Pwning O365 Infrastructure

Presented at null Dubai Meet 17 May 2019 Monthly Meet

Transcript

1. Pwning O365 Infrastructure Pralhad Chaskar (@c0d3xpl0it)
3. How can we tell if an organization uses O365? We can check with a single URL: https://login.microsoftonline.com/getuserr ealm.srf?login=username@acmecomputer company.com&xml=1
4. If the ‘NameSpaceType’ indicates ‘Managed,’ then O365 is in use
5. If the ‘NameSpaceType’ indicates ‘Federated,’ for Federated Active Directory
6. If the ‘NameSpaceType’ indicates ‘Unknown,’ if no record exists.
7. It’s Not a Bug, It’s a Feature! -- Microsoft
8. Findings User Names
9. Using LinkedIn site:linkedin.com intext:<company name>
10. Generate the Password List • Grabbed from Linkedin, Adobe, HIBP, etc leaks. • Classic Passwords (e.g. 123456, P@ssw0rd, etc) • Region specific password list (e.g. Dubai2020) • Etc..
11. Response Code from O365
12. Office365UserEnum python office365userenum.py -u user_list -o output.txt https://bitbucket.org/grimhacker/office365userenum
13. Phishing: 2FA bypass with OAuth Phishing Step 1: Attacker registers an app with AAD with permission to read user mailbox Step 2: Attacker crafts a mail with a link to authorize the app Note: the URL is entirely hosted at Microsoft making it trickier to know it is a phishing site Step 3: User tricked into consenting to app permission request NO USER CREDENTIALS REQUIRED. ATTACKER ACCESS PERSISTS AFTER CREDENTIAL RESET Gmail OAuth example: https://content.fireeye.com/m-trends/rpt-m-trends-2017 , Bypassing Multi-Factor Authentication for Corporate Email Theft
14. Phishing: 2FA Bypass with MITM Evilginx2 https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/ Cookie is intercepted by Evilginx Victim receive the 2FA code
15. Note • By default, O365 has a lockout policy of 10 tries, and it will lock out an account for one (1) minute. • However, if it is synced with on-premises, this means that the actual lockout could be much lower. • Additionally, Azure AD allows for custom lockout settings (https://docs.microsoft.com/en-us/azure/active- directory/authentication/howto-password-smart-lockout). • Keep this in mind while testing.
16. On Successful guessing one account https://github.com/nyxgeek/o365recon
19. Sometimes Active Directory username may not match the email address Use ‘Get-ADUsernameFromEWS’ module from MailSniper (https://github.com/dafthack/MailSniper).
20. What Next ? • Log into O365 Outlook on the web. • Check for draft emails containing passwords, check for notes that are saved. • Check their OneDrive and SharePoint Online. • Etc….
21. For Defenders • To enable multi-factor authentication (MFA) for all O365 accounts • Add MFA to everything • If there’s something you can’t set up with MFA, burn it down, or make it only accessible via VPN (which you also have configured with MFA)
22. Recon Compromise Persistence Expansion Actions on Intent AAD • Dump users and groups with Azure AD • Password Spray: MailSniper • Password Spray: CredKing O365 • Get Global Address List: MailSniper • Find Open Mailboxes: MailSniper • User account enumeration with ActiveSync • Harvest email addresses • Verify target is on O365, [DNS], [urls], [list] • Bruteforce of Autodiscover: SensePost Ruler • Phishing for credentials • Phishing using OAuth app • 2FA MITM Phishing: evilginx2 [github] • Add Mail forwarding rule • Add Global Admin Account • Delegate Tenant Admin • MailSniper: Search Mailbox for credentials • Search for Content with eDiscovery • Account Takeover: Add- MailboxPermission • Pivot to On-Prem host: SensePost Ruler • Exchange Tasks for C2: MWR • Send Internal Email • MailSniper: Search Mailbox for content • Search for Content with eDiscovery • Exfil email using EWS APIs with PowerShell • Download documents and email • Financial/wire fraud End Point • Search host for Azure credentials: SharpCloud • Persistence through Outlook Home Page: SensePost Ruler • Persistence through custom Outlook Form • Create Hidden Mailbox Rule [tool] On-Prem Exchange • Portal Recon • Enumerate domain accounts using Skype4B • Enumerate domain accounts: OWA & Exchange • Enumerate domain accounts: OWA: FindPeople • OWA version discovery • Password Spray using Invoke- PasswordSprayOWA, EWS, Atomizer • Bruteforce of Autodiscover: SensePost Ruler • PasswordSpray Lync/S4B [LyncSniper] • Exchange MTA • Search Mailboxes with eDiscovery searches (EXO, Teams, SPO, OD4B, Skype4B) • Delegation Prepared by @JohnLaTwC, May 2019, v1.04
23. Reference • https://twitter.com/JohnLaTwC/status/1126482411900915714 • https://twitter.com/TrustedSec/status/1128315820529082369