Abstract
EntraID guest accounts are widely used to grant external parties limited access to enterprise resources, with the assumption that these accounts pose little security risk. As you’re about to see, this assumption is dangerously wrong.
In this talk, we will show how guests can leverage undocumented APIs to bypass limitations and gain unauthorized access to sensitive business data and capabilities including corporate SQL servers and Azure resources. Furthermore, we will reveal how guests can create and control internal business applications to move laterally within the organization. All capabilities presented in the talk will be demonstrated with default Office 365 and EntraID configuration.
Next, we will drop PowerPwn, an offensive security toolset for Microsoft 365 focused on Power Platform. PowerPwn uncovers the true scope of guest access in your tenant. It automates limitation bypass, enumerate and dump all accessible data, and allow for interactive write and delete operations by the researcher.
Finally, we will make up for shattering the illusion of guests having limited access by sharing concrete steps to harden your Azure AD and Office 365 configurations to prevent such attacks and suggest detection logic to catch them if a change in configuration is not possible.
Official agenda abstract for this talk, sourced from CARO Workshop 2024
Transcript
AI generated from recording.
Opening the Stage; Why Guest Users Matter
00:00 Presenter: The stage is yours.
00:01 Presenter: Thank you and welcome. I’m here to talk to you today about guest users in Entry ID and what they can do in your tenant. And I’ll give you a small hint. It’s much more than you might think.
00:17 Presenter: So I’m actually going to talk to you about Michael Barguri’s research.
00:22 Presenter: He’s the CTO and co-founder at Zenity, a company that’s focused on low-code, no-code security,
00:29 Presenter: recently also Gen.AI.
00:31 Presenter: I’m a senior security researcher there, and I’m also the answer to the question,
00:36 Presenter: hacker or rock star, why not both?
00:40 Presenter: Thank you.
00:41 Presenter: I heard that clapping.
00:43 Presenter: Thank you.
00:44 Presenter: It’s also my first time here.
00:45 Presenter: I’m actually very excited.
00:49 Presenter: Okay, let’s start.
00:50 Presenter: I want to talk to you about the guests in Entry ID
00:53 Presenter: and what the real security boundaries for them are.
00:57 Presenter: And I want to start doing so by actually talking about
01:00 Presenter: why do we even have a mechanism in the tenants in Entry ID
01:06 Presenter: to actually invite guests.
01:08 Presenter: Okay, why do we even have that?
01:10 Presenter: Okay, so let’s say you’re working in an organization,
01:12 Presenter: you want to collaborate maybe with other vendors, people from the outside, you have a million reasons to do that, right?
01:20 Presenter: Send sensitive data around, whatever, okay?
01:23 Presenter: We have a few options to do that.
01:24 Presenter: We can just send those emails, right?
01:27 Presenter: That’s one option.
01:27 Presenter: It’s a very bad option, of course.
01:29 Presenter: I think everybody can agree on that for numerous reasons.
01:33 Presenter: Also, we can just choose a file sharing platform, for example, and just put it there.
01:40 Presenter: But that’s very bad, right?
01:42 Presenter: some random person on the street, a random USB, we basically leave ourselves wide open.
01:49 Presenter: We have no information about what they do security-wise.
The Guest Invitation Process
01:54 Presenter: Another option, actually, pretty interesting, is inviting them into our organization, to
01:59 Presenter: our tenant.
02:00 Presenter: That might be a better option.
02:02 Presenter: Now, why is that a better option?
02:04 Presenter: Because when we invite them as guests, basically, we create external identities in the Active
02:10 Presenter: directory and we can both share more resources with them while also enforcing some restrictions
02:18 Presenter: and protecting our resources, so to speak, which, okay, that’s a win-win, right? That sounds pretty
02:24 Presenter: good, I think, okay? So we can agree that in order for us to achieve safe guest access, which
02:31 Presenter: sounds good, it’s really promising, we need two things, right? First of all, it needs to be easy,
02:37 Presenter: right it can’t be difficult okay no matter what your identity is google okta microsoft whatever
02:42 Presenter: the second thing is that it needs to be really easy for it and security to control okay we said
02:49 Presenter: something about security controls um yeah it needs to be easy to enforce those security controls okay
02:55 Presenter: so getting guest access the first thing okay let’s talk about that is actually very very easy okay
03:02 Presenter: It’s super easy.
