oscartbeaumont / windows_mdm

A Windows MDM Proof of Concept Written In Go Lang

Windows MDM Demo

This project is a super simple and minimal implementation of the device enrollment and management protocols for using Windows 10 MDM. This project is designed to act as a starting place for your own projects with the protocols. DO NOT use this code as a reference for a production server as it designed to be a minimal starting place. I highly recommend using Mattrax if you are managing production devices as mistakes in the implementation could cause security incidents or major outages. The server uses 'Federated' (default and required for AzureAD) or 'OnPremise' authentication and doesn't currently support 'Certificate' authentication. This project uses the protocols:

• MD-MDE
• MS-MDM
• Some of MS-WSTEP & Some of MS-XCEP

Licence

This code is MIT licensed so use it in your projects as long as you credit to me. Please also give me credit if this project helped you in understanding the protocol to build your server. If this helps reach out I would love to hear how you are using it.

Usage

Once you have Go Lang and Git installed use the following unix commands.

git clone https://github.com/oscartbeaumont/windows_mdm.git
cd windows_mdm/
GOROOT=$(go env GOROOT) # Sets your GOROOT env varible required by the patch script
go run patch/patch.go # This changes the Go Lang standard library to support extra characters in certificates to remove the "asn1: syntax error: PrintableString contains invalid character" error.
# Put your webserver's HTTPS certificate in './certs/certificate.pem' & the private key in './certs/privatekey.pem'
# This HTTPS certificate must be valid and contain both the primary domain and the enterpriseenrollment subdomain/s (These should match the email of your users)
# Eg. Containing the domains 'mdm.otbeaumont.me' & 'enterpriseenrollment.otbeaumont.me' results in '*@otbeaumont.me' being able to enroll. Adding an extra 'enterpriseenrollment.student.otbeaumont.me' would then allow '*@otbeaumont.me' & '*@student.otbeaumont.me' to be able to enroll.
go run ./ --domain=mdm.example.com [email protected] --auth-policy=Federated # Replace the domains to match your environment
# Server is now running and listening on port 443 (unless an error is throw)

Enrolling a Device

There are 3 main methods of enrolling a device into management:

1. Deeplink (A special url that initiates enrollment)
2. Through the Settings menu (Enter an email and the server is discovered)
3. AzureAD (upon joining a device the MDM is also enrolled)

I reccomend manually enrolling the device for development because the Deeplink, at least on my device, stops working if you use it lots of time on the same device without restarting your broswer and AzureAD adds unnneded development complexity (obviously if your developing AzureAD features you will need to use it).

Deeplink

The end user goes to the url (in this case your primary domain with the path '/deeplink') and the MDM enrollment begins. This link could be included in an email or company portal website to make enrollment really easy for the end user. This initiates the same process as manually beginning enrollment through the settings menu.

Manually

On a Windows 10 machine go to "Settings" > "Accounts" > "Access work or school" > "Connect" > Enter your email and the enrollment process will begin.

AzureAD

Start by adding a custom MDM server to AzureAD. This can be done by clicking "Mobility (MDM and MAM)" in the sidebar, then "On-premises MDM application" and set the name as you wish and click "Add". Next you need to tell it where your MDM server is by going into its setttings page from "Mobility (MDM and MAM)" in the sidebar, then set the ToS url to 'https://example.com/EnrollmentServer/ToS' and the discovery URL to 'https://example.com/EnrollmentServer/Discovery.svc'. You will also need to set a scope for which AzureAD users the MDM will be installed for. Obviously replace example.com with your servers primary domain (as set by the command line flag). Finally you have to configure its application by clicking "On-premises MDM application settings" at the bottom of the MDM servers settings page then setting the below settings.

• "Expose an API" > "Application ID URI" > "Edit" > Set it to your servers primary domain
• "API Permissions" > "Grant admin concent for {Directory Name}" > Login with a admin user user IN THE directory > "Accept"
• "Authentication" > Add a new one of type "Web" and the redirect URI as the servers primary domain (This may not be required, I havn't checked)

Help

If you have questions about this project or the protocol in general, feel free to contact me here but please try and work it out yourself before contacting me. This is a working project (which is way more than what I had when I started) and this protocol requires heaps of trial and error to get anywhere so get used to it.

