlogs.install(level='ERROR', logger=logger)
+    else:
         coloredlogs.install(level='DEBUG' if is_debug else 'INFO', logger=logger)
 
     if output_file_path:
         # create file handler which logs messages
         fh = logging.FileHandler(output_file_path, 'w+')
-        fh.setLevel(logging.DEBUG if is_debug else logging.INFO)
         # create formatter and add it to the handlers
         formatter = logging.Formatter(fmt='%(asctime)s %(hostname)s %(name)s[%(process)d] %(levelname)s %(message)s',
                                       datefmt='%Y-%m-%d %H:%M:%S')
@@ -54,7 +59,6 @@ def print_error(msg):
 
 
 def print_exception(exception, additional_details=None):
-
     try:
         exc_type, exc_obj, exc_tb = sys.exc_info()
         file_name = os.path.split(exc_tb.tb_frame.f_code.co_filename)[1]
@@ -67,7 +71,6 @@ def print_exception(exception, additional_details=None):
         traceback_exc = None
         str = '{}'.format(exception)
 
-    global verbose_exceptions
     if verbose_exceptions:
         logger.exception(str)
     else:
@@ -81,7 +84,6 @@ def print_exception(exception, additional_details=None):
 
 
 def print_info(msg):
-
     print_generic(msg)
 
 

diff --git a/ScoutSuite/output/data/html/partials/dashboard.html b/ScoutSuite/output/data/html/partials/dashboard.html
@@ -35,7 +35,7 @@
                 <div class="collapse" id="item-{{key}}" aria-labelledby="item-{{key}}" data-parent="#list-{{key}}">
                     <div class="card-body row">
                         <div class="col-sm-9">
-                            <p>{{rationale}}</p>
+                            <p>{{{rationale}}}</p>
                         </div>
                         <div class="col-sm-3">
                             <ul>

diff --git a/...ite/output/data/html/partials/gcp/services.cloudresourcemanager.projects.id.bindings.html b/...ite/output/data/html/partials/gcp/services.cloudresourcemanager.projects.id.bindings.html
@@ -11,7 +11,7 @@ <h4 class="list-group-item-heading">Information</h4>
     <div class="list-group-item">
         <h4 class="list-group-item-heading">Bindings</h4>
         <h5 class="list-group-item-heading">Attached Users:</h5>
-        <div class="accordion-inner">
+        <div id="cloudresourcemanager.projects.{{@../key}}.bindings.{{@key}}.users" class="accordion-inner">
             <ul>
                 {{#each members.users}}
                 <li><samp>{{this}}</samp></li>
@@ -21,7 +21,7 @@ <h5 class="list-group-item-heading">Attached Users:</h5>
             </ul>
         </div>
         <h5 class="list-group-item-heading">Attached Groups:</h5>
-        <div class="accordion-inner">
+        <div id="cloudresourcemanager.projects.{{@../key}}.bindings.{{@key}}.groups" class="accordion-inner">
             <ul>
                 {{#each members.groups}}
                 <li><samp>{{this}}</samp></li>
@@ -31,7 +31,7 @@ <h5 class="list-group-item-heading">Attached Groups:</h5>
             </ul>
         </div>
         <h5 class="list-group-item-heading">Attached Service Accounts:</h5>
-        <div class="accordion-inner">
+        <div id="cloudresourcemanager.projects.{{@../key}}.bindings.{{@key}}.service_accounts" class="accordion-inner">
             <ul>
                 {{#each members.service_accounts}}
                 <li><samp>{{this}}</samp></li>