03:03 Presenter: Let me show you here.
03:05 Presenter: Yes.
03:06 Presenter: Okay.
03:06 Presenter: So we can see here a bunch of ways to do that.
03:10 Presenter: It’s basically we just need to plug in the email.
03:12 Presenter: Okay?
03:12 Presenter: That’s the TLDR.
03:14 Presenter: You can do it through Teams.
03:16 Presenter: You can do it through SharePoint.
03:17 Presenter: You can do it through whatever you want.
03:19 Presenter: It’s very easy.
03:19 Presenter: It takes five seconds.
03:20 Presenter: And basically you just create that guest user.
03:23 Presenter: You’ve just invited a guest user.
03:25 Presenter: It can be a hacker.
03:25 Presenter: It can be not a hacker.
Security Boundaries for Guests; Guest Access in Practice
03:27 Presenter: Whatever.
03:27 Presenter: Okay?
03:28 Presenter: Super easy.
03:28 Presenter: So we can agree that point one happens, right?
03:32 Presenter: specific type of access and we’ll talk about what that means shortly. But let’s talk about the second
03:38 Presenter: thing. Is it really easy for IT and security to control? Well, in order to answer that, let’s
03:44 Presenter: actually understand what happens. Because on the left side we have the identity providers
03:50 Presenter: of the external entities or whatever, the guests. On the right side we have the identity provider
03:56 Presenter: for our organization, okay?
03:58 Presenter: And the cool thing here is that when the link is established,
04:02 Presenter: basically we enforce a bunch of security protections upon them, right?
04:06 Presenter: We said that they have now external,
04:09 Presenter: they created in our Active Directory as external identities,
04:12 Presenter: and so we can activate things like security controls, MFA,
04:15 Presenter: and all these good things.
04:17 Presenter: That sounds perfect, right?
04:19 Presenter: Sounds really, really good, okay?
04:22 Presenter: But wait a minute.
04:23 Presenter: Didn’t we just say something about active directory, guests, somebody external in our active directory?
04:29 Presenter: That sounds a little odd.
04:32 Presenter: What does that mean?
04:33 Presenter: Do they get full access?
04:35 Presenter: Well, luckily, no.
04:36 Presenter: Okay, that would be really strange if they would, because we’d be basically inviting somebody random or somebody external to have the same permissions as someone that works for us.
04:49 Presenter: Okay, we don’t want that.
04:50 Presenter: And so we want a deny-by-default access, okay?
04:55 Presenter: And this is really, really important.
04:57 Presenter: But this is also part of the mechanism that we want to examine in this talk, okay?
05:03 Presenter: This is part of it, okay?
05:04 Presenter: And the reason for that is all that we’ve discussed so far is the promise of security for guests, okay?
05:11 Presenter: It’s the theory, okay?
05:13 Presenter: Now let’s talk about the practice, okay?
05:15 Presenter: And you might see, you might find some main key differences, okay?
05:20 Presenter: So as a benign user, let’s go into our tenant, okay, into our entry ID.
05:25 Presenter: You can see that I’m a benign user because of the green icon on the right lower side, okay.
05:31 Presenter: I’m logging in.
05:32 Presenter: I’m already logged in, actually.
05:34 Presenter: I want to invite somebody in, okay.
05:36 Presenter: Let’s see that, okay, as a benign user.
05:38 Presenter: I start just, I want to add it as a member.
05:41 Presenter: I’m starting to add them.
05:42 Presenter: Okay, I entered the email.
05:43 Presenter: Why not a hacker?
