1 00:00:00,930 --> 00:00:04,189 - Our next speaker is first time at DEFCON Michael. 2 00:00:04,189 --> 00:00:06,443 Lovis gonna be taking a dump in the cloud. So get ready, 3 00:00:07,469 --> 00:00:08,302 please. Gimme a warm welcome. 4 00:00:12,660 --> 00:00:14,133 - Hey, what's up? 5 00:00:15,450 --> 00:00:18,179 Well, first of all, hi mom. 6 00:00:18,179 --> 00:00:20,520 Second of all kind of excited. 7 00:00:20,520 --> 00:00:24,467 Obviously didn't really think the tile would go through, 8 00:00:24,467 --> 00:00:27,060 but sure. We're leading into it. 9 00:00:27,060 --> 00:00:30,640 So the talk is called taking a dump in the cloud and it's 10 00:00:30,640 --> 00:00:35,130 more of taking a data dump from the cloud than taking an 11 00:00:35,130 --> 00:00:37,680 actual dump in the cloud. But yeah, we'll, 12 00:00:37,680 --> 00:00:38,610 we'll get into it later. 13 00:00:38,610 --> 00:00:42,109 So I'll start by introducing myself. My name is Melvin 14 00:00:42,109 --> 00:00:44,070 Langvick I go by the alias Flangvik online. 15 00:00:44,070 --> 00:00:46,080 I used to be a C sharp developer. 16 00:00:46,080 --> 00:00:49,240 Now I'm a red teamer over at trust sec, 17 00:00:49,240 --> 00:00:51,660 I work at the target operations team. 18 00:00:51,660 --> 00:00:54,469 I'm extremely lucky to be able to work with such extreme 19 00:00:54,469 --> 00:00:56,313 mentality at individuals. 20 00:00:57,570 --> 00:01:00,030 I do TWITCH streams. I can't say I do them every Sunday. 21 00:01:00,030 --> 00:01:01,500 People are gonna call that out. 22 00:01:01,500 --> 00:01:03,360 I try to do them some Sundays. 23 00:01:03,360 --> 00:01:06,510 I used to do them every Sunday. I don't do it anymore. 24 00:01:06,510 --> 00:01:09,960 I'm also a part of an region technical hacker podcast called 25 00:01:09,960 --> 00:01:12,510 shell cast. If you speak or listen Norwegian, 26 00:01:12,510 --> 00:01:14,790 then maybe that's something for you. 27 00:01:14,790 --> 00:01:17,200 I run a very unsuccessful YouTube channel that you probably 28 00:01:17,200 --> 00:01:20,480 don't wanna look at, but if you want to go ahead, 29 00:01:20,480 --> 00:01:23,680 I maintain the sharp collection and fail projects. 30 00:01:23,680 --> 00:01:26,439 Maybe some of you heard about it, maybe not. 31 00:01:26,439 --> 00:01:29,869 I also have some other projects that have added to the gift 32 00:01:29,869 --> 00:01:31,337 of over time. 33 00:01:31,337 --> 00:01:34,080 So we're gonna go through this sort of as a story. 34 00:01:34,080 --> 00:01:35,703 So I'm releasing a toolkit. 35 00:01:36,869 --> 00:01:39,549 I'm gonna talk you through what got me started into the 36 00:01:39,549 --> 00:01:42,090 developing process of that toolkit and sort of how it all 37 00:01:42,090 --> 00:01:44,828 began. So it began back in 2020 or middle 2020. 38 00:01:44,828 --> 00:01:47,880 I was doing an external penetration test against the 39 00:01:47,880 --> 00:01:48,713 customer. 40 00:01:48,713 --> 00:01:51,450 And one of the things we do when we do external testing is 41 00:01:51,450 --> 00:01:53,048 that we perform a password spraying attack, 42 00:01:53,048 --> 00:01:56,610 and most customers, they typically have Microsoft office. 43 00:01:56,610 --> 00:01:58,920 So I was going to do a password spraying attack against 44 00:01:58,920 --> 00:02:00,570 Microsoft office. 45 00:02:00,570 --> 00:02:01,440 In my mind, 46 00:02:01,440 --> 00:02:04,470 such an attack is split into three different modules. 47 00:02:04,470 --> 00:02:06,000 You have the integration phase, 48 00:02:06,000 --> 00:02:08,640 the spring phase and the ex filtration phase during 49 00:02:08,640 --> 00:02:10,290 integration, 50 00:02:10,290 --> 00:02:13,339 you'll try to identify as many possible email accounts, 51 00:02:13,339 --> 00:02:17,280 which would be linked to accounts in the actual client's 52 00:02:17,280 --> 00:02:21,018 tenant as possible. Typical resources are hunter IO, 53 00:02:21,018 --> 00:02:24,000 probably I'm guessing a lot of people heard about that. 54 00:02:24,000 --> 00:02:26,738 It's sort of a database that fesses and collects emails for 55 00:02:26,738 --> 00:02:28,048 company specifically. So you can go in, 56 00:02:28,048 --> 00:02:30,819 you look up the company name and you'll see the email and 57 00:02:30,819 --> 00:02:35,657 the email syntax. The email syntax is very important. 