Full transcript
0:00All righty, hi everyone. Thanks so much for tuning in. Look, I'm super excited to finally get a chance to chat with Keanu, Keanu niece. I'm so sorry. I know I was going to get your last name wrong. Uh, but we've been bantering, we've been having a chance to chat, and Keanu is a pen tester, ethical hacker, red teamer,
0:15just doing some awesome offensive security work, and the developer of GraphSpoil. So, if you're up for it, Keanu, I'd love for you to tell me hey, a little bit about yourself, what you're up to, and then we could get into a demo, maybe showcase a little bit of GraphSpoil. >> Yeah, I'm a a pen tester and the H I do
0:30some red team assessments and uh social engineering engagements, all kinds of uh fun stuff. And in general, I noticed a couple of years ago that there weren't that many good tools that you could use to enumerate and try the and Azure kind of things, Azure stuff with uh access tokens, because back then device code phishing was pretty new, and I started
0:53looking into that, and I was pretty successful with that. However, after you do device code phishing, and we'll go into that uh a little bit later, you will get access tokens and no username and password, and you can send API calls to Microsoft services. However, yeah, it wasn't that straightforward that you use for to work from command line tools. So,
1:12that's when I started creating my own tools, and after a while, I thought okay, maybe this is growing into something that other people can also use. So, I pushed it there on GitHub. >> Sweet. And GraphSpoil, I know you mentioned to work with that Graph API for like Microsoft, Microsoft Azure, Microsoft Entra ID, and all those. But
1:29that opens up a whole wide world of all the things you could do, like read emails, look at Teams messages, maybe dig through SharePoint or OneDrive. I know there is a ton of opportunity. And if you're up for it, do we want to do some screen share, maybe let off some fireworks, Ivan? >> So, yeah, this is GraphSpoil. So, on
1:46GitHub, you can find it uh fairly easy. The installation process is fairly self-explanatory. It's all all in there. There is some additional installation page if you want to go over that. And then, there is also a full wiki that you can use. I try to update it as much as I can with the new features. However, I still need to work
2:06a little bit on that. But, in general, I think it will be most useful if I just open it up and go through it. So, Guess what? You can use it. I see the features over here or the the command line options over here. However, all you basically want to do is just run it up like that and it will open up. I'm just
2:24going to create a new database over here so we can test it out in a cleaner environment where none of the access tokens of my previous clients will be in, of course. So, you just launch it like that. I'm on a little bit of a pre-release version with some new features, so we might be able to have a
2:41look into that as well. And then, you can just open this in your browser. So, if you launch Guess what? The first time, you will see there will not be that much in there. So, first thing you want to know in Guess what? is that in general, everything will work with access tokens. You will see at the top
3:01you have quite a lot of options of things that you will be able to do. So, enumeration stuff and also be able to modify some stuff. However, first you will need to get some access tokens or refresh tokens. And there are quite a lot of ways to be able to obtain these. You can either steal them from the
3:19devices of the user yourself if you have compromised them or if there is malware running on there, you can get them over there. However, one of the most powerful options that Guess what? supports is doing device code authentication. So, with device code authentication, you can basically trick users into signing in with a code that you create as an
3:40attacker in tools, for example, like Guess what? You send them that code. This code is valid for like 15 minutes only. But, if the user fills in that code on any of the URLs that you see over here, a legitimate Microsoft login URL that they might trust. They fill that in over there and then sign in to
3:56their account or they already signed in. Then you will see that GrassFed will be able to instantly obtain these access and refresh tokens. So, what we going to do is first generate a normal access token or normal device code. Right, you can select the resources and basically the API that you will be able to send requests to after that the user is
4:17authenticated. So, in general quite a lot of the the the functionality GrassFed uses the Microsoft Graph API. They are all supported as well. If you will select that one, we can change that later on. And there we can select a client ID. This one is a little bit more important because it will define what the user will see on their screen. So,
4:36it is important to match that to the pre-text that you want to use. So, for example, if we want to send the user a fake Microsoft Teams invitation for example over email, but you want them to sign in to Microsoft Teams, we might want to select the client ID for Microsoft Teams. You don't need to know them by hand. GrassFed has these already
4:55in there. So, you can select it and then you can click generate device code and you will see instantly it will obtain a device code from Microsoft. You'll see it will also automatically start polling. Every 5 seconds this will update and it will check that the user already authenticate or not. So, right now it is still polling so it will be