05:44 Presenter: You know, why not?
05:46 Presenter: And I’m inviting them, okay.
05:48 Presenter: That’s everything, okay.
05:50 Presenter: Basically, they’re invited.
05:51 Presenter: Real easy.
05:52 Presenter: We said that.
05:53 Presenter: What happens on the other side, right?
05:55 Presenter: As the hacker now, okay?
05:56 Presenter: And we can see that according to the red icon, okay?
05:59 Presenter: I log into my hacker tenant, right?
06:02 Presenter: I have a hacker tenant.
06:03 Presenter: And then my email gets, my tenant gets a consent, okay?
06:09 Presenter: I have to accept the invitation from that guest tenant, okay?
06:13 Presenter: Once I accept that, I go to that guest tenant that I’ve been invited to, but I don’t see anything, right?
06:20 Presenter: see an app’s window and it’s empty okay there’s nothing there this is great actually because we
06:26 Presenter: said we want to deny by default okay this is great so you know maybe everything works as expected
06:33 Presenter: and you know maybe we can just go home I think maybe we’re done but but not exactly of course
Phishing via Teams
06:41 Presenter: because we have to talk about the real attack surface of guests okay and I want to start doing
06:50 Presenter: explaining something. So what we’re trying to see is that guests are much more powerful than you might think.
06:57 Presenter: Two examples of that are, first of all, team-based phishing. So Teams is one of the main platforms that organizations use to collaborate.
07:07 Presenter: And it’s both a collaborative platform, but it’s also an enterprise platform. And those things sometimes don’t work well.
07:15 Presenter: They don’t mix well. And one example of that is that users in Teams from one tenant can actually send messages to users in another tenant.
07:24 Presenter: And we’re all used to Teams being internal. So this is kind of confusing.
07:30 Presenter: And attackers abuse this. This is just from the Microsoft blog, an example of how APTs use something called Teamfisher.
07:37 Presenter: You can look it up. It’s an open source tool.
07:39 Presenter: It’s pretty cool because they actually not only abused the fact that you can send cross-tenant messages,
07:46 Presenter: but they also were able to bypass some security restrictions and attach files to Teams.
07:53 Presenter: So that’s, in a way, moving phishing from emails to Teams.
07:59 Presenter: That’s really powerful, and you can do that as a guest if you invite somebody as a guest because there are two tenants involved.
08:06 Presenter: And this is actually pretty interesting because if you look on how it looks like in Teams, can you even spot that it’s an external user?
08:16 Presenter: Maybe not from the distance, but it’s really, really small.
08:20 Presenter: That’s right there, the upper red box.
08:23 Presenter: That’s your protection mechanism.
08:24 Presenter: It says like really, really small, external in two parentheses, okay?
08:30 Presenter: So that’s your protection mechanism, okay?
08:32 Presenter: And this is somewhat concerning, okay?
08:36 Presenter: we can do as guests. Another really cool thing that I always love is recon. So you wouldn’t
08:43 Presenter: expect that somebody that I had just invited to my organization as a guest would be able
08:48 Presenter: to recon users on my tenant, right? That doesn’t make sense. Why would he be able to do that?
08:53 Presenter: He’s a guest. He’s not supposed to have like denied by default access. But there’s a really,
08:59 Presenter: really cool tool and research that I really recommend you go to called AAD Internals if
09:06 Presenter: interested in all this subject, okay? And what it says actually is that you can definitely do that,
09:14 Presenter: okay? It’s really possible and you can do that. And we’re not going to like dive into it because
09:19 Presenter: that’s beyond the scope of this talk, but it’s basically abusing the fact that you can say,
09:25 Presenter: okay, I have my user ID. If I have a user ID, even as a guest, I can know which roles and which
09:31 Presenter: groups that user ID has. Now the guest is always in the guest group, okay? And if I have a guest,
09:38 Presenter: sorry, a group, a certain group’s ID, I can know which users are there. So you understand where
Reconnaissance with Guest Accounts
09:43 Presenter: I’m getting here. You can do this recursively, and sometimes the guest is in more than one group,
09:47 Presenter: and you end up with a much larger number of users that you can actually enumerate. And this
09:53 Presenter: is not, it will probably not be for all the tenants’ users, but it’s a large list, okay?