58 00:02:35,657 --> 00:02:38,051 We'll get back to that later. 59 00:02:38,051 --> 00:02:41,820 You also have the DHA service. 60 00:02:41,820 --> 00:02:45,690 Now DHA is a breach database lookup service, 61 00:02:45,690 --> 00:02:49,173 and all of these services sort of live in a weird gray area. 62 00:02:50,097 --> 00:02:53,040 And DHA has been stable for years. 63 00:02:53,040 --> 00:02:55,800 Sometimes they get taken down legal wise. 64 00:02:55,800 --> 00:02:57,390 I mean, if an attacker can get to it, 65 00:02:57,390 --> 00:02:59,290 I wanna know that information as well. 66 00:03:00,160 --> 00:03:03,300 So I consider that gray area fine to use in general. 67 00:03:03,300 --> 00:03:04,260 So DHA is great. 68 00:03:04,260 --> 00:03:07,920 You look up the client domain name and you'll be prompted 69 00:03:07,920 --> 00:03:09,960 with a bunch of emails that has been obtained from 70 00:03:09,960 --> 00:03:12,333 semi-public bridge databases. 71 00:03:13,800 --> 00:03:15,810 And then you have Google, right? 72 00:03:15,810 --> 00:03:18,120 Simple as that biggest search engine on the planet. 73 00:03:18,120 --> 00:03:21,739 You use something called Google direction in order to find 74 00:03:21,739 --> 00:03:24,280 files and other information related to the company. 75 00:03:24,280 --> 00:03:26,829 If you scrape meta information from those files, again, 76 00:03:26,829 --> 00:03:29,010 you'll have information about names and possible accounts 77 00:03:29,010 --> 00:03:31,080 linked within the company as well. 78 00:03:31,080 --> 00:03:34,170 And I think the biggest one out there linked in, right? 79 00:03:34,170 --> 00:03:36,090 and this goes back to the email syntax. 80 00:03:36,090 --> 00:03:37,890 If you have the email syntax of a company, 81 00:03:37,890 --> 00:03:41,851 if you know that the company uses first name dot last name 82 00:03:41,851 --> 00:03:43,429 for their email accounts, 83 00:03:43,429 --> 00:03:47,069 then that J.Jameson over at LinkedIn is gonna have James dot 84 00:03:47,069 --> 00:03:49,138 Jameson as email account. 85 00:03:49,138 --> 00:03:51,000 So if you put that together, 86 00:03:51,000 --> 00:03:53,430 you were able to come up with of a bigger list of possible 87 00:03:53,430 --> 00:03:55,749 email accounts with an tenant. 88 00:03:55,749 --> 00:03:58,950 So then you go over to the actual spraying phase where you 89 00:03:58,950 --> 00:04:02,460 pick out a shady password like summer 2022 exclamation 90 00:04:02,460 --> 00:04:06,149 mark, which everybody still uses, even though it's 2022, 91 00:04:06,149 --> 00:04:09,570 and you pick out a service, you want to hit that with. 92 00:04:09,570 --> 00:04:12,579 So typical ones are Microsoft office in the actual cloud, 93 00:04:12,579 --> 00:04:13,800 10 end office, 365. 94 00:04:13,800 --> 00:04:17,778 Then you have some customers that still expose ADFS. 95 00:04:17,778 --> 00:04:20,100 They have some sort of on premise applications. 96 00:04:20,100 --> 00:04:21,808 So they expose ADFS. 97 00:04:21,808 --> 00:04:25,470 You have clients exposing at the outlook of application, 98 00:04:25,470 --> 00:04:27,030 the exchange externally as well. 99 00:04:27,030 --> 00:04:28,920 And then you have the third party identity, 100 00:04:28,920 --> 00:04:31,678 extra management and SSO providers like Okta who sort of 101 00:04:31,678 --> 00:04:34,140 take over the Federation of the users. 102 00:04:34,140 --> 00:04:37,680 And then you can connect other services that apps into that. 103 00:04:37,680 --> 00:04:39,280 So you'll pick a target and you spray, right? 