Full transcript
0:00Consentfix.
0:02Analyzing a browser native ClickFix
0:04style attack that hijacks OOTH consent
0:08grants. Listen, I feel like I had to
0:11make this video. I wanted to cover this
0:13cuz this is so cool. I got to be honest,
0:15I was nerd sniped when I first read this
0:18and I wanted to play with it and I
0:19wanted to show it to you. So, there's a
0:21lot of cool stuff I want to dive into in
0:23this video. So, I think the way that
0:24we'll structure it is first I want to
0:26walk through the article so you get that
0:28background context. Second, I'll show
0:30off a little cool little oh teeny weeny
0:33video demonstration. And then third, I'm
0:35just kind of going to talk going to
0:38pontificate, speculate, think, and
0:41discuss a little bit more of the
0:42conversations to have with this sort of
0:44cool new thing. So, this writeup was
0:46just previously released on December
0:4811th, and they say, "Look, it's a
0:50fishing campaign using a new kind of
0:52attack technique that we're calling
0:54consent fix. Combining OOTH consent
0:56fishing with a clickfix style lure that
0:59leads to a whole account takeover in
1:02identity, like your Entra ID or
1:05Microsoft 365 environment." So, normally
1:07when you think of clickfix, the original
1:10OG kind of traditional attack vector,
1:12that's a social engineering ploy that
1:14ultimately usually ends up an initial
1:16access on the endpoint. Like a victim, a
1:20user poor end victim target ends up
1:22running malware on their computer and
1:24they're infected by that technique of,
1:26oh, a verify your human or click to
1:29prove I'm not a robot button. But this
1:32trick bridges the gap between that usual
1:35classic traditional local device on the
1:38endpoint attack to identity the cloud
1:41your online environment. They're saying
1:44that they saw some victims access a
1:46malicious or compromised website they
1:48actually got funneled to via Google
1:50search and the attacker injects a fake
1:52Cloudflare turnstyle like the Google
1:54recapture like the oh verify you're
1:57human I'm not a robot button. But they
1:59have something interesting here. They
2:01require you to type in your email
2:03address. And I guess these iterations
2:05have some fancy bells and whistles that
2:07would check, oh, if it's a valid email,
2:10if it's under a specific domain or maybe
2:12group of victims that they're trying to
2:14target in a given target list, then it
2:16would end up oh, fluctuating, not
2:18letting it progress if it wasn't who
2:20they were actually going for. That's
2:21kind of neat. That's kind of cool.
2:23Making sure it's like a work email
2:24account. But once you entered your email
2:28address, then the gimmick was that it
2:30would open up a Microsoft like entra ID
2:34login page or what looks like one where
2:36you could click to sign in if your
2:38cookies and session is still there and
2:40then it redirects you to a localhost
2:44page that you would want to copy or
2:46they're instructing the victim copy and
2:49paste that URL so it goes back to the
2:52hacker so that they have that as their
2:55new breadcrumb and puzzle piece. What
2:57that means is that they're handing the
3:00bad actor a specific authentication
3:03token for an OOTH app. And that special
3:07code then allows the attacker to connect
3:10this app to the victim's Microsoft 365
3:14tenant and get the cookies, credentials,
3:17session tokens, realistically refresh
3:20token, and access token that could then
3:22be used as cookies to get into their
3:25entire Microsoft online environment.
3:27We're talking your email inbox and
3:29Outlook. We're talking Microsoft Teams
3:31to chat with your co-workers. We're
3:33talking One Drive, Sharepoint, all the
3:35things. All of that from a little cutesy
3:38little ClickFix technique. Hey, I'm
3:41going to keep us cruising to do some
3:42demos coming up next. But real quick
3:44before we do, please let me take just a
3:46quick moment to tell you about the
3:47sponsor of today's video, Hexrays.
3:50Reverse engineering is hard.