5:15blue. But once the user authenticates, we will see that this will turn to green. So, let's do that really quickly with a demo account. You can send any of these URLs over here. They all redirect to the same URL. You can copy and paste that. I'll select the shortest one and this is the one that you would basically
5:31send to your attack or your victim user. So, I will select one of these URLs over here and then this is basically what would happen. Obviously, first you send this to your victim user. We'll just play as a victim user ourself over here is that you can see the flow. So, we enter over here and you see this is a
5:49legitimate Microsoft login page, right? So, this is a legitimate website from Microsoft. It has some warning messages over here. This didn't used to be there, but then Microsoft decided that it would be a good idea to put them over there because obviously this has been abused by real threat actors as well. Right? So, it does say over here, "Do not enter
6:09codes from sources you don't trust." Obviously, during our assessment that we do where we need to do social engineering meeting, we need to convince the user with a pretext that we are the source that they do trust. And even with this warning message over there, we still see that users fill in this code from from us. Let's do that really
6:28quickly. I'll fill in the code over there. Press next. Then you'll see there's already a lot of sign-in sessions that I'm already signed into. Usually, in a corporate environment, a user will already also be signed in to their corporate device, of course. So, what the user would then do is just click on their accounts. Uh yeah, this
6:48is this user. I don't mind to mention. Uh but if I click on that, it will say, "Are you trying to sign in to Microsoft Teams?" Right? Remember our pretext, which probably convinced the user that they are trying to sign in to Microsoft Teams. Maybe we sent them a fake Microsoft Teams invite, right? With the Microsoft Teams code that they would
7:05need to use. So, they will probably say, "Yeah, I'm I'm trying to sign in to Microsoft Teams." Right? And they click continue over there. You'll see that that is actually already done and the moment you will see that the device code will update over here. It has done that. And now if I scroll that to the right,
7:20you will see that it has successfully authenticated over there. Actually, can close this window right now so that we go back to Chris Pike. So, right now the user is already compromised, actually. Even though we don't even have their username password. So, what can we do after that? Well, you will see that we have obtained an access token over here.
7:41It's green, so it's valid. Usually valid for about an hour and then some minutes. And it says over here that it's great to buy the device code. We can now use that access token to do all kinds of fun stuff in Krb with the other features. Right. So, first we would need to activate that one. Then you will see the
7:58active access token is over here. And if I open the sidebar over there, it will show us the current active access token with all of the scopes that we have. If you want to dive maybe a little bit deeper into this access token. This is our raw access token. It's a JSON web token. You can decode that with several
8:16tools. But Krb also already does that for you. And then you can see everything that is in this access token already. So, you have some information in here. Not all of it is going to be very useful for us, but things that you will see that are in there, the IP address of where you generated the device code will
8:33be in there. This is useful location-based conditional access policies, for example. So, this is how Microsoft knows where you're authenticating from. Then, what else is there? The username of the user that we just compromised. Their email address is in there. And then, most importantly, the application ID. So, over here, and it's display name. We set that to
8:53Microsoft Teams, right? And then the audience is the APIs that we now are able to send requests to. And this one, also very important, the scope, which this defines what we as attacker now are able to do with this access token, right? You can see all kinds of fun information in there, such as mail.send, chatmessage.send. We have probably
9:14somewhere files to read write. Also, we can now read files, we can see sites on SharePoint. So, all of this we will now be able to do. Let's see if we can maybe find something. Right, activate that access token. Quite a lot of modules we can use. For example, let's start with OneDrive. Just open that. And normally,
9:34what you would need to have to do is these access tokens. You can't suddenly just insert them into an active browser session and then go to actually OneDrive. So, all you can do is send API calls with this. But, that's fairly annoying to do directory listing and to go to all all of the files in in OneDrive, for example. So, Grassfire is
9:53basically a user interface, a web application that allows you to just browse OneDrive, for example, like you're used to, and it will handle all of the API calls in the background with access token for authentication. So, we can see uh the OneDrive of the user. If we, for example, open want to open a folder, we can do that. Important info.