104 00:04:39,280 --> 00:04:41,720 And then hopefully you hit a bad, 105 00:04:41,720 --> 00:04:44,160 hit a user with a bad password and you get access to 106 00:04:44,160 --> 00:04:44,993 something. 107 00:04:44,993 --> 00:04:47,070 You get access to some sort of service on the inside that 108 00:04:47,070 --> 00:04:50,130 has some kind of data and you perform some sort of post 109 00:04:50,130 --> 00:04:52,699 exploitation activity, typically ex filtration. 110 00:04:52,699 --> 00:04:54,780 So this is what you do. 111 00:04:54,780 --> 00:04:57,900 And this is what I did and what I did it in this story. 112 00:04:57,900 --> 00:05:00,299 I got a user with a bad password and I tried to log in 113 00:05:00,299 --> 00:05:03,389 everywhere and I was prompted with MFA, right? 114 00:05:03,389 --> 00:05:06,330 I couldn't get in no matter what service, no, 115 00:05:06,330 --> 00:05:09,669 that application just got prompted with MFA except for one 116 00:05:09,669 --> 00:05:11,736 Microsoft teams. 117 00:05:11,736 --> 00:05:15,420 So when I logged to the logged into the Microsoft teams 118 00:05:15,420 --> 00:05:17,169 desktop, I was not prompted with MFA. 119 00:05:17,169 --> 00:05:19,440 And I initially thought this must be a bug. 120 00:05:19,440 --> 00:05:21,240 You must be something weird going on, 121 00:05:21,240 --> 00:05:23,280 but I tested it against that client and multiple other 122 00:05:23,280 --> 00:05:25,170 clients. And for some reason, 123 00:05:25,170 --> 00:05:28,170 they just had a major gap when it comes to the Microsoft 124 00:05:28,170 --> 00:05:29,488 team's desktop client. 125 00:05:29,488 --> 00:05:31,970 And this fell through because of conditional access. 126 00:05:31,970 --> 00:05:34,480 So conditional access is a service that Microsoft, 127 00:05:34,480 --> 00:05:38,659 that offers for its users in its tenants that allow you to 128 00:05:38,659 --> 00:05:41,531 define certain conditional that will give you access or not, 129 00:05:41,531 --> 00:05:42,869 hence conditional access. 130 00:05:42,869 --> 00:05:44,509 So say you try to log in from Europe. 131 00:05:44,509 --> 00:05:49,171 You won't get in because you log in from Europe and the 132 00:05:49,171 --> 00:05:52,020 company knows that we don't have any employees in Europe. 133 00:05:52,020 --> 00:05:54,420 So there's no reason to give you that access. 134 00:05:54,420 --> 00:05:56,850 Or if you log in from a trusted subnet internally, 135 00:05:56,850 --> 00:06:00,150 maybe they don't prompt you for MFA because why would you do 136 00:06:00,150 --> 00:06:01,290 on the internal network? Right? 137 00:06:01,290 --> 00:06:04,331 You're already pass the physical boundary. So sure. 138 00:06:04,331 --> 00:06:05,550 Let's just skip MFA as well. 139 00:06:05,550 --> 00:06:07,140 So in the case, 140 00:06:07,140 --> 00:06:09,750 I'm talking about they misconfigured their conditional 141 00:06:09,750 --> 00:06:12,529 access policy so that the Microsoft teams client could just 142 00:06:12,529 --> 00:06:13,437 get into that MFA. 143 00:06:13,437 --> 00:06:16,856 And in my hypothesis about this is that in the 144 00:06:16,856 --> 00:06:21,856 actual user interface where you define conditional access, 145 00:06:21,920 --> 00:06:25,880 there was some sort of user experience mixed up where they 146 00:06:25,880 --> 00:06:29,069 couldn't find the team's client checkbox or whatever, 147 00:06:29,069 --> 00:06:32,160 because I found this on multiple clients within a four 148 00:06:32,160 --> 00:06:34,080 months span, and then it just suddenly go away. 149 00:06:34,080 --> 00:06:37,219 So I don't know if that's happened or not just throwing it 150 00:06:37,219 --> 00:06:38,103 out there. 151 00:06:39,060 --> 00:06:41,193 Anyway, I got into teams at the time. 152 00:06:42,029 --> 00:06:44,033 I didn't understand that this was due to conditional access. 