3:52State-of-the-art binary code analysis
3:54tools like IDA make it a little less
3:56painful and a lot more powerful. IDA
3:59enables you to disassemble, decompile,
4:02and debug any application you're up
4:04against. It helps you dig into how
4:06software works under the hood, whether
4:08it's malware, firmware, proprietary
4:11software, or anything. And the Hexrays
4:13decompiler is available on 11 different
4:16platforms between x86, x64, ARM, Power
4:21PC, MIPS, and more. These analysis tools
4:24help you cut up code, unpack and
4:26deopuscate threats, investigate
4:28exploits, cheats and game hacks, binary
4:31bugs and vulnerabilities. And IDA
4:33version 9 takes things even further with
4:36faster saves with smaller IDB databases,
4:39expanded processor support for
4:41Tririccore, RiskV, and RH850, and
4:44smarter decompilers across ARM 64, Power
4:48PC, Rust, Swift, and Golang. You'll get
4:51clearer C++ exception handling, STL
4:54structure recognition, Flirt signature
4:56improvements, and even a dedicated
4:58microode viewer to peak into the
5:00decompiler's internals. With a brand new
5:03plug-in manager, HCLI, the open-source
5:06Python API, headless processing with IDA
5:08LIB, and seamless team collaboration
5:11features, IDA gives you the latest
5:13innovations to stay ahead of modern
5:15threats. IDA doesn't just decompile. It
5:18gives you interactive control to dive
5:20into binaries, annotate, patch, and
5:23script your own workflows. And thanks to
5:25our channel partner, Hexrays, we have a
5:28special promotion just for our channel.
5:30You can use code Hammond 50 for 50% off
5:33any IDA Pro product or code Hammond 30
5:36for 30% off any IDA Pro online training.
5:40Offer expires 1 year after this video
5:42release date with more details below in
5:44the video description. Make reverse
5:46engineering easy with the ultimate
5:48analysis tools from hexrays.
5:51Disassemble, decompile, and debug with
5:54IDA. You can get started with my link
5:56below in the video description.
5:58jh.live/hex-rays.
6:01Huge thanks to hexrays for sponsoring
6:03this video. So, they have a video here
6:06to really see this and visualize it, but
6:08I'll talk through it because it's
6:09realistically basically the same as
6:11ClickFix. You click, oh, I'm not a robot
6:13in this setup, in this scenario. enter
6:15your email address and they're just
6:17showing, you know, demonstrating, oh,
6:19this setup has it constrained. So, it's
6:21going to validate its specific account
6:23or some online business corporate domain
6:26or then once it finally has that
6:29connected or is verifying once you have
6:31given away your email address thinking
6:33you're signing back in then it has a
6:36cutesy little animation to show you look
6:38a page will open up and you've got to
6:41copy that localhost URL and then enter
6:45it if you weren't signed in already.
6:47It'll have you reprompt to go through
6:49multiffactor authentication and all. The
6:51gimmick is this is all going to real
6:54Microsoft. It is a legitimate Microsoft
6:57login and it's all in your browser. So
7:00let's dive in a little bit more
7:02tactically like actually how this is
7:04done. They're talking about OOTH
7:06shenanigans via Azure CLI. Normally the
7:10wellestablished techniques or different
7:12attack vectors for initial access or
7:14initial foothold in a cloud Microsoft
7:16365 environment are with like device
7:19code fishing or ooth consent grant
7:22attacks. We're talking specifically
7:24about these OOTH consent grant attacks.
7:27Normally they trick a victim into
7:28connecting a malicious external app into
7:31their tenant. And we've covered that
7:34illicit consent grant attack or
7:36malicious OOTH app attack vector before
7:38on the channel. Oh, what was I doing
7:40with that background? What is that? The
7:42thing is typically that attack technique
7:45requires you putting your hacker hat on,
7:47acting as the offensive security
7:49specialist, ethical hacker, penetration
7:51tester here. When you create a rogue
7:54app, you create that in your own
7:56separate external Microsoft 365 tenant.