10:14This one seems important. Cupcake recipes. We can download that, for example, and then see what is in there, as you can see over here. So, not too important in this specific uh case. We could, if we want, upload some files. In a lot of cases, we see like a desktop, for example, shared to OneDrive. You could, for example,
10:33>> Wow. hijack the shortcuts document that is on there, and maybe change their Google Chrome shortcuts to a malicious one that will execute PowerShell, for example. So, then you could uh spread malware to their devices or do something like that. >> That's a very wild like identity-to-endpoint attack vector, in my opinion. Like, that's that's crazy cool. >> [laughter]
10:51>> They are indeed some some nice techniques that you can do if you think a little bit out of the box. I'm just going to go over a couple of the features, and then you just stop me whenever uh you think uh something is relevant, of course. Recent files. So, the the files that were recently accessed by the specific user. So, we
11:08can already see some interesting ones, of course, uh over there that we might be able to download if we wanted to. And we can see where it is hosted in um a SharePoint site uh seems from sales and marketing. So, we could download that one. We can look at what is in there. See quite a lot of credentials uh that
11:26we might be able to uh use. So, yeah, this home directory comes your standard enumeration process, of course files shared with this user. So someone shared a kitten image with a specific user. So that's also there. And then for example, in SharePoint, we should be able to list all the SharePoint sites this user has
11:46access to because we have the sites. Don't read write all permission or that. So you will be able to list that. And then we can just go click through them sales and marketing click on documents for example and click through some folders and secrets and you will find the same document that we saw previously, right? Nice. So there used to be a way where
12:07you would be able to open the Outlook actual Outlook application from just an access token. Sadly, I've noticed that this doesn't really work that often anymore. So this was an an old module that's still in there. Sometimes it works, sometimes it doesn't. I think Microsoft changed something over there that's prevents this from being possible. So then I created a new
12:28Outlook graph module which uses just basically created the complete Outlook interface in graph by myself. And it uses the Microsoft graph API in the background. As you can see over here, it instantly already lists us all the folders I have access to. I can for example reload that over here and then we can see the emails that we have
12:45currently only one. And we can select that, read that. Uh seems like undeliverable notice. We can reply to the email. Have everything we want in there with images. We can add attachments, uh send to BCCs and so forth. It's very detailed. Delete emails as well. Do some custom search queries. I've also you can use custom ones or use
13:05the ones that are pre-built into graph by for example to search for password reset notices for example. But let's clear that and maybe look in the sent items. Reloads. And here we can see some emails as well. So yeah, once again some secrets being shared. Your standard stuff. Obviously, this is a real world environment. So I added some things that
13:24we see quite a lot during our assessments. Uh so we will find quite a lot of bits of uh credential harvesting. But yeah, this is actual stuff that we do see during real assessments as well quite a lot. And if we did have the mail.read.shared scope, and we had some permissions over a shared shared mailbox, you would also
13:43be able to to access the shared mailboxes over there. I think currently I do not have that scope either. So this is a little bit technical, but that is where the scopes and the clients get a little bit funny. I've added a note over here, but since this access token is obtained through a Microsoft Teams access client ID, it will have all the
14:05scopes over the Microsoft Graph API that the Microsoft Teams application would normally have. And this one, mail.read.shared, is not one of them, even though mail.send is one, mail.readwrite is one of them, but the shared mailboxes isn't. What we would need to do then is change our client application to Outlook mobile because I
14:25know that this one does have the mail.read.shared. So this is where something that I haven't really shown yet comes into practice, the the refresh tokens become important. We didn't only receive an access token when we did the device code phishing, we also received a refresh token, which is even more important because if you look this access token, original one, is only
14:46valid for 1 hour. So this expires, we can't use it anymore. However, the refresh token that we got, this one, stays valid for quite a bit longer. The fact it stays valid for about 90 days, so quite a long time, and you can use this one to obtain new access tokens. For restricted scopes, this becomes a