09:58 Presenter: So that’s pretty crazy, right?
10:00 Presenter: I mean, if we haven’t updated our threat models with guests being abused by attackers,
10:07 Presenter: guest access, then we actually should do this.
10:11 Presenter: But hackers always want more, right?
10:13 Presenter: We want to change stuff.
10:15 Presenter: We want to destroy stuff.
10:16 Presenter: We want to edit stuff.
10:18 Presenter: Okay, what else can we actually do?
10:20 Presenter: So let’s switch gears now and actually go to the main part of the talk,
10:24 Presenter: which is the real attack surface of guests.
10:28 Presenter: And before we do that, I have to tell you that you have a choice.
10:34 Presenter: You can stop here, assuming you have a tenant at home and enter ID.
10:38 Presenter: You can just go home because I might kind of ruin your week now
10:42 Presenter: because you’ll understand that you have a load of work to do when you get back to the office.
10:47 Presenter: Or you can stay and listen to what I have to say.
10:51 Presenter: Assuming there’s no takers here, I’ll actually continue, okay?
10:55 Presenter: And by continuing, I’m actually going to go to that link on the left.
11:01 Presenter: And when I click on it as a guest, I’m actually going to go to something called Power Apps within the Power Platform ecosystem.
11:11 Presenter: Okay, I get, again, as a hacker, I get to this hello screen.
11:14 Presenter: Okay, that’s great.
11:15 Presenter: And then there’s a disconnect.
11:17 Presenter: Okay, basically it’s saying, hey, wait, wait a minute.
11:19 Presenter: It’s a deny by default.
11:20 Presenter: Who are you?
11:20 Presenter: You’re not part of this tenant.
11:21 Presenter: Go home.
11:23 Presenter: Okay, I go home to my tenant.
Power Platform Credentials Exposure
11:25 Presenter: direct, that’s cool, I guess. But then I can see, okay, that shows us that we’re in our home tenant,
11:33 Presenter: Pontoso, by the way, which is a tribute, yes, somebody understood. And if we click on switch
11:39 Presenter: directory, we can actually see whatever other tenants, whatever full tenants we can access to,
11:45 Presenter: okay, the ones, for example, that we’ve been invited to. What if I just switch to that tenant
11:49 Presenter: again and i go to connections okay now this is by the way the original url that we tried to enter
11:57 Presenter: now the thing about this is we’re looking at a list of something it looks kind of interesting
12:02 Presenter: right as security uh people we’re seeing like azure file storage sql azure store blah blah blah
12:09 Presenter: it’s it’s kind of interesting okay and that’s because connections in the power platform ecosystem
12:16 Presenter: are actually interchangeable with credentials.
12:18 Presenter: And I’ll explain what that means.
12:20 Presenter: But basically, we’re looking at a credentials list for different data sources.
12:25 Presenter: And that’s kind of weird.
12:26 Presenter: Why would a guest like ourselves, as a hacker in this situation, be even able to see this?
12:33 Presenter: It’s kind of odd, right?
12:35 Presenter: Let’s try to understand that a little bit further.
12:37 Presenter: Let’s click on one.
12:39 Presenter: And if we click here, we see a share button.
12:43 Presenter: Now, I don’t know about you, but my mother always said, don’t share your credentials.
12:47 Presenter: So it’s kind of weird that we have a share button on something that we just said, hey, it’s exactly like credentials.
12:56 Presenter: That’s kind of odd.
12:57 Presenter: And let’s try to understand exactly what’s happening here, okay?
13:02 Presenter: So if we press on share, we see that this connection, okay, has already been shared with several entities, okay?