You can also hire me for consulting or developing MDM solutions (in any reasonably standard programming language), just reach out.

windows_mdm's Issues

Error Parsing The Certificate Request: asn1: syntax error: PrintableString contains invalid character

Hello
During debugging, I found that BinarySecurityToken sent from the device reported an error when doing x509. ParseCertificateRequest。

The request from the device is as follows:
<s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:ac="http://schemas.xmlsoap.org/ws/2006/12/authorization" xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
<s:Header>
<a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep</a:Action>
<a:MessageID>urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749</a:MessageID>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
<a:To s:mustUnderstand="1">https://windows-mdm.bytedance.net/EnrollmentServer/Enrollment.svc</a:To>
<wsse:Security s:mustUnderstand="1">
<wsse:UsernameToken u:Id="uuid-cc1ccc1f-2fba-4bcf-b063-ffc0cac77917-4">
wsse:Usernamebytedance.net\taomin.666</wsse:Username>
<wsse:Password wsse:Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">Tm123456</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</s:Header>
<s:Body>
wst:RequestSecurityToken
wst:TokenTypehttp://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken</wst:TokenType>
wst:RequestTypehttp://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType>
<wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#base64binary" ValueType="http://schemas.microsoft.com/windows/pki/2009/01/enrollment#PKCS10">MIICzjCCAboCAQAwSzFJMEcGA1UEAxNAM0YxOEM1QzEtMjYxOS00QjdDLUJDQUQtMjM4NjFEITFBNkFBMDhDRTRFMzY3NDg4NTAyNUVFMzcxN0Q0RjQwADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMkMTOs5KyilP4mH0whd/fExvgi38jqvk8/Ua9XKH2675wY6h/rXC0B2KE/r8GWSczW2CnILw3vjpBA5f4/c97iNHg3FpsDzwscMuhMH/lNKPgr+ht88zvWN6Cw630JTgQRP+1zsXPw2fTR3WTjK/hj5HzC3uZ9soXuHCVSXx+rerxbyBgnrGINcm5eQFVyGvX9Pyr8Y2Kj4Ys2CH/GPn8DYPA0waAS1uXXPxTuOh0mZxQQiKjJAlZ7ZhtsVzDZcCefZ4CL1amLZeSPsOqx+YN/BT0iIzKdM5d47UJ77zuDxQF3bcCLWi11PERQOXd4030SoOgfUp3xSXm644cxCKvUCAwEAAaBCMEAGCSqGSIb3DQEJDjEzMDEwLwYKKwYBBAGCN0IBAAQhMUE2QUEwOENFNEUzNjc0ODg1MDI1RUUzNzE3RDRGNDAAMAkGBSsOAwIdBQADggEBAJLS6oORBHc+Y5ig3shNjhv1iW8kx+48ms4XgkVJCwGmYyisZ1YGcFcM4Rs7Kjk7lSoD3vpMQd53eyp46DWZpwo79QppVoxns2LI2dBn5ZU5fHUGKMRXQ01eW/b4d0HU9w1DGgLDZUGM0T46Q/smDMNlghuKioWt9t0WpfooTglhlCJBtB5Maq4nNr9h1yqx/mWA7+o6rRFjRM5vo/QlLOWfP9h3fyvB+iEv7J0eUjHUZJxrZCgSEGJO9pZjwNQ5Fq02LUVanxuWDRz8OzsvowqF3JcNxogWE6fPDheIG7vi5uPBixM0tCCdTaoJpEBtZrB1jaoJ7/kmxKH4tZG9cCw=</wsse:BinarySecurityToken>
<ac:AdditionalContext xmlns="http://schemas.xmlsoap.org/ws/2006/12/authorization">
<ac:ContextItem Name="UXInitiated">
ac:Valuetrue</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="HWDevID">
ac:Value7127DF0EFB0AF03AACE7B4EE1D72AFF9170C1AD3FBCC50109F1AEEFC06543296</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="Locale">
ac:Valuezh-CN</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="TargetedUserLoggedIn">
ac:Valuetrue</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="OSEdition">
ac:Value48</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="DeviceName">
ac:ValuePF2E532A-LEK</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="MAC">
ac:ValueCC-D9-AC-82-68-CE</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="MAC">
ac:ValueE4-AB-20-52-41-53</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="MAC">
ac:ValueCC-D9-AC-82-68-D2</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="MAC">
ac:ValueEE-E6-20-52-41-53</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="MAC">
ac:Value00-2B-67-F6-C3-0B</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="MAC">
ac:ValueE8-F7-20-52-41-53</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="MAC">
ac:Value00-FF-DD-DD-A7-18</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="DeviceID">
ac:Value1A6AA08CE4E3674885025EE3717D4F40</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="EnrollmentType">
ac:ValueFull</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="DeviceType">
ac:ValueCIMClient_Windows</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="OSVersion">
ac:Value10.0.19043.1526</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="ApplicationVersion">
ac:Value10.0.19043.1526</ac:Value>
</ac:ContextItem>
<ac:ContextItem Name="NotInOobe">
ac:Valuefalse</ac:Value>
</ac:ContextItem>
</ac:AdditionalContext>
</wst:RequestSecurityToken>
</s:Body>
</s:Envelope>

