Fixed token parsing on linux

mlcsec · mlcsec · commit 39cd59e1314e · 2024-07-22T16:02:27.000+01:00
diff --git a/.github/usage.png b/.github/usage.png
diff --git a/README.md b/README.md
@@ -64,42 +64,9 @@ pip3 install -r requirements.txt
 
 ## Usage
 
-```
-usage: graphpython.py [-h] [--command COMMAND] [--list-commands] [--token TOKEN] [--estsauthcookie ESTSAUTHCOOKIE] [--use-cae] [--cert CERT] [--domain DOMAIN] [--tenant TENANT] [--username USERNAME] [--secret SECRET] [--id ID] [--select SELECT] [--query QUERY]
-                      [--search SEARCH] [--entity {driveItem,message,chatMessage,site,event}] [--device {mac,windows,androidmobile,iphone}] [--browser {android,IE,chrome,firefox,edge,safari}] [--only-return-cookies]
-                      [--mail-folder {allitems,inbox,archive,drafts,sentitems,deleteditems,recoverableitemsdeletions}] [--top TOP] [--script SCRIPT] [--email EMAIL]
-
-options:
-  -h, --help            show this help message and exit
-  --command COMMAND     Command to execute
-  --list-commands       List available commands
-  --token TOKEN         Microsoft Graph access token or refresh token for FOCI abuse
-  --estsauthcookie ESTSAUTHCOOKIE
-                        'ESTSAuth' or 'ESTSAuthPersistent' cookie value
-  --use-cae             Flag to use Continuous Access Evaluation (CAE) - add 'cp1' as client claim to get an access token valid for 24 hours
-  --cert CERT           X509Certificate path (.pfx)
-  --domain DOMAIN       Target domain
-  --tenant TENANT       Target tenant ID
-  --username USERNAME   Username or file containing username (invoke-userenumerationasoutsider)
-  --secret SECRET       Enterprise application secretText (invoke-appsecrettoaccesstoken)
-  --id ID               ID of target object
-  --select SELECT       Fields to select from output
-  --query QUERY         Raw API query (GET only)
-  --search SEARCH       Search string
-  --entity {driveItem,message,chatMessage,site,event}
-                        Search entity type: driveItem(OneDrive), message(Mail), chatMessage(Teams), site(SharePoint), event(Calenders)
-  --device {mac,windows,androidmobile,iphone}
-                        Device type for User-Agent forging
-  --browser {android,IE,chrome,firefox,edge,safari}
-                        Browser type for User-Agent forging
-  --only-return-cookies
-                        Only return cookies from the request (open-owamailboxinbrowser)
-  --mail-folder {allitems,inbox,archive,drafts,sentitems,deleteditems,recoverableitemsdeletions}
-                        Mail folder to dump (dump-owamailbox)
-  --top TOP             Number (int) of messages to retrieve (dump-owamailbox)
-  --script SCRIPT       File containing the script content (deploy-maliciousscript and backdoor-script)
-  --email EMAIL         File containing OWA email message body content (spoof-owaemailmessage)
-```
+<p align="center">
+  <img src="./.github/usage.png" />
+</p>
 
 ## Commands
 
@@ -656,5 +623,4 @@ Graph permission IDs applied to objects can be easily located with detailed expl
   - [x] `Update-DeviceConfig` - patch settings that aren't read only from existing managed device config, more info [here](https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-update?view=graph-rest-beta)
   - [x] `New-SignedJWT` - need to test this from sharpgraphview
 - Options:
-  - [ ] add functionality for chaining commands e.g. --command get-user, get-currentuser, get-groups
-  - [ ] --proxy 
+  - [ ] --proxy option
diff --git a/graphpython.py b/graphpython.py
@@ -314,8 +314,16 @@ def get_user_agent(args):
 
 def get_access_token(token_input):
     if os.path.isfile(token_input):
-        with open(token_input, 'r', encoding='utf-16') as file:
-            access_token = file.read().strip()
+        encodings = ['utf-8', 'utf-16', 'ascii', 'iso-8859-1']
+        for encoding in encodings:
+            try:
+                with open(token_input, 'r', encoding=encoding) as file:
+                    access_token = file.read().strip()
+                return access_token
+            except UnicodeDecodeError:
+                continue
+        
+        raise ValueError(f"Unable to decode the file {token_input} with any of the tried encodings.")
     else:
         access_token = token_input
     return access_token
@@ -7067,9 +7075,9 @@ def print_profile_settings(response_json, profile_type):
         print("=" * 80)
 
 
-    #############
-    # Resolvers #
-    #############
+    ############
+    # Locators #
+    ############
     
     # locate-objectid
     elif args.command and args.command.lower() == "locate-objectid":