7:59Then you're given a client ID or client
8:02secret and that is what you'll end up
8:04hooking up to your own server, your own
8:07infrastructure. You acting as the
8:09adversary set up all this infrastructure
8:11and then fish the victim and have them
8:14accept and connect your app. Look at
8:17some of the setup that usually goes into
8:19that. You'll end up creating the
8:21permissions that are necessary for the
8:22application. You'll have to connect that
8:24client ID, client secret, blah blah
8:26blah. You get those back and forth from
8:28the Azure portal and then you prepare
8:30your server to perform this technique.
8:33So in contrast to that, that's a part of
8:36why this consent fix idea is pretty
8:40slick. Azure CLI is a firstparty
8:44Microsoft app and it's implicitly
8:46trusted in Entra ID and it doesn't need
8:48anyone to end up clicking, oh, I accept
8:51or approve these permissions. These
8:53firstparty Microsoft official apps like
8:56Azure CLI are trusted by default in all
8:59tenants. They can request permissions
9:01without admin approval and they can't be
9:03deleted or blocked. That's pretty cool.
9:06And to connect these dots for you, when
9:08we're talking about the Azure CLI, we're
9:10talking about the simple command line
9:12ast.
9:19You could use windget or whatever you
9:21end up doing to install that. But then a
9:23is just a command line client for the
9:26ability to easily manage your Azure
9:29active directory or now entra ID. Look
9:32at this cutesy little asy art. It is the
9:34cool new Azure CLI. You could log into
9:36your account, manage the graph API and a
9:39whole lot of the other bells and
9:40whistles behind the scenes for the cloud
9:43environment. We could do something like
9:44az login and that will end up prompting
9:47us to log into our Microsoft account.
9:49And we could do this just kind of oh
9:50walking through the steps here. But
9:53notice this Azure signin display. We
9:56could do this with a device code. Use
10:00device code. And that will then give us
10:02a specific unique code to open a
10:06specific Microsoft URL. We've covered
10:08that in another video, but it's really
10:10just like sort of Netflix or Amazon
10:12style thing connecting to like a
10:13television, that concept. And then it
10:15will end up connecting accounts. Device
10:17code does give you a notification though
10:19of what you're doing. If I were to click
10:22and connect to this, it'll be like,
10:23"Hey, are you sure you want to do that?
10:24Make sure you trust it." And then it'll
10:26get all the info as needed. But we're
10:28not talking about the device codefish.
10:30We're talking about an ooth application
10:33and Azure CLI. But the consent fix
10:36technique isn't even using the Azure CLI
10:40like literally typing the a command on
10:42the command line. No, it's using the
10:44same sort of requests HTTP communication
10:48between the real online Microsoft
10:50environment so that it could
10:51realistically genuinely log in to the
10:54Microsoft account. It's just using this
10:57trusted firstparty known and legitimate
11:00application as the fingerprints that led
11:03it through the door. Now, what I mean by
11:04that HTTP communication, because all
11:07this is realistically just interacting
11:09with an API, like trying to talk to a
11:11website, Microsoft online, this is the
11:13URL that they're basically preparing.
11:16And when they ask you to enter your
11:19email, type in, oh, what account are you
11:21trying to sign back into? It's already
11:23prepared with the specific client ID for
11:27the Azure CLI app and I think the
11:30resource string just as well. You could
11:32say, "Hey, I were maybe filling in to
11:35log in as Joe uh johnhammer
11:38onicrosoft.com."
11:40Now, because I've pre-prepared that
11:42email, let me open up a private window.
11:44I could go ahead and paste in that, but
11:46it will already know, okay, look, you're
11:48trying to sign in to this specific
11:50account. Clicking into this, it would
11:52prompt for our password, do regular
11:54multiffactor authentication as for a
11:56legitimate, genuine signin. But let me
11:58get back over to that virtual machine
12:00that we were playing in where we did
12:01have uh another M365 account ready for
12:04us. Let me open a new tab and let me get
12:06to that same URL. Joe as the victim user
12:10is a real thing. So we just need that
12:13address and URL. Once I click to sign
12:16in, you see something weird going on
12:18though. It redirects me to localhost.
