OAuthSeeker: Red Team Tool for OAuth Phishing Attacks Against Azure and Office365

Leveraging Compromised Access Tokens

OAuthSeeker obtains valid Microsoft Graph API credentials inclduing a JWT and refresh token upon successful completion of the OAuth flow with the application. OAuthSeeker automatically perform the token refresh operation every twenty-four hours to ensure that refresh tokens remain active for their entire validity period and aren’t revoked early. However, OAuthSeeker doesn’t provide any direct means to operationalizing these tokens after they have been obtained through an OAuth consent phishing campaign. However, there are several existing tools which can be used to leverage these tokens for post-exploitation.

GraphRunner is a post-exploitation toolkit for Microsoft 365, allowing attackers to leverage authenticated access to Microsoft’s Graph API. With GraphRunner, operators can search and export data from emails, SharePoint, and Teams, enumerate user permissions, deploy malicious applications, and more. It’s a powerful way to pillage compromised accounts and maintain persistence within a Microsoft 365 environment. Black Hills Information Security originally developed this tool, and they have an informative webcast titled GraphRunner: A Post-Exploitation Toolset for M365 discussing the tool’s usage and common attack paths.

GraphSpy is a multipurpose tool designed for advanced red team operations in Microsoft 365, with a local web interface for efficient token management. It enables streamlined access to OneDrive, SharePoint, and Outlook, supporting device code phishing with concurrent code polling. The tool simplifies interactions with Microsoft APIs, allowing attackers to execute custom requests and perform targeted data extraction and persistence operations across projects. More insights are available in a YouTube interview with the GraphSpy author titled GraphSpy – Offensive Security Tool for Microsoft 365 with Keanu Nys.

OAuthAzure is a utility that can be leveraged alongside OAuthSeeker for post-exploitation and enumeration of resources within an Azure environment. OAuthSeeker allows you to perform a phishing attack where you can request user_impersonation privileges within Microsoft Azure which then allows you to access all Azure resources on behalf of the victim user account. OAuthSeeker by default requests Graph API tokens as the requested token audience for the JWT can either be for the Microsoft Graph API or for Microsoft Azure, but not both at the same time. By default, we request Graph API access within OAuthSeeker, but OAuthAzure can then be leveraged to exchange the obtained JWT and Refresh token for a Microsoft Azure token for access to Azure impersonation capabilities.

OAuthPillage is a utility included within the OAuthSeeker framework for performing post-exploitation leveraging compromised Microsoft Graph API tokens. This utility allows you to leverage a compromised Microsoft Graph API token with the ability to list user privileges through the User.ReadBasic.All permission to dump all of the information about users available within Microsoft Azure for usage in additional follow-on phishing attacks targeting a victim organization.