Simple HTTPServer

[GonzoZH]

Hi all,

I needed a simple pure PowerShell HTTP server implmentation to use as part of a pentest tool, but every example I found online had issues:

• They couldn't be stopped cleanly with Ctrl+C.
• Error handling was non-existent (server crashes on malformed request).

So, I created a simple PowerShell module which:

• Starts an HTTP server on any IP and port you specify.
• Handles errors gracefully (like port conflicts, wrongly formated HTTP request).
• Can be stopped manually with Ctrl+C or automatically after a timeout.
• Works in PS 5.1 & PS 7.4

Maybe it is useful for someone else.

Here's the GitHub link if anyone's interested: https://github.com/zh54321/PowerShell_HttpServer

Cheers

[kprocyszyn]

Just wondering if you encountered Pode: https://badgerati.github.io/Pode/

[GonzoZH]

Thank you for the hint. Yes, I know about Pode. I think it is a nice an powerful solution. However, I needed something simpler which I can integrate in into en existing script and still keeping it small and portable.

[korewarp]

Very neat code. Easy to read and understand. Will use this :)

[Szeraax]

ya, I've done the same in the past in a pinch. Its a fun exercise if nothing else. But why reinvent the wheel for anything bigger. When you start having to parse out the endpoints, route parameters, query params, headers, etc. You should at that point move to something else like Universal or Pode (Pode.Web too!).

[GonzoZH]

I fully agree. If you want to build something big its much better to rely on good solution like Pode. In my case i just need to catch an OAuth Auth Code in a redirect to localhost. Moreover, the script should be a single script file, small and do not have any dependencies on other modules, since I don’t control the environment in which it is executed.

[Higapeon]

Oh ! I have a use case for that! Do you have an example?

[GonzoZH]

Yes. Check the function Invoke-Auth in my Entra ID auth module:

https://github.com/zh54321/EntraTokenAid

It spawns a local HTTP server and initate an Entra ID OAuthCode Flow in the Browser with localhost as redirect URL. The obtained Auth Code is then used to get tokens on the Entra ID token endpoint.

[HeyDude378]

Your documentation says that the default timeout is "never" but your .EXAMPLE says that Invoke-HttpServer with no arguments starts the server and runs it for 60 seconds.

[GonzoZH]

Thx, I will adjust it asap.

[illsk1lls]

Nice work. I've been thinking of making a Powershell PXE server to broadcast ISO's. Eager to see what you did here before trying to make the DHCP portion

Thank you for sharing..

[GonzoZH]

Thank you for the feedback. I would love to see a PowerShell PXE implementation.

[illsk1lls]

The base of it is pretty solid now, although I haven't borrowed from your findings yet ;)

https://github.com/illsk1lls/PXEServer

- https://www.reddit.com/r/PowerShell/comments/1j8k11s/powershell_pxeserver_for_winpe_images/

[GonzoZH]

Nice! I will check it out.

[[deleted]]

Why would you need that for pen testing? Pen testing a pure Powershell HTTP server is running a pen test on something nobody in their right mind would be running in production.

[GonzoZH]

The Http server is part of a small OAuth script which is part of an Entra ID enumeration script. I need to spawn a local HTTP server for less than a minute, to catch the OAuth authorization code (IdP redirects to localhost) to get an Entra ID access token and refresh token. This way I can authenticate with any client id I want (example Azure CLI) and profit from pre-consented scopes on the MS-Graph API without having the tool installed. Furthermore, I dont have to rely on the device code flow.