13:12 Presenter: is the entire organization, which could explain maybe why we’re seeing it.
13:17 Presenter: And we have two other entries for Jamie, wherever Jamie is.
13:22 Presenter: We have an Outlook and a Non-Outlook, because why not?
13:25 Presenter: And folks, this is of course the problem, right?
13:27 Presenter: Somebody shared this connection, which again is interchangeable with a credential in a power platform ecosystem with the entire organization.
13:36 Presenter: It might have been Jamie, we’ll figure that out.
13:39 Presenter: But this is the root of the issue, okay?
13:42 Presenter: this is concerning.
Bypassing DLP in Power Apps; Exploiting API Management
13:44 Presenter: So let’s try to understand what’s exactly behind this.
13:47 Presenter: Why is this even happening, right?
13:49 Presenter: We click on details next,
13:53 Presenter: and we see that Jamie is the owner.
13:55 Presenter: Oh, Jamie, she shared it.
13:59 Presenter: But Jamie is basically a business user, okay?
14:02 Presenter: So what does that mean?
14:04 Presenter: Why are business users,
14:06 Presenter: in this case a customer service representative,
14:08 Presenter: why are they sharing credentials?
14:10 Presenter: What’s happening here?
14:13 Presenter: here is that business users in the low-code, no-code era are building apps.
14:21 Presenter: Okay?
14:21 Presenter: They’re doing it.
14:22 Presenter: They’ve been doing it actually for years using dragging and dropping, and they are doing
14:26 Presenter: it now using Gen.AI.
14:28 Presenter: They can just plug into a chat GPT like text, LLM, whatever, and just create an application
14:35 Presenter: including all the misconfigurations that come along with it, and they can just do it themselves.
14:41 Presenter: Okay?
14:42 Presenter: is already happening okay if you kind of think yeah you know my organization we’re a financial
14:48 Presenter: service we don’t really do that i have to convince you that according to microsoft i have to convince
14:54 Presenter: you that’s probably wrong because according to microsoft last year there were eight million
14:58 Presenter: of these citizen developers okay compared to for example c sharp.net which were only there were
15:04 Presenter: only five million okay and how much security are we investing in these citizen developers okay
15:10 Presenter: these business users. Now also remember their business users, they’re not supposed to be security experts.
15:17 Presenter: They aren’t and they shouldn’t be. So of course they’re going to make misconfigurations.
15:25 Presenter: We have to help them, we have to own this. So now that we’ve actually seen all of this, this is kind of interesting,
15:32 Presenter: what can we actually do with that as attackers? Let’s look at that.
15:36 Presenter: So we’re back here at the specific connection we observed earlier as the attacker.
15:41 Presenter: You can actually see two different tabs here.
15:43 Presenter: Okay, let’s click on the apps using this connection.
15:46 Presenter: And we can see that there’s an application actually using what we said was a credential,
15:51 Presenter: what we said was a connection, and we’ll explain that shortly.
15:54 Presenter: We click on it because as hackers we’re saying, okay, let’s see what we can find.
15:59 Presenter: Can we actually exfil some data here?
16:01 Presenter: And then we get to this page.
16:04 Presenter: We see that there’s a link here and a bunch of info.
16:06 Presenter: Let’s click on the link and try to understand what’s going on.
16:08 Presenter: Oh, we get an error.
16:10 Presenter: Okay, what’s going on here?
16:11 Presenter: Okay, we get some error about something.
16:14 Presenter: We don’t have a correct plan or something.
16:16 Presenter: Ask your admin, whatever.
16:18 Presenter: If we read this a little bit more thorough,
16:21 Presenter: we actually notice that it’s basically saying,
16:24 Presenter: listen, you don’t have a license for Power Apps,
16:26 Presenter: but you can ask your admin for one.
16:29 Presenter: So maybe if we ask our hacker tenant admin for one,
16:35 Presenter: would that work?