15:08little bit too technical, I don't know how technical you want to go, but there are some specific limitations on which client IDs and resource combinations you can use. If you see it's a 4K token, a family of client ID token, then that means that we can do a little bit of magic and we can use this refresh token
15:25to activate activate it. And not only over here it's activated now, can not only use this one to obtain an access token for the Microsoft Teams client ID, which will give me all the scopes I'm used to from previously, but I can also change this client ID to, for example, Microsoft Office. Usually this shouldn't be possible due to the OAuth and OpenID
15:46Connect specification, which say that you should only be able to refresh access tokens for the same client ID, right? Of your refresh token. But Microsoft is deviating a little bit from that and implemented something they call family of client IDs, this FOCI. And every client ID in this family can be used to obtain access tokens of
16:06different client IDs in the same family. And you'll see that the scope differs a little bit from the previous one. For example, if I now select the Outlook mobile one, submit that one, activate that one, I can see the scope over here. The site and you see a little bit of difference approaches that we have, including mail at 3. shared to hit
16:27um shared mailboxes, right? I think this user doesn't even have access to a shared mailbox, but in case uh you would want that, that's how you would be able to obtain that. So, yeah, that's basically some basic information of what you can do. We can go a little bit further maybe uh in some more complex topics, also more fun topics, I might
16:47say. For example, multi-factor authentication methods, right? We now know that we can use the refresh token to obtain different types of access tokens for different APIs. Sadly, for the Microsoft Graph API, I'm not really able to like add multi-factor authentication methods and things like that. For that, you would need to go to myaccount.microsoft.com and it uses like a different API and you
17:09can actually obtain that in Graph by as well because I've like reverse engineered how that silence API works and I've implemented it in Csharp by so you can use that. And the application that we can use is also a family of client ID applications. For example, at Microsoft Azure CLI or Azure PowerShell, let's use one of these. Let's submit
17:30that. You'll see this as now a different resource. Now it's it's not a URL in this case. Sometimes it's a URL like here, sometimes it's an application ID. All that's important over here is that this application ID corresponds to the one that Microsoft would use to set multi-factor authentication methods, for example, right? So, once we activate this one, I can go to MFA methods. And
17:52if I load over here, we can see all of the multi-factor authentication methods that are configured for this account. So, you can see authenticator app, there's two of those configured. You can see them over here. It gives a little bit so basic information for that. We don't have any FIDO keys added yet. Also, one mobile phone, I would be able
18:10to see that as well, but then you would need to blur that because that's my phone. But, the very nice thing that you are able to do over here is add new authentication methods, of course. Right? So, you can either add one for your Microsoft authenticator, for example. You can click on add. And it'll say it's failed over here, and I
18:29probably know why that is. And that's because our access token doesn't have a specific claim that it needs. So, here it has MFA claims, meaning that the access token was obtained using multi-factor authentication app. Um, but there is a special kind of claim that you need to actually modify multi-factor authentication methods. Then your MFA
18:50claim may not be older than like a couple of minutes, and it has it's called a next gen MFA claim. And we can obtain that if we would have fished the user directly with the specific books set, then we would have obtained that. So, we can do that uh really quickly so that you won't be able to see that. So,
19:10um I'm going to take this one, and I'm going to take uh this one for example. Actually, let's do it like this. This one is what I need. I click generate device codes and now if the user would sign with this one, I'll do that really quickly then you will see that it will prompt me for multi-factor
19:28authentication instantly but we're still on the registration login page of Microsoft. So, that's fine. So, I'm quickly going to do that. 59 all right. All right, so signed in over here. If I go back the right page we'll see this updates very soon. There we go. We got a refresh token and an access token. I'm going to activate this refresh token and
19:48the access token over here. I'm just going to refresh it once again for good measure because it needs to be in a specific format. So, my sign in is Microsoft Azure. So, we have the token over here and now you will see now token has this NGC MFA claim fights and you will also see this token is only valid