153 00:06:44,939 --> 00:06:45,930 So I started just digging into teams. 154 00:06:45,930 --> 00:06:48,240 I started reversing the API calls it made, 155 00:06:48,240 --> 00:06:51,390 and I started looking at the network traffic that generated 156 00:06:51,390 --> 00:06:54,148 and how it interacts with Microsoft resources online. 157 00:06:54,148 --> 00:06:57,659 And I don't know if you can see the actual text, 158 00:06:57,659 --> 00:06:59,880 but this is somehow what that looks like. 159 00:06:59,880 --> 00:07:03,939 So if you're ever planning to dive into the network flow of 160 00:07:03,939 --> 00:07:04,860 teams, 161 00:07:04,860 --> 00:07:07,819 there's two other processes that you gotta know about. 162 00:07:07,819 --> 00:07:09,299 And those are Microsoft AAD, 163 00:07:09,299 --> 00:07:11,411 broker plug in and background task host. 164 00:07:11,411 --> 00:07:15,360 If you do not capture the network traffic from these 165 00:07:15,360 --> 00:07:19,410 processes, you'll have access talking, access token, 166 00:07:19,410 --> 00:07:21,720 pairing out thin air, and you will loose hair. 167 00:07:21,720 --> 00:07:25,290 I can just tell you that because you nothing makes sense. 168 00:07:25,290 --> 00:07:28,509 But if you start capturing the network traffic from these 169 00:07:28,509 --> 00:07:29,678 processes, including teams, 170 00:07:29,678 --> 00:07:32,640 you'll start because of the full flow on how teams work and 171 00:07:32,640 --> 00:07:34,260 how it authenticates and what APIs it uses. 172 00:07:34,260 --> 00:07:36,880 So it starts off by authenticating as, 173 00:07:36,880 --> 00:07:39,330 and user towards the login.microsoftonline.com point 174 00:07:39,330 --> 00:07:41,299 federated by Microsoft. 175 00:07:41,299 --> 00:07:45,731 So does that, and then you get the access token back, 176 00:07:45,731 --> 00:07:48,829 what's called a V one formatted token, adjacent blob. 177 00:07:48,829 --> 00:07:52,131 And it's basically adjacent blob. It's your access token, 178 00:07:52,131 --> 00:07:53,459 your refresh token, 179 00:07:53,459 --> 00:07:56,480 your exploration time and information related to your access 180 00:07:56,480 --> 00:07:58,697 that access token gets put in two places. 181 00:07:58,697 --> 00:08:03,539 So it gets put in the SSO off cookie, 182 00:08:03,539 --> 00:08:07,110 and it gets put into a Heather called authorization with a 183 00:08:07,110 --> 00:08:08,250 prefix of bear, 184 00:08:08,250 --> 00:08:11,550 which is very typical and follows the only O off standard. 185 00:08:11,550 --> 00:08:15,120 And then something where it happens. So you guys know Skype, 186 00:08:15,120 --> 00:08:18,737 right? Which was supposed to die in like July 31st, 187 00:08:18,737 --> 00:08:21,660 20, 21 or something. Skype is alive. 188 00:08:21,660 --> 00:08:22,539 It just won't die. 189 00:08:22,539 --> 00:08:26,057 And teams knows this because it's fess a token called Skype 190 00:08:26,057 --> 00:08:29,720 token and reaches out to the teams of microsoft.com point 191 00:08:29,720 --> 00:08:32,988 gets the Skype token, puts that in a cookie and header, 192 00:08:32,988 --> 00:08:35,749 and then keeps talking to the teams API endpoint. 193 00:08:35,749 --> 00:08:40,749 So my best guess would be that the Skype API is alive and 194 00:08:40,770 --> 00:08:44,550 that is just racked behind the new modern teams API. 195 00:08:44,550 --> 00:08:46,799 So that's rather interesting, 196 00:08:46,799 --> 00:08:50,100 but this is the basic functionality that teams would need. 197 00:08:50,100 --> 00:08:53,171 Once it gots it got the access token and the Skype token, 198 00:08:53,171 --> 00:08:56,611 it could just access the basic teams resources. 199 00:08:56,611 --> 00:09:00,880 One thing I wanted to mention is that during this first 200 00:09:00,880 --> 00:09:04,139 authentication attempt teams specifies a client ID and it 201 00:09:04,139 --> 00:09:05,749 will become very important, 202 00:09:05,749 --> 00:09:09,658 but a client ID is basically a good string that defines the 203 00:09:09,658 --> 00:09:12,480 application, talking to the endpoint. 