16:36 Presenter: Could we be able to access this Power Apps in another tenant for which we saw an error
16:42 Presenter: that we don’t have a license?
16:43 Presenter: Let’s try.
16:44 Presenter: I mean, why not?
16:46 Presenter: We go to Microsoft.
16:47 Presenter: We say, hi, I’m a hacker.
16:49 Presenter: Please give me a license.
16:51 Presenter: And we get a license because it’s our home tenant.
16:54 Presenter: And basically we can get whichever license we want, right?
16:58 Presenter: And then it works.
17:00 Presenter: Okay.
Token Exchange and Red Teaming Tools
17:01 Presenter: That’s cool.
17:02 Presenter: So we’ve kind of bypassed that issue.
17:06 Presenter: Okay, it’s interesting.
17:08 Presenter: It says something about a data loss prevention policy, blah, blah.
17:12 Presenter: We look through it.
17:13 Presenter: We actually see that it’s basically blocking us.
17:16 Presenter: Okay, a DLP, which we might be familiar with from other aspects of security, is blocking us.
17:21 Presenter: And that’s actually pretty great because we know what a DLP is from other sections of security.
17:28 Presenter: And it’s supposed to mitigate that access.
17:30 Presenter: It’s supposed to safeguard it.
17:32 Presenter: That’s great.
17:32 Presenter: Okay, let’s try to actually understand what’s going on here.
17:36 Presenter: the DLP is actually built into Power Platform. Oh, perfect. So let’s actually create one now as a
17:43 Presenter: benign user to try to understand what a DLP is here, okay? And let’s say social security numbers,
17:51 Presenter: you know, just create like a demo one. Okay, let’s assign connectors. Connectors in Power Platform
17:56 Presenter: are basically data source types, okay? We can see SharePoint, OneDrive. Okay, cool. Okay. But then
18:04 Presenter: when we actually pick one, we start noticing something maybe a little strange, okay? We don’t
18:08 Presenter: have any granularity, and basically, this isn’t a DLP in maybe the sense that we are used to, okay?
18:16 Presenter: It’s not labeling. It’s not really doing some data exfiltration protection. It’s basically an
18:21 Presenter: allow and deny list, okay? And that’s a problem in a way, and you sometimes have more security
18:29 Presenter: mechanisms in Power Platform, but these things, these DLPs, they’re basically allowing denialists
18:36 Presenter: for the data sources that these apps use, okay? And that’s a little bit of an issue because we
18:42 Presenter: don’t have any user association here, and we’re basically saying, okay, I don’t want any app to
18:49 Presenter: use this kind of data source. You know, you could start to think about this as a hacker and say,
18:54 Presenter: wait a minute, that leaves a bit of a security hole, right?
18:59 Presenter: So we at the company actually have a hobby to find these security holes.
19:04 Presenter: There are quite a few.
19:06 Presenter: And the thing about these are that it’s, I’m talking about this,
19:12 Presenter: not to say that the DLP mechanism is bad, it’s a good tool,
19:15 Presenter: but it’s not a security boundary, okay?
Defensive Takeaways — Part 1
19:18 Presenter: It’s a governance tool, okay?
19:19 Presenter: It will not stop any hacker or any persistent citizen developer
19:24 Presenter: actually abusing Power Platform. And this is important for us to understand.
19:30 Presenter: So let’s actually go back to the hacker perspective here and let’s try to see what we can do.
19:41 Presenter: So for a moment I’m going to deactivate that DLP because I want to see what we can get from the
19:48 Presenter: data source. So I’m going into the DLP and I’m actually going to close things. I’m going to
19:54 Presenter: unblock data sources, the one that we saw, maybe some others, that the application is using. Don’t
19:59 Presenter: worry, we’ll get back to this in a moment, okay? I won’t forget, I promise. So as a benign user,
20:05 Presenter: we now log into the app again without that restriction. And we have this screen, okay?