20:05for like 15 minutes because it's fairly powerful what you can do with that and I showed you that that I had notes that I can do right now is go to MFA methods. Reload that and now I should be able to add new multi-factor authentication methods to the account of the user. So, you can see over here QR code. I can now
20:22scan that at that and I have a new MFA methods to user. That is wild. >> [laughter] >> I did not know about that NGC MFA like the next gen MFA claim. >> Yeah. Yeah, it's something also fairly undocumented documented I think because yeah, normal users should not use this API of course. Right. I'm not going to
20:42add this one. What I'm going to do instead maybe is add the FIDO2 security key. I also implemented that. I have a YubiKey right here. So, I'm going to put that in. Test key drawn over there. Add security key. It will open this Windows browser or window and that you can use. You just need to enter the PIN code for your
21:03YubiKey of course. There we go. Then I need to touch it physically and you can see the stages over there. It has now added this key to my account. So, I can now go back, it reloads this, and I should see there is one which is set right here. You see over here, it's there. So, now this previous access
21:20token was only valid for 15 minutes, right? Because it had the special claim in there. Now, I can basically sign into the account of user anytime I want using their username and without you knowing their username and password. And because it's a security key, secure right? It will have multi-factor authentication claims as well. So, now I would just be
21:39able to sign into the account of the user. I can actually do that really quickly if you want. So, now I should be able to sign in over there to the account. From there, I don't have the password, but I should be able to sign in with the security key. Yes, it detects that one. We enter the PIN code
21:56of my security key, touch it, and we are signed in. >> [laughter] >> That is awesome. Just capture their account on your own little physical token. >> [laughter] >> Yeah, yeah, indeed. And it's fairly powerful because now even if the user resets their password or changes their MFA methods or their phone or whatever, you still have this security key, right?
22:18So, regarding persistence, this is like fairly powerful. And now we can even obviously use all applications that we want with the GUI. We don't even need to press parity mode. We can just open Outlook or Teams or whatever we want, right? So, it's a little bit of a an upgrade from an access token to a full and persistent
22:37user session. >> Now, there will obviously be logs. Like there will be records in the I don't know, purview or whatever century. How I don't know what Microsoft might call specifically those for the Azure AD logs, right? >> Yes, of course, indeed. So, there will be be logs that a user has added the FIDO key, which obviously that by itself
22:55is not malicious because users can can add that, of course. However, during incident response, if users does notice like some suspicious behavior on their accounts or you are a little bit too eager with the enumeration and grab quite a lot of files at once, then it's might trigger an alert. Your blue team might start investigating that and they
23:14will indeed hopefully find out that you added a FIDO2 security key. Super cool. There are a couple of more features I can show you. So, I'm going to close out this window and go back to where we were. So, I've showed you this one. Guess what? I can also act as like a an MFA method itself, so you can add that
23:34directly from here as well. And that it will you will be able to generate like MFA codes directly from interesting. So, let's stick with that one. Microsoft Teams, I haven't showed you that one. For that, there is a graph API for Microsoft Teams. However, that one do
23:55need specific scopes that you cannot really get as a regular user. Like even if I select like Microsoft graph API and I select the Microsoft Teams client ID, if I obtain an access token for that, you will see the scopes, there is not something like chat.read.all or something similar, chat.read.write. And this is what you need to be able to read
24:16and send chat messages over the Microsoft graph API. So, even though you can the Microsoft Teams client ID can authenticate to the this Microsoft graph API, for some reason it can send mails and it can read your mails, but it cannot read chat messages. So, what you do need then is what I implemented over here is the Skype API. So, this is the
24:36Microsoft Teams API, but it still uses the the Skype endpoint for some reason. So, you can obtain that with the same client ID, create a have user impersonation rights. So, once you activate this one, you will be able to go to Microsoft Teams and use this over here to see all the Teams messages of the user and go over them. So, you will
24:55be able to send messages over there. You can see everything you want. to There's like some documents over there from SharePoint. We would also be able to get that. So, even over there uh we can get that because we are signed in. So, yeah. >> [laughter] >> I'm sorry. I'm laughing at all the Bob the Builder memes.