204 00:09:12,480 --> 00:09:15,960 So you have one default client ID supplied by Microsoft for 205 00:09:15,960 --> 00:09:16,860 teams, 206 00:09:16,860 --> 00:09:18,990 and then you have other client IDs for different other 207 00:09:18,990 --> 00:09:20,550 applications. And again, 208 00:09:20,550 --> 00:09:22,950 we'll come back to this later is very important. 209 00:09:23,939 --> 00:09:25,800 So yeah. 210 00:09:25,800 --> 00:09:28,449 So in preparation for this talk, I did this right. 211 00:09:28,449 --> 00:09:32,670 And I tried to replicate what I did back in November, 2020, 212 00:09:32,670 --> 00:09:34,410 but the results were different. 213 00:09:34,410 --> 00:09:37,740 Microsoft had changed something who would've known. Right? 214 00:09:37,740 --> 00:09:40,411 So when you do the initial access, 215 00:09:40,411 --> 00:09:44,720 you no longer get a JWT token in response in the classical 216 00:09:44,720 --> 00:09:47,280 Von format, adjacent structure, 217 00:09:47,280 --> 00:09:49,260 you get an encrypted string in return. 218 00:09:49,260 --> 00:09:52,170 That turns out to be a J w E string, 219 00:09:52,170 --> 00:09:56,730 which is a adjacent web encrypted string or plain text. 220 00:09:56,730 --> 00:09:59,760 And inside that encrypted plain text is the actual Levon 221 00:09:59,760 --> 00:10:01,503 formatted token, which we want. 222 00:10:02,640 --> 00:10:05,897 And if you actually decode the first X or so length of that 223 00:10:05,897 --> 00:10:09,656 string, you can actually basics before they code that. 224 00:10:09,656 --> 00:10:12,480 And you can find the encryption algorithm. 225 00:10:12,480 --> 00:10:15,787 That's used to be able to encrypt in the encrypted 226 00:10:15,787 --> 00:10:17,968 encrypted, but I don't wanna deal with that. 227 00:10:17,968 --> 00:10:20,228 That's just too much of a pain. So again, 228 00:10:20,228 --> 00:10:22,118 Microsoft changed something. 229 00:10:22,118 --> 00:10:24,000 They didn't break anything from me. 230 00:10:24,000 --> 00:10:25,320 The old method still works. 231 00:10:25,320 --> 00:10:28,470 This is sort of just going into a bit of a side quest here 232 00:10:28,470 --> 00:10:30,300 about why they would change this. 233 00:10:30,300 --> 00:10:33,000 So they changed their default authentication flow that was 234 00:10:33,000 --> 00:10:36,168 used before into something called an on behalf of flow, 235 00:10:36,168 --> 00:10:39,663 which is just different than uses the JWE. 236 00:10:41,400 --> 00:10:43,389 And if you read their documentation about this, 237 00:10:43,389 --> 00:10:47,580 they say that do not attempt to validate or read tokens for 238 00:10:47,580 --> 00:10:48,630 any RPA API. 239 00:10:48,630 --> 00:10:51,120 You don't own tokens from Microsoft services can use a 240 00:10:51,120 --> 00:10:54,040 special format that will not validate as a J w T. 241 00:10:54,040 --> 00:10:57,680 That sounds off the similar to what we just found. 242 00:10:57,680 --> 00:11:02,445 So threat challenge, I don't know, sounds like a challenge. 243 00:11:02,445 --> 00:11:04,394 That's what it sounds like. 244 00:11:04,394 --> 00:11:07,350 So if you take a look at the documentation again, 245 00:11:07,350 --> 00:11:10,260 we can see examples of the V one format at token. 246 00:11:10,260 --> 00:11:12,203 This is what it's supposed to look like. 247 00:11:13,074 --> 00:11:16,470 This is what it looked like before, and notice the V one, 248 00:11:16,470 --> 00:11:17,453 the 1.0, 249 00:11:17,453 --> 00:11:20,550 and then we go back to the request that is now changed. 250 00:11:20,550 --> 00:11:22,773 And we see this 2.0 1.02 point. 251 00:11:26,263 --> 00:11:28,127 Oh yeah. If you change that back, you're good to go again. 