20:10 Presenter: and it says allow, and notice that it’s an allow, but it’s not granting access in the OAuth scope
20:19 Presenter: permission sense. This is credentials sharing, okay? This is what’s going to happen here, and I’ll
20:25 Presenter: explain that in a moment, okay? We press on allow, and then we see the data. Okay, that’s great. That’s
20:31 Presenter: what we wanted, okay? We are seeing data via power-ups, okay? We can see the customers here. Okay,
20:38 Presenter: Okay, interesting.
20:39 Presenter: What’s actually happening here though, okay?
20:42 Presenter: When we look at through our browser, we open the developer tools,
20:46 Presenter: we can see that actually there’s an API invocation call here, okay?
20:50 Presenter: There’s an API call getting that data, okay?
20:53 Presenter: And this is actually interesting because when we observe this further,
20:56 Presenter: we’re not seeing anything like an OAuth that we get access to
21:02 Presenter: to perform operations on the user’s behalf or anything.
21:04 Presenter: We’re basically seeing an API call that is replaying some secret back, and that’s what’s allowing us to access that data source.
21:15 Presenter: And that’s kind of surprising, okay?
21:18 Presenter: And it also, we can see that it starts with APIM, which is the API hub.
21:22 Presenter: It’s an internal Microsoft resource, okay?
21:25 Presenter: So let’s try to figure out what’s going on here.
21:27 Presenter: Let’s copy this request to the side, okay?
21:30 Presenter: Let’s just look at it as a curl request or whatever.
21:34 Presenter: a get in this example. Could have been, by the way, another method. And we can see that there’s
21:41 Presenter: a domain here, the API M, the API hub that we talked about that allows us to get this information.
21:47 Presenter: Then we can see SQL, which is the data source, right? We have a specific ID because it’s a specific
21:51 Presenter: instance of an SQL. This is, by the way, also what the credentials are related to.
21:57 Presenter: Then we have an operation related to the data set, to the application. And finally, we have
22:04 Presenter: actually when we decode it, it’s the table, right? It’s the table that was accessed through the app.
22:09 Presenter: Okay, that’s pretty cool. What the hell is going on here?
22:13 Presenter: So what’s going on here is that we have the API management for Azure that sits between power platform and whatever data source that we actually fetch, okay?
22:26 Presenter: And what that API has is a credential, a metadata store in which it stores secrets, okay?
22:34 Presenter: When you create a connection, you actually plug in credentials that are being stored there.
22:41 Presenter: And you actually share, if you share that connection, you share not the credentials themselves directly, but you actually share the ability to call that API and then use it on your behalf.
22:53 Presenter: And that’s interesting.
22:56 Presenter: Okay, maybe we can use that.
22:57 Presenter: What if we just copy that request and don’t go through Power Apps at all now?
23:05 Presenter: we have an API code,
23:06 Presenter: what do we need Power Apps directly now?
23:09 Presenter: Would we be able to see the data maybe?
23:12 Presenter: Well, the answer is yes.
23:14 Presenter: We can just see the data
23:15 Presenter: that the DLP or the Power Apps tried to stop us.
23:20 Presenter: We can just access it directly.
23:23 Presenter: And the reason why this works
23:26 Presenter: is because the DLP wasn’t blocking the connection.
23:29 Presenter: It wasn’t blocking the connection to the data source.
23:32 Presenter: it was blocking apps from using it.
23:36 Presenter: And now this has been disclosed and resolved, okay?
23:40 Presenter: But notice that it’s one of the holes that we mentioned earlier.
23:43 Presenter: But note that you should still be aware
23:45 Presenter: because the fix is only relevant for new connections, okay?
23:50 Presenter: And this is kind of concerning, I think, okay?
23:55 Presenter: And, okay, so what actually can we do with this?
23:58 Presenter: How can we really leverage it to get a full home run from the hacker perspective?
24:03 Presenter: So let’s take a closer look at this API.
24:07 Presenter: Now, this API, it uses a token.