25:15Oh, yeah. This was from some kind of I did some CTF at some time ago and I used this and this is all uh ChatGPT generated, but uh Nice. >> [laughter] >> So, you have this. You can send messages. You can send images if you want, read documents, and so forth. So, all kind of powerful. Can even list all
25:35other users that that are in the organization and send them some emails as well or some Teams messages as well. So, you could add them at some message to that and then it will create a new group for them. So, we can do that over there. So, over here we send now a new Teams message. So, also very useful as a
25:54that thing because uh what we usually want to do is do some privilege escalation after we compromise a low privilege user. So, a good way is always like finding out or figuring out who the IT guys are and sending them some messages saying that you have some issues and then you invite them in a Microsoft Teams call, for example, which
26:12is like the device code fishing well all over again. So, then we get access to their accounts and then it's a game over fairly soon. Wow. So, these are some of the new features I've been working on from Entra ID. So, these are not all implemented in the public version just yet. It's in my private repo for a limited group of
26:33people that have access to that. If you want, I can give you access later on if you want to play with that a little bit. Right now, this is public. So, what you can do is list the Entra ID users. So, let me just We have some options over the year to which specific properties you want to query. So, you load that and
26:51then you get a full list of all the users in the organization that you can see, okay, which persons have group memberships and 20 roles and so forth. Are they synced to on-prem or not? Could be useful to compromise them to to move to on-prem, for example. And we can see some details of the user, open them, see
27:09all their properties, their phone numbers, when their password was changed, all the groups they are a member of. This one should also resolve, but I think but we can try that they can It's this specific access token has a specific scope by the year, and otherwise it will not be able to obtain the the directory roles. But now it
27:28should be able Okay, and now Microsoft is struggling with that as well. I know which one is going to work though. So, here we should be able to also see the that this user is a global admin, for example, which devices it owns. Right, you can see some information from there. I'll show you some things to follow in devices in a
27:47little bit because you can do quite a lot of powerful stuff with that. Apple assignments, API permissions, and so forth are yeah, all visible over here. Right, and we have basically a little bit of the same flow with groups. Right, so we can enumerate all the group memberships or all the groups in the organization, and we can see how many
28:06members are part of that, and then we can once again open that, scroll down a little bit, see the transitive members of that one, see the owners of that group. All of these you can open up and see like some JSON information with some more details. You have that That's uh basically everywhere that you want some more deep book information or some more
28:24metadata of the specific entity. Also, security groups are there. There is one dynamic one, for example. Also, something very useful for us as admins to look into because these have like membership rules, and sometimes you can make your own user a member of that specific group by changing some
28:44properties like your own department. I don't think you can change that. There are some kind of properties that you can change on your own profile as a directory user. That would result in you becoming part of that specific group. So, that's also always interesting to look into. And then the one that I've been working on today, just now, so this
29:02is like couple hours old or new this functionality, the Azure AD roles. Once again, this is not using the Microsoft Graph API. So, it's not going to work with the Graph access token because with the Microsoft Graph API, you need specific permissions to be able to enumerate directory roles. So, you you can enumerate like a global admins that
29:21are active global admins, but you cannot enumerate eligible group memberships as a low privilege user. You can do that with high privilege user, but what I noticed is if you use like the undocumented API that Azure portal uses, you can use that to enumerate that as a low privilege user. So, what I did is I implemented that one instead. What do
29:40you know, you can also obtain that using client ID for client ID. ID. So, with this same access token that we've been using previously, we can now request this new access token. So, this is the Microsoft PIM one. Activate that. So, we're there. And now we should be able to enumerate the role assignments.