252 00:11:30,060 --> 00:11:34,320 So if you take the initial request and you just downgrade, 253 00:11:34,320 --> 00:11:36,960 you just change the parameter from 2.0 to 1.0, 254 00:11:36,960 --> 00:11:40,803 you will get the good old V one format, the talking back, 255 00:11:40,803 --> 00:11:42,563 and you can actually understand what's happening, 256 00:11:43,514 --> 00:11:46,293 which is quite fun. Sadly, we don't have time for this, 257 00:11:46,293 --> 00:11:47,126 this isn't what we're going to talk about. 258 00:11:48,444 --> 00:11:49,410 It's just sort of a side quest explaining that I was 259 00:11:51,091 --> 00:11:51,924 preparing for its talk and they changed stuff right before 260 00:11:53,992 --> 00:11:54,825 the talk. And it's still silly, but okay. 261 00:11:56,144 --> 00:11:57,713 Back to the main story. So we logged into teams, right? 262 00:11:59,114 --> 00:12:00,813 Teams got two access tokens, 263 00:12:00,813 --> 00:12:02,693 so they can now do basic functionality. 264 00:12:02,693 --> 00:12:04,085 This is set basic functionality. 265 00:12:04,085 --> 00:12:07,770 So we have the SHA module and you have the teams SHA module, 266 00:12:07,770 --> 00:12:11,205 which is teams, both reaching out to API endpoint, 267 00:12:11,205 --> 00:12:13,224 ending in microsoft.com. 268 00:12:13,224 --> 00:12:15,690 And then you have two other modules. 269 00:12:15,690 --> 00:12:19,704 You have the calendar and you have the files and files. 270 00:12:19,704 --> 00:12:22,869 That's one drive and calendar that's outlook. 271 00:12:22,869 --> 00:12:27,869 So how does teams access this without me logging in or 272 00:12:29,520 --> 00:12:32,490 accepting the redirect or anything like that just has access 273 00:12:32,490 --> 00:12:34,710 to it, which at the time was really interesting. 274 00:12:34,710 --> 00:12:37,173 So if you take a look at the effort traffic, 275 00:12:38,760 --> 00:12:41,730 you can actually see that it sets the ground type in the 276 00:12:41,730 --> 00:12:44,704 parameter as refresh token and supplies, 277 00:12:44,704 --> 00:12:48,205 the refresh token from the old resource specifies the new 278 00:12:48,205 --> 00:12:49,432 resource. 279 00:12:49,432 --> 00:12:52,500 And then you are able to go into that resource or get, 280 00:12:52,500 --> 00:12:55,650 and new access talking that can access that resource without 281 00:12:55,650 --> 00:12:57,593 doing an interactive signing again. 282 00:12:57,593 --> 00:12:59,993 And that's actually, so according to the, 283 00:12:59,993 --> 00:13:03,154 so Microsoft is bending the O off 2.0, specification, 284 00:13:03,154 --> 00:13:05,190 pretty hard here. They're just saying, nah, 285 00:13:05,190 --> 00:13:07,320 we don't wanna do like this specification. 286 00:13:07,320 --> 00:13:08,670 Isn't there for the reason. 287 00:13:09,605 --> 00:13:10,950 And they're bending it pretty hard because if you look at 288 00:13:12,504 --> 00:13:14,850 the scope there, that list of permissions is huge. 289 00:13:14,850 --> 00:13:17,610 And this is directly tied to the client idea that we talked 290 00:13:17,610 --> 00:13:19,233 about with teams. 291 00:13:19,233 --> 00:13:22,213 Every time the team's client accesses other resources using 292 00:13:22,213 --> 00:13:25,133 this technique uses using the refresh token grant type 293 00:13:25,133 --> 00:13:26,640 request. 294 00:13:26,640 --> 00:13:30,005 They just get a metric ton of scopes and permissions for as 295 00:13:30,005 --> 00:13:33,173 resource the team's client can send emails on your behalf. 296 00:13:33,173 --> 00:13:38,173 The team's client can read and write emails on your behalf 297 00:13:38,550 --> 00:13:40,650 from your outlook instance, 298 00:13:40,650 --> 00:13:44,335 which is very interesting and that refresh token request or 299 00:13:44,335 --> 00:13:45,514 that, and which we'll get back to, 300 00:13:45,514 --> 00:13:49,530 which is a non interactive sign on looks, 301 00:13:49,530 --> 00:13:50,363 something like this. 302 00:13:50,363 --> 00:13:53,130 So what happens is that to the team's client takes the 303 00:13:53,130 --> 00:13:55,620 access token that it original required. 