24:10 Presenter: Now we’re looking at Jot.io to actually understand.
24:13 Presenter: We needed a token to actually be able to send that API request.
24:18 Presenter: We couldn’t just do it right off the bat.
24:21 Presenter: We needed a token to do that.
24:23 Presenter: And we could do that with a Power Apps token, which has this specific scope for that API hub that we just mentioned.
24:30 Presenter: So, I mean, we want to get a full home run or whatever the phrase is.
24:36 Presenter: Can we maybe generate our own token to do that?
24:39 Presenter: Well, we know that we can generate tokens, right?
24:42 Presenter: That’s a mechanism that we understand.
24:44 Presenter: But we need the correct client ID.
24:46 Presenter: We need the correct application.
24:48 Presenter: So, what if we use a public app maybe to do that?
24:53 Presenter: Can we maybe do that?
24:54 Presenter: Well, no.
24:55 Presenter: And the reason is because it needs to be pre-approved in the tenant.
24:58 Presenter: So in other words, this means that it wouldn’t exist in any tenant.
25:04 Presenter: The second thing that we want to try is maybe if we can create our own app.
25:08 Presenter: So no also because it needs to be able to query the MSFT internal scope.
25:15 Presenter: So now we’re really, really, really close.
25:17 Presenter: So what can we do?
25:18 Presenter: So we’re going to solve this actually by doing three things.
25:23 Presenter: owned by default, that is pre-approved to query that internal resource, and that is
25:29 Presenter: able to generate tokens on demand.
25:31 Presenter: We want a full bypass here, and it’s supposed to be a public client for that.
25:36 Presenter: And one application that does that is the PowerApps portal, because we saw it earlier, we were
25:42 Presenter: able to do that, but not exactly.
25:45 Presenter: We couldn’t actually generate tokens on its behalf.
25:48 Presenter: So we’re going to solve this using a really, really neat piece of research called the family of client IDs research.
25:55 Presenter: And in a nutshell, it just enables you to exchange one token for another.
26:00 Presenter: But they have to be within the same family of tokens.
26:03 Presenter: That’s what it basically says.
26:05 Presenter: And this is exactly why you don’t have to re-log into SharePoint and stuff like that when you go to it from another subdomain or whatever, from another Microsoft domain.
26:13 Presenter: So this is a family of tokens, for example.
Defensive Takeaways — Part 2
26:18 Presenter: one we basically compromise all of them so power apps is what we wanted it worked and we can also
26:23 Presenter: use the azure cli because we we know that we can generate tokens on demand so would that work could
26:29 Presenter: we create one and exchange for the other well yes that works we get a login screen and that’s a full
26:36 Presenter: home one so just to finish i want to show you how you can do this too okay so introducing power upon
26:43 Presenter: It’s an open source red teaming tool that’s also Michael’s red team research contribution.
26:49 Presenter: It has several modules.
26:51 Presenter: We’re going to focus on the Dump on GUI, but I really recommend you focus on other experiments
26:56 Presenter: on others as well.
26:57 Presenter: It’s on GitHub.
26:58 Presenter: If we use it on the tenant and we log in, we can just get to this.
27:05 Presenter: We can see this screen after it does all the heavy lifting for us.
27:08 Presenter: We can see some of the connections we saw earlier as a hacker.
27:10 Presenter: If we press on dump, we can actually see those data sources.
27:13 Presenter: Okay?
27:14 Presenter: And we have all the information that we saw.
27:18 Presenter: Yeah, I’m just finishing.
27:20 Presenter: And then if we press on playground, we can just send arbitrary queries.
27:25 Presenter: And we can basically do anything for those connections.
27:28 Presenter: So I really recommend you look at it.
27:30 Presenter: Do I have time to say a few less words of defense of how we can protect against?
27:35 Presenter: No.
27:36 Presenter: Okay.
27:37 Presenter: So thank you very much.
27:38 Presenter: With that, we’re done.
27:39 Presenter: Thank you.