30:01So, we see all the active role assignments, how long they are valid for, for the eligible ones as well, and so forth, right? So, whether they are permanent or not. So, now we can really start targeting some some high privilege users that we want to, right? Some authentication administrators and global admins and things like that. So, very,
30:20very useful information. That is super cool. One last thing I want to show you, and this one is also like very powerful and it's by all the same level of powerful as the FIDO2 upgrade that we saw there. You had the device code to FIDO2 the where we would be able to with the YubiKey now get a full session as a
30:40user. There's one other method of doing that, for example, if FIDO2 keys are not enabled or you want to use something else, and that works with registering devices. And it's fairly complex. It's I have simplified this quite a lot in Kerberos Spice. So, you have device certificates over here. You can either import them from other devices as well
30:59which are compromised, primary refresh tokens that you can also import, and Windows Hello keys. And so, all of these work quite nicely together. Right now, we don't have any of these. Let's say you just start from scratch and you want to fish our user all over again. So, what we can do is obtain an access token for the specific resource, this one,
31:19Entra ID device join, then this one, Microsoft Authentication Broker. This specific access token, if we obtain that, we will be able to register a new device, obtain a primary refresh token for that device, and then also register Windows Hello for that, allowing us to have uh uh full access over the accounts with a new rejoined device. Even if we
31:41don't have the password of the user, we would now also have persistent access to the user session. It will all become clear in a little bit. You could do this manually, but since you only have like 15 minutes to register the device and register Windows Hello for that, and maybe if the user signs in at an inconvenient time when you're not at
31:58your computer, I have automated this. So, you can uh select this one, for example, Windows Hello auto action in the device code section. It will set all the settings right. Then, you will see some additional options become active. So, just going to add join device over here. You can make it either Entra ID joined or registered. Doesn't really
32:16matter. In a lot of cases, I see organizations restricting the ability to join devices to Entra ID, but not to register them. So, I usually would set this to registered because this is what organizations use to, for example, register mobile phones of the user to their organization for specific purposes, right? So, usually this is left open, and we can set the device
32:37type is basically metadata. It can be anything. You can just customize it. Microsoft will not validate it, but it's just how it will show up in the logs. You can even make like custom operating systems like John OS. It doesn't really matter. It will just show up like this in the device logs. So, we will generate a device code. You will see the out
32:56action is ready and now the user will need to sign in to that. So, let's do that again. Let's go to this one. Microsoft console device login. Also, side notes, what I like to do is like during social engineering assessments where I can use a phishing, I just call them, tell them I'm from the help desk, they
33:16need to register their device or whatever. Just say, "Okay, you need to go to this legitimate Microsoft website microsoft.com/devicecodes or device login." Python is a okay microsoft.com seems legitimate, right? They see the Microsoft logo over here. You talk them through it, enter this code. It's only nine characters, so they enter that. And you just say, "Okay, you
33:35don't need to provide me your credentials, right? Just select your account and sign in as normally. Obviously, don't share your password over the phone. That's not so secure." You talk them through it and then usually they will sign in for you. That is awesome. >> [laughter] >> So, a little bit tips and tricks over there. Social engineering. Yep.
33:54This is So, let's sign in. We are trying to sign in to Microsoft authentication broker. So, this is all we are going to tell, but obviously in the pretext that I told right now, you can say that this is Microsoft, right? So, you can say this is for registering your device. So, it's fairly safe. Usually, if you call a
34:12couple of employees, they they will find one that's going to do that. So, we will continue over here and then the attack is done, but if we wait a couple more seconds, you can see now action is in process. So, I don't even need to be at my computer while doing this. The attack is already finished. And we just like
34:28usually we have the refresh token, we have the access token, right? However, you will see, we have a little bit of extra. We have now a device certificate, so there's now a new device registered in Azure AD with that specific user. As we would be able to copy the certificates and the private key of that device, which are usually in the
34:48certificate store of the device, and this one is protected by the TPM, so it's pretty hard to get those out of there, but we now created a new one that's trusted by the organization. And now you take a Okay, what can we do with that? Well, once you have a device certificate and key, you can actually obtain primary refresh tokens. You see
35:08there are some primary refresh tokens already created over here. And these are basically refresh tokens that are more powerful than your regular ones because they are linked to a specific device, to a device identity. What does that give us? Well, these primary refresh tokens are so powerful that you can sign in with You can use them to obtain access
35:29tokens for any client ID and any resource. Like previously, we were restricted to only like the family of client IDs. If we fished a user for a specific client ID that was in the family of client IDs, we'd be able to now refresh those to a specific older access token in the same family. Now we don't need that anymore. We can obtain