go test code:

func TestPEMDecode(t *testing.T) {
formatted := MIICzjCCAboCAQAwSzFJMEcGA1UEAxNAM0YxOEM1QzEtMjYxOS00QjdDLUJDQUQtMjM4NjFEITFBNkFBMDhDRTRFMzY3NDg4NTAyNUVFMzcxN0Q0RjQwADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMkMTOs5KyilP4mH0whd/fExvgi38jqvk8/Ua9XKH2675wY6h/rXC0B2KE/r8GWSczW2CnILw3vjpBA5f4/c97iNHg3FpsDzwscMuhMH/lNKPgr+ht88zvWN6Cw630JTgQRP+1zsXPw2fTR3WTjK/hj5HzC3uZ9soXuHCVSXx+rerxbyBgnrGINcm5eQFVyGvX9Pyr8Y2Kj4Ys2CH/GPn8DYPA0waAS1uXXPxTuOh0mZxQQiKjJAlZ7ZhtsVzDZcCefZ4CL1amLZeSPsOqx+YN/BT0iIzKdM5d47UJ77zuDxQF3bcCLWi11PERQOXd4030SoOgfUp3xSXm644cxCKvUCAwEAAaBCMEAGCSqGSIb3DQEJDjEzMDEwLwYKKwYBBAGCN0IBAAQhMUE2QUEwOENFNEUzNjc0ODg1MDI1RUUzNzE3RDRGNDAAMAkGBSsOAwIdBQADggEBAJLS6oORBHc+Y5ig3shNjhv1iW8kx+48ms4XgkVJCwGmYyisZ1YGcFcM4Rs7Kjk7lSoD3vpMQd53eyp46DWZpwo79QppVoxns2LI2dBn5ZU5fHUGKMRXQ01eW/b4d0HU9w1DGgLDZUGM0T46Q/smDMNlghuKioWt9t0WpfooTglhlCJBtB5Maq4nNr9h1yqx/mWA7+o6rRFjRM5vo/QlLOWfP9h3fyvB+iEv7J0eUjHUZJxrZCgSEGJO9pZjwNQ5Fq02LUVanxuWDRz8OzsvowqF3JcNxogWE6fPDheIG7vi5uPBixM0tCCdTaoJpEBtZrB1jaoJ7/kmxKH4tZG9cCw=
csrRaw, err := base64.StdEncoding.DecodeString(formatted)
if err != nil {
fmt.Println(err)
return
}
req, err := x509.ParseCertificateRequest(csrRaw)
if err != nil {
fmt.Println(err)
return
}
if err = req.CheckSignature(); err != nil {
fmt.Println(err)
return
}
}