limit information collected by "azurehound list group-members" to onl…

…y collect member IDs
SpecterOps · Nov 16, 2023 · de04953 · de04953
1 parent faeb09f
commit de04953
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/client/groups.go b/client/groups.go
@@ -61,10 +61,10 @@ func (s *azureClient) GetAzureADGroupOwners(ctx context.Context, objectId string
 	}
 }
 
-func (s *azureClient) GetAzureADGroupMembers(ctx context.Context, objectId string, filter string, search string, count bool) (azure.MemberObjectList, error) {
+func (s *azureClient) GetAzureADGroupMembers(ctx context.Context, objectId string, filter string, search string, count bool, selectCols []string) (azure.MemberObjectList, error) {
 	var (
 		path     = fmt.Sprintf("/%s/groups/%s/members", constants.GraphApiBetaVersion, objectId)
-		params   = query.Params{Filter: filter, Search: search, Count: count}.AsMap()
+        params   = query.Params{Filter: filter, Search: search, Count: count, Select: selectCols}.AsMap()
 		response azure.MemberObjectList
 	)
 	if res, err := s.msgraph.Get(ctx, path, params, nil); err != nil {
@@ -246,7 +246,7 @@ func (s *azureClient) ListAzureADGroupMembers(ctx context.Context, objectId stri
 			nextLink string
 		)
 
-		if list, err := s.GetAzureADGroupMembers(ctx, objectId, filter, search, false); err != nil {
+		if list, err := s.GetAzureADGroupMembers(ctx, objectId, filter, search, false, selectCols); err != nil {
 			errResult.Error = err
 			if ok := pipeline.Send(ctx.Done(), out, errResult); !ok {
 				return

diff --git a/cmd/list-group-members.go b/cmd/list-group-members.go
@@ -92,7 +92,7 @@ func listGroupMembers(ctx context.Context, client client.AzureClient, groups <-c
 					}
 					count = 0
 				)
-				for item := range client.ListAzureADGroupMembers(ctx, id, "", "", "", nil) {
+				for item := range client.ListAzureADGroupMembers(ctx, id, "", "", "", []string{"id"}) {
 					if item.Error != nil {
 						log.Error(item.Error, "unable to continue processing members for this group", "groupId", id)
 					} else {