35:49access and refresh tokens for any client. But even more, we can generate primary refresh token cookies. And this is basically how your devices do single sign-on. You've probably already noticed when you have a company device and you sign in with your PIN codes or whatever one time on your Windows login screen. After that, you usually don't really
36:11need to authenticate that much anymore because you're already signed in and it will say signed in in Windows, right? Well, what it will basically be doing in the background is using these device credentials to obtain the primary refresh token and use these primary refresh tokens to obtain these cookies. So I'm going to show you what that's going to look like. And you can copy
36:29that over here. These cookies are valid for about 5 minutes, but are very, very powerful. Let's see. I'll open a new incognito window, go to microsoft.com, and just follow the instructions. Do it like this. Now, my cookie's gone. It's getting a new one. So, all we need to do is we're now at microsoft.com. I'm going to go to the cookies tab, clear all of
36:50them, and just import this one. And this is like a completely empty window. There's no one signed in over here yet. If they were right now going to my account, microsoft.com, you'll see I'm just magically signed in. No credentials needed whatsoever. No username, no password, no MFA. I didn't have multi-factor authentication. However, this session even has multi-factor authentication
37:11claims. Right? Because it's the device was generated with multi-factor authentication map. So, very, very powerful feature that you can use as well. And with the primary refresh token, you could just swing from any app or any service, right? Like because that doesn't need any specific client ID, you could just use any of them. That's wild. >> Indeed. And yeah, once again, once you
37:31have this, you don't need like MFA for anything else anymore than just generating the cookies because you can just sign in to any application that you want. Right? I can now go to Azure, for example, and we will also just be signed in. These cookies are just valid for like 5 minutes, but you can generate them how much you want. And once you
37:49sign in to an application, you will get like cookie session cookies for Azure portal specifically. And now, yeah, this session lasts for a couple of hours. I probably if you sign in to something like I share points, for example, you will see that these sessions will stay valid for like a couple hours, even days, with just one cookie. Right? And
38:08you can do this indefinitely. Like the last thing that it generated is the Windows Hello key. Right? This also already got generated. And basically, what this allows us to do is the device that we now generated is now also enrolled with Windows for business, the feature that allowed you to just enter your PIN codes when you boot your device
38:27and suddenly you're magically signed into your account. Well, what happens is your device will actually have a Windows Hello key and will use that to obtain new primary refresh tokens. And once you have this key and as long as this device stays valid and there is not removed from the Azure portal, you are now able to obtain new primary refresh tokens for
38:48as much as you want for as long as you want. As you can see over here, new primary refresh token generated from that. And because these primary refresh tokens are valid for 14 days by default, so you can see it over here. And if even if these expires, as long as I have the keys, I don't need the username and the
39:03password, I don't need multifactor authentication, and just keep generating this for as long as I want. So, then we can do the same trick with the cookies as I have shown previously. >> Yeah, that is insane. >> [laughter] >> That is too cool and Grass fed makes it too easy. Goodness gracious. Yeah, indeed, um sadly some some
39:22malicious actors are also using it. So, from that perspective, it's just important to get these tools out there in the hands of good red teamers and pen testers so that they can use them during their assessments and show how easy it is for attackers to actually also use these because if I don't make these tools, they will just make them
39:42themselves, of course. Agreed. Yeah, I think still the education, the awareness, like that's what's important. Like I know whatever research, yeah, falls in the wrong hands, but you still need to know to begin with because otherwise they'll do it all before before the good guys do. Exactly. Well, hey, this is awesome, my friend. Thank you, thank you, thank you for
40:01showing me the ropes. How can folks follow along? I know you shared the GitHub just previously. If anyone was looking out for, yeah, those new releases, those new updates that I know you were cooking up. And then anything else that anyone else might maybe contribute, help, sponsor? Yeah, they can obviously come over here to the last by kids up get the latest version over
40:20here. I do have like a setup of sponsor page as well. We have seven right now and if you do sponsor over there you can see that you will get access to a pre-release version as well. It's like just private version where I give a little bit of the latest version a little bit earlier to the new people while I'm
40:40still developing the features that support me. So I probably messed up that >> [laughter] >> website. >> Oh, no. That's perfect. All right. Yeah, maybe follow me on Twitter or on LinkedIn or whatever. I do usually make some posts. I don't make too much posts, but if I make a new version of gas by for example, I will
40:57mention it over there as well. Excellent. Well, I'll include all those links in the video description for folks to be able to tune in and track you down. But thank you. Thank you. Thank you, man. I can't say it enough. This is so cool and I had no idea how much further it can go cuz I think I was
41:12following along for like oh maybe the first 10 maybe 15 minutes like I've done device code fishing and I could go play with the account, but I had not done any of the next gen MFA or even the token swapping that you were doing between refresh tokens. So awesome. Awesome stuff. Thank you so much. >> [laughter] >> No problem. Thank you for inviting me.