diff --git a/...Suite/output/data/html/partials/gcp/services.cloudresourcemanager.projects.id.groups.html b/...Suite/output/data/html/partials/gcp/services.cloudresourcemanager.projects.id.groups.html
@@ -0,0 +1,35 @@
+
+<!-- Cloud Resources Manager groups' partial -->
+<script id="services.cloudresourcemanager.projects.id.groups.partial" type="text/x-handlebars-template">
+    <div id="resource-name" class="list-group-item active">
+        <h4 class="list-group-item-heading">{{name}}</h4>
+    </div>
+    <div class="list-group-item">
+        <h4 class="list-group-item-heading">Information</h4>
+        <div class="list-group-item-text item-margin">Group: <span id="cloudresourcemanager.projects.{{@../key}}.groups.{{@key}}.name">{{name}}</span></div>
+    </div>
+    <div class="list-group-item">
+        <h4 class="list-group-item-heading">Bindings:</h4>
+        <div class="accordion-inner">
+            <ul>
+                {{#each roles}}
+                <li><samp>{{this}}</samp></li>
+                {{else}}
+                <li><samp>None</samp></li>
+                {{/each}}
+            </ul>
+        </div>
+    </div>
+</script>
+
+<script>
+    Handlebars.registerPartial("services.cloudresourcemanager.projects.id.groups", $("#services\\.cloudresourcemanager\\.projects\\.id\\.groups\\.partial").html());
+</script>
+
+<!-- Single cloudresourcemanager group template -->
+<script id="single_cloudresourcemanager_group-template" type="text/x-handlebars-template">
+    {{> modal-template template='services.cloudresourcemanager.projects.id.groups'}}
+</script>
+<script>
+    var single_cloudresourcemanager_group_template = Handlebars.compile($("#single_cloudresourcemanager_group-template").html());
+</script>
diff --git a/...tSuite/output/data/html/partials/gcp/services.cloudresourcemanager.projects.id.users.html b/...tSuite/output/data/html/partials/gcp/services.cloudresourcemanager.projects.id.users.html
@@ -0,0 +1,35 @@
+
+<!-- Cloud Resources Manager users' partial -->
+<script id="services.cloudresourcemanager.projects.id.users.partial" type="text/x-handlebars-template">
+    <div id="resource-name" class="list-group-item active">
+        <h4 class="list-group-item-heading">{{name}}</h4>
+    </div>
+    <div class="list-group-item">
+        <h4 class="list-group-item-heading">Information</h4>
+        <div class="list-group-item-text item-margin">User: <span id="cloudresourcemanager.projects.{{@../key}}.users.{{@key}}.name">{{name}}</span></div>
+    </div>
+    <div class="list-group-item">
+        <h4 class="list-group-item-heading">Bindings:</h4>
+        <div class="accordion-inner">
+            <ul>
+                {{#each roles}}
+                <li><samp>{{this}}</samp></li>
+                {{else}}
+                <li><samp>None</samp></li>
+                {{/each}}
+            </ul>
+        </div>
+    </div>
+</script>
+
+<script>
+    Handlebars.registerPartial("services.cloudresourcemanager.projects.id.users", $("#services\\.cloudresourcemanager\\.projects\\.id\\.users\\.partial").html());
+</script>
+
+<!-- Single cloudresourcemanager user template -->
+<script id="single_cloudresourcemanager_user-template" type="text/x-handlebars-template">
+    {{> modal-template template='services.cloudresourcemanager.projects.id.users'}}
+</script>
+<script>
+    var single_cloudresourcemanager_user_template = Handlebars.compile($("#single_cloudresourcemanager_user-template").html());
+</script>
diff --git a/ScoutSuite/output/data/html/partials/gcp/services.cloudsql.projects.id.instances.html b/ScoutSuite/output/data/html/partials/gcp/services.cloudsql.projects.id.instances.html
@@ -12,6 +12,8 @@ <h4 class="list-group-item-heading">Information</h4>
         <div class="list-group-item-text item-margin">Last Backup: <span id="cloudsql.projects.{{@../key}}.instances.{{@key}}.last_backup_timestamp">{{last_backup_timestamp}}</span></div>
         <div class="list-group-item-text item-margin">Logs: <span id="cloudsql.projects.{{@../key}}.instances.{{@key}}.log_enabled">{{convert_bool_to_enabled log_enabled}}</span></div>
         <div class="list-group-item-text item-margin">SSL Required: <span id="cloudsql.projects.{{@../key}}.instances.{{@key}}.ssl_required">{{convert_bool_to_enabled ssl_required}}</span></div>
+        <div class="list-group-item-text item-margin">Public IP Address: <span id="cloudsql.projects.{{@../key}}.instances.{{@key}}.public_ip">{{public_ip}}</span></div>
+        <div class="list-group-item-text item-margin">Private IP Address: <span id="cloudsql.projects.{{@../key}}.instances.{{@key}}.private_ip">{{private_ip}}</span></div>
         <div class="list-group-item-text item-margin">Authorized Networks:</div>
         <ul>
             {{#each authorized_networks }}

diff --git a/ScoutSuite/output/data/html/partials/gcp/services.iam.projects.id.service_accounts.html b/ScoutSuite/output/data/html/partials/gcp/services.iam.projects.id.service_accounts.html
@@ -18,9 +18,10 @@ <h4 class="list-group-item-heading"><span id="iam.projects.{{@../key}}.service_a
                 {{#each keys}}
                 <li>Key <samp>{{@key}}</samp></li>
                 <ul>
-                    <li id="iam.projects.{{@../key}}.service_accounts.{{@key}}.keys.{{@key}}.algorithm">Key Algorithm: {{key_algorithm}}</li>
-                    <li id="iam.projects.{{@../key}}.service_accounts.{{@key}}.keys.{{@key}}.valid_before">Valid Before: {{valid_before}}</li>
-                    <li id="iam.projects.{{@../key}}.service_accounts.{{@key}}.keys.{{@key}}.valid_after">Valid After: {{valid_after}}</li>
+                    <li id="iam.projects.{{@../../key}}.service_accounts.{{@../key}}.keys.{{@key}}.key_type">Key Type: <samp>{{key_type}}</samp></li>
+                    <li id="iam.projects.{{@../../key}}.service_accounts.{{@../key}}.keys.{{@key}}.algorithm">Key Algorithm: <samp>{{key_algorithm}}</samp></li>
+                    <li id="iam.projects.{{@../../key}}.service_accounts.{{@../key}}.keys.{{@key}}.valid_before">Valid Before: {{valid_before}}</li>
+                    <li id="iam.projects.{{@../../key}}.service_accounts.{{@../key}}.keys.{{@key}}.valid_after">Valid After: {{valid_after}}</li>
                 </ul>
                 {{else}}
                 <li><samp>None</samp></li>