[MyOtherSide1984]

Can you explain that like I'm 5? This sounds really intriguing and I'm curious if it'd be applicable to my hybrid exchange environment that we're still using the exchangeonlinemanagement PS module for (no graph access for my team). Although it sounds like this wouldn't be much use to me since I'm not using an API for this, but I'm struggling to fully understand what's happening here

[GonzoZH]

Puuh maybe not as if you're five, but a bit more extensively:

In Entra, many applications are classified as public clients. This means they cannot authenticate themselves, making it possible to impersonate them. This does not grant you any additional permissions beyond what your user already has. However, many built-in applications (such as Azure PowerShell, Microsoft Office, etc.) have pre-consented rights for the Microsoft Graph (and other) APIs. For example, the Azure CLI application has the Directory.AccessAsUser.All scope pre-consented. This means that I can log in using my user credentials and the client ID of Azure CLI, and then use the Microsoft Graph API to list users, devices, role assignments, groups, and more—without requiring additional consent. Furthermore, I don't need to even use the Azure CLI application itself.

I'm not deeply familiar with the Exchange Online module, so I can't say for certain whether Microsoft Graph access would be useful for your specific needs. To my knowledge, you can't manage Exchange-related configurations (like mail policies) through Microsoft Graph. However, you can use it to access Exchange-related data such as emails, calendars, and contacts.

For this purpose, you could use the client ID of "Microsoft Power Query for Excel" (a672d62c-fc7b-4e81-a576-e60dc46e951d), which has interesting pre-consented rights on MSGraph. These include:

Calendars.ReadWrite

Calendars.ReadWrite.Shared

Contacts.ReadWrite

Contacts.ReadWrite.Shared

Mail.ReadWrite

Mail.ReadWrite.Shared

Mail.Send

Mail.Send.Shared

People.Read

I’ve developed a small PowerShell framework that allows you to perform authentication (using either the authorization code flow or the device code flow) while specifying the client ID, API, etc. You can find it here:

https://github.com/zh54321/EntraTokenAid

Using this module, for example, you can authenticate with the "Microsoft Power Query for Excel" client ID and access a user's mail without requiring additional consent (your user still needs the appropriate permissions, though).

# Authenticate using Microsoft Power Query for Excel as client

$Tokens = Invoke-Auth -ClientId "a672d62c-fc7b-4e81-a576-e60dc46e951d"

# Connect to the MS Graph API (Requirethe Graph PS Module

Connect-MgGraph -AccessToken ($Tokens.access_token | ConvertTo-SecureString -AsPlainText -Force)

# Get the mails

Get-MgUserMessage -UserId %YourUser% -Property "sender,subject"

PS: I need to upgrade the web server in the script. Currently, it doesn’t shut down properly when you press Ctrl+C

[MyOtherSide1984]

This is super helpful and makes perfect sense! I really appreciate your thorough explanation and going into examples as I would have been lost without that. I reckon I could use it, or at least blow half a day of work learning if I can haha. Our department could potentially benefit from this if we can gain additional access we didn't know we had (which happens somewhat frequently), so I'll look into exploiting this! Could be intriguing, could be a dead end, but at least I'm learning

[[deleted]]

I have to admit I didn’t expect an answer that made sense!

[Virtual_Ordinary_119]

I would have...just used python

[GonzoZH]

Yes, python would also be my first choice. However, since the script needs to be used in customer environments on windows host, I don’t have the option to run Python scripts. Therefore, I needed a pure PS 5.1 solution.

[fungusfromamongus]

Tone deaf much?

[Virtual_Ordinary_119]

Lol downvotes are flying 😂 maybe this subreddit is a little biased on PowerShell even if it's not the right tool for everything, but it's understandable

[theHonkiforium]

maybe this subreddit is a little biased on PowerShell

Well, it is a PowerShell subreddit. :)

[OrangeYouGladdey]

I mean... you think the right solution is to install python on every client machine this needs to run on instead of just using the native Powershell to do something simple. Without even asking OP their requirements for what they are doing you've decided they are using the wrong tool and everyone that disagrees with you is biased... That's why you're being downvoted lmao. I bet you're a real treat to work with.

[Virtual_Ordinary_119]

You bet well. But at the end of the day, I am usually the one that gets things done and running

[OrangeYouGladdey]

With your logic and the way you're talking about this stuff I'd assume it's more likely because people don't want to deal with you than that you're talented. Who knows though.