12:21Now, this is exactly what we would
12:23expect to have happen in a real
12:25legitimate OOTH app sort of server and
12:28implementation, right? You're connecting
12:30like you're developing an app to work
12:32with Entra ID. It's just authenticating
12:35and giving you the token that code
12:38that's provided here. That's the secret
12:40sauce and that's what the thread actor
12:41is asking for. This is why you see the
12:44push security write up include this uh
12:46burpuite screenshot with this
12:47loginicrosoft online URL because that's
12:50real legitimate Microsoft login. But
12:52once they've clicked that button once
12:54they have signed in and it sends them to
12:56localhost that big long code is what
12:59they the thread actor then asks for.
13:02Copy paste that in. And now some of you
13:05myself included reading through this I
13:08was really thinking who's going to fall
13:10for this? Who would do this? And I know
13:12some people would, but this back and
13:16forth copy paste localhost that looks
13:20clunky to me. I feel like there is a lot
13:22of friction in the social engineering
13:25user experience. You know what I mean?
13:26The gimmick here though that I don't
13:28think I did a good enough job explaining
13:30was that look this URL once they've
13:32entered their email and that gets
13:35funneled along to the end user they
13:37don't have to if they already have a
13:39session and cookies established for them
13:41getting their work done answering their
13:43emails already being logged in to Azure
13:45and enter ID they don't need to enter
13:47their username password do the
13:49multiffactor authentication crap they
13:51just click and then they give away their
13:54account well not their account but now
13:57access to that environment. So again, I
13:59am nerd sniped by this. I think the idea
14:02is wild to bridge from the endpoint or
14:05even oh you know classic cutesy fishing
14:07that's not even fishing. This could just
14:08be any web page out and about across the
14:11internet as you're flipping through
14:12pages and websites and then a couple
14:14clicks then you've stolen a cloud
14:16environment. Like that's bonkers. So I
14:19had to play with it. I wanted to try and
14:21recreate it and see it in action and see
14:23what I could tweak and tune. So, I'm
14:24going to play a video for you because I
14:26wanted to show you what I had put
14:28together. This is just a short little
14:29cutesy demonstration, proof of concept.
14:32But over on the left hand side in the
14:33terminal here, that's where I'm going to
14:35be starting up our little server just to
14:37host and prepare our landing page or
14:40like the fishing website web page lure
14:43all on its own. I open that up. I just
14:45host it and it's index.html. But here's
14:48the little premise here. Microsoft page
14:50says, "Hey, we're sorry. You need to
14:51sign in again to access this resource."
14:53Now, that's probably totally normal,
14:55right? Maybe we're used to, oh, the
14:56resignin, reauthor, SSO stuff that it
14:59always tends to be whenever we're using
15:00Microsoft. But look, it pops up in an
15:03opening signin window and the cookies
15:06and cache is already there. So, the
15:08victim just clicks sign in. Now, you
15:12can't track what happens in this popup.
15:15So, I just had to try and time it or add
15:18a little bit of delay so that look, if
15:20you see this weird error, and I think we
15:22do need to smooth over that user
15:24experience. Oh, you're having trouble.
15:25If you see an error, the site can't be
15:27reached, then I don't want you to have
15:29to copy and paste. That feels too
15:30clunky. Why not just drag it? You could
15:33drag the icon or that URL right into the
15:36box to complete signin. And just like
15:38that, you can see it over on the lefth
15:40hand side. all of the refresh token,
15:43access token, keys to the kingdom for
15:46that environment with a tiny little
15:49Azure CLI ooth app just added in and we
15:52could do whatever else we wanted to do
15:55from there. But you're keeping up the
15:56ruse. The page says, "Oh yeah, you've
15:58successfully signed in. Let's redirect
16:00you." But the damage is done with just
16:02what is it? Two steps, three steps. Drag
16:06something in.