304 00:13:55,620 --> 00:13:56,937 When you logged in typed in your password, 305 00:13:56,937 --> 00:14:00,213 you get an access token, and then it sends that backup, 306 00:14:00,213 --> 00:14:03,455 that actual access that's actual access token using the 307 00:14:03,455 --> 00:14:06,030 ground type refresh token. 308 00:14:06,030 --> 00:14:08,610 And it just gets in new access token for new resource. 309 00:14:08,610 --> 00:14:09,626 It's magic, it's absolutely magic. 310 00:14:09,626 --> 00:14:14,626 And this is a non interactive login. 311 00:14:14,880 --> 00:14:17,580 So there's two type of logins in Microsoft, AAD right, 312 00:14:17,580 --> 00:14:19,380 you have the interactive logins, 313 00:14:19,380 --> 00:14:21,600 and then you have the non interactive logins. 314 00:14:21,600 --> 00:14:23,910 If you go to the Azure portal, 315 00:14:23,910 --> 00:14:26,460 the AAD section of the Azure portal, 316 00:14:26,460 --> 00:14:28,440 and you go into users and sign, 317 00:14:28,440 --> 00:14:30,330 you can see two type of signin, again, 318 00:14:30,330 --> 00:14:33,737 non interactive signin and non interactive sign interactive 319 00:14:33,737 --> 00:14:37,080 signin are when users log in using password and user name or 320 00:14:37,080 --> 00:14:38,680 so other form of authentication, 321 00:14:39,660 --> 00:14:42,450 non interactive signings are when an application accesses 322 00:14:42,450 --> 00:14:45,393 other resources, just like team does teams does. 323 00:14:46,474 --> 00:14:48,173 And this is what that looks like. 324 00:14:48,173 --> 00:14:50,484 So you can see that the Microsoft teams' application is 325 00:14:50,484 --> 00:14:53,273 getting access to Microsoft graph on behalf of that user. 326 00:14:54,630 --> 00:14:56,283 And this is all very interesting. 327 00:14:57,146 --> 00:15:00,810 And just recently at troopers this year, 328 00:15:00,810 --> 00:15:03,420 some awesome individuals over at secure works, 329 00:15:03,420 --> 00:15:06,780 released the research called the family refresh tokens. 330 00:15:06,780 --> 00:15:11,604 I gotta get huge shout outs to Ryan from secure works that 331 00:15:11,604 --> 00:15:14,400 detect dev at Twitter, 332 00:15:14,400 --> 00:15:17,310 who helped me validate some of this and really his research 333 00:15:17,310 --> 00:15:19,855 sort of put words on what I saw at that time. 334 00:15:19,855 --> 00:15:23,850 And I know many other internal researchers also looked at 335 00:15:23,850 --> 00:15:24,963 this previously. 336 00:15:26,204 --> 00:15:31,055 So what family refresh tokens describes is not only that a 337 00:15:31,055 --> 00:15:32,705 refresh token for one application 338 00:15:33,655 --> 00:15:38,310 from different client IDs can refresh into other resources, 339 00:15:38,310 --> 00:15:42,030 but as you can also change the client ID and get even more 340 00:15:42,030 --> 00:15:45,333 resources for other applications, and I won't go into it, 341 00:15:46,594 --> 00:15:49,133 but I just take a look at this, read it 10 times, ingest it, 342 00:15:50,263 --> 00:15:51,143 right? 343 00:15:51,143 --> 00:15:51,976 It's one of those things you have to ingest multiple times. 344 00:15:53,855 --> 00:15:56,313 It's awesome. Absolutely amazing research. 345 00:15:56,313 --> 00:15:57,780 I can't wait to see what others will and what I probably 346 00:15:59,794 --> 00:16:00,690 will integrate into this toolkit as a result of this 347 00:16:02,404 --> 00:16:03,524 research as well. 348 00:16:03,524 --> 00:16:04,913 So no one going probably way too fast. 349 00:16:07,023 --> 00:16:07,913 So just to recap here, so we dive through teams, 350 00:16:09,834 --> 00:16:11,123 we understood the network traffic. We got the access tokens. 