16:09I think it's cool. Like I know I'm
16:11wearing my hacker hat right now, but the
16:14copy paste of like the thin line in the
16:16address bar, local host port 8,400, like
16:18that just looks a little bit sketch. So
16:20we could smooth over that experience by
16:23the cutesy little drag and drop. And if
16:25we were thinking, you know, maybe make a
16:27landing page where it's a little bit
16:28more inline cuz they use a video like
16:30they they had this animation of click,
16:32copy this. It'd be pretty slick if the
16:35Microsoft prompt for click the account
16:37you want to log into or login here were
16:38in line embedded within the page like an
16:41iframe. But Microsoft doesn't let you do
16:43that. It's got to be a pop out. It's got
16:45to be a popup or another tab. But then
16:47cross origin policy or same origin
16:50policy won't let you see what's
16:53happening in the URL bar. You don't know
16:55the context of that new loose iframe or
16:58popup, right? More specifically. So, you
17:01don't know, you can't programmatically
17:02tell with JavaScript as to when they
17:04completed it, if they went to localhost.
17:06And even then, if they see localhost and
17:08it gives them this site cannot be
17:10reached error, that also looks weird.
17:12So, we want to smooth that over and say,
17:14"Oh, if you're having trouble, oh, you
17:15could finish your secure sign in. Haha."
17:17The drag and drop works just as well as
17:19copy and paste for the victim to
17:21voluntarily give up that OOTH code. And
17:24then we, the server, the fishing site,
17:26ends up making the request to Microsoft
17:28to go ahead and finish that app
17:30registration, letting us in the door to
17:32their cloud environment. But if I take
17:34my hacker hat off now and start to think
17:37a little bit more, uh, well, yeah, this
17:40looks a little damning because there are
17:42no endpoint artifacts. This happens
17:44entirely in your web browser. Thinking
17:47this through, right? You connect to a
17:49fishing page to start. You enter your
17:51email into that fishing page. It opens
17:53another popup for the Microsoft login.
17:56You drag in a gesture and then the
17:58damage is done. The only thing you have
18:01to key off of there is your browser
18:03history. Maybe you could go find and
18:05track down when you went to the login
18:07Microsoft kind of component piece.
18:08Hitting that URL on the history is one
18:10artifact in Is there like a log or
18:13record? Is there a forensic artifact of
18:15what you drag and drop? I don't know.
18:18Genuinely, I'm asking. Let me know in
18:19the comments if you got something. And
18:20then we're talking about the firstparty
18:23trusted legitimate Azure CLI app. So
18:28that you can't particularly make go
18:30away, but the logs that you might see in
18:34Azure like within Entra, you could see
18:36maybe login events with the application
18:38Microsoft Azure CLI and Azure Resource
18:41Manager. But the thing is that could
18:43just as easily be real legitimate actual
18:46use of the Azure CLI, not malicious.
18:49They got a little bit more tactical
18:51details in the write up and article, so
18:53I will link that in the video
18:54description for you. But I just thought
18:57this one was wild. Like this is the
19:00lowest lift opportunity from any
19:04website, any endpoint. Like it doesn't
19:07even need a fishing email because this
19:08can just be cast about and then get into
19:11a cloud environment. Microsoft 365 entra
19:14ID all via clickfix. I don't know. I
19:17feel like it can't even be consent fixed
19:19because you don't even get to deal with
19:20or see a usual OOTH permission chart.
19:23They just give you an easy one click and
19:25you're in. I feel like it's like entraix
19:28or there's got to be some other way way
19:30to capture and name that. Let me know
19:31what you think. I don't know if you're
19:32playing with something like this. I
19:34don't know if this is spooking you,
19:35scaring you, giving you the
19:36heebie-jebies, but uh look, it's a
19:38matter of knowing that that threat is
19:39out there and that's how it could be
19:41done. That's it. That's the end of the
19:42video. I've been talking for too long.
19:43Thanks so much. I love you. See you in
19:44the next one. Bye.