351 00:16:13,124 --> 00:16:14,430 We understand how teams refreshes its using its access token 352 00:16:16,204 --> 00:16:17,663 into all the resources using non interactive sign ins. 353 00:16:19,215 --> 00:16:20,573 How can we abuse this? What could possibly go wrong? 354 00:16:22,324 --> 00:16:24,990 So initially I started creating something called Azure 355 00:16:24,990 --> 00:16:27,040 active directory, authentication library, 356 00:16:28,095 --> 00:16:31,045 ADAL or sharp ADAL because ADAL already exists and it would 357 00:16:31,942 --> 00:16:33,423 be in the mindset. 358 00:16:33,423 --> 00:16:36,600 It would be a C sharp library that simply takes a use 359 00:16:36,600 --> 00:16:39,273 password or a session and just dumps everything, 360 00:16:40,124 --> 00:16:40,957 just ex filtrates all the data. Then it only did OneDrive. 361 00:16:40,957 --> 00:16:45,957 So you would give a use password to the application. 362 00:16:48,844 --> 00:16:50,190 It would just dump the dump as in actually download the 363 00:16:52,055 --> 00:16:54,215 entire OneDrive directory of the user. 364 00:16:54,215 --> 00:16:56,364 And it was designed for initial access. 365 00:16:56,364 --> 00:16:57,780 You could download files and you could take a look at 'em 366 00:16:59,463 --> 00:17:00,540 and possibly gain further access based on the contents of 367 00:17:02,253 --> 00:17:04,853 those files. But I didn't think it was good enough. 368 00:17:05,954 --> 00:17:07,524 I didn't think it was. 369 00:17:07,524 --> 00:17:09,540 I wanted it to be more of a wholesome toolkit that you could 370 00:17:11,074 --> 00:17:12,870 actually use from start to finish than just the data 371 00:17:14,495 --> 00:17:15,328 ex filtration part. 372 00:17:17,804 --> 00:17:20,594 And that's when I think Aldar helped me came up with the 373 00:17:20,594 --> 00:17:23,383 name team filtration and that's the actual tool kit that's 374 00:17:23,383 --> 00:17:24,844 being released today. 375 00:17:24,844 --> 00:17:26,861 And I will push the gear up once this talk is over. 376 00:17:26,861 --> 00:17:29,223 So team filtration is a C sharp application that is cross 377 00:17:29,223 --> 00:17:31,713 compiled. So it could be ran natively on Linux, 378 00:17:31,713 --> 00:17:33,750 Mac and windows that streamlines the whole, 379 00:17:33,750 --> 00:17:35,100 an integration spraying, 380 00:17:35,100 --> 00:17:38,550 ex filtration post expectation activities. 381 00:17:38,550 --> 00:17:41,850 When you're performing a attack against the Microsoft office 382 00:17:41,850 --> 00:17:43,050 365 cloud. 383 00:17:43,050 --> 00:17:44,940 And I'll, we're gonna talk way more about it, 384 00:17:44,940 --> 00:17:46,390 but some of the key features, 385 00:17:47,722 --> 00:17:48,555 and I know this text is probably way too small, 386 00:17:50,364 --> 00:17:51,330 but key features is that the infiltration is strictly 387 00:17:52,783 --> 00:17:54,314 database oriented. 388 00:17:54,314 --> 00:17:55,860 This means that you will not end up with 25 text files with 389 00:17:57,255 --> 00:17:58,088 different emails and different passwords and different 390 00:17:59,903 --> 00:18:02,913 combinations on your desktop. And you're done using it. 391 00:18:02,913 --> 00:18:04,975 It's all stored in the localized database, 392 00:18:04,975 --> 00:18:06,203 similar to crack app exec and very various other tools. 393 00:18:08,074 --> 00:18:11,044 And the plan with this was to automate and make the tool 394 00:18:11,044 --> 00:18:12,263 smart. So when you do initial integration, 395 00:18:13,364 --> 00:18:15,420 the tool knows what accounts what's valid from that initial 396 00:18:16,375 --> 00:18:17,933 integration attempt, and we store those in the database. 397 00:18:19,375 --> 00:18:20,208 So once you go over to spraying it, 398 00:18:21,392 --> 00:18:22,560 it already knows which accounts are valid and you can spray 399 00:18:24,463 --> 00:18:25,335 those. 400 00:18:25,335 --> 00:18:28,352 You don't need to provide a new set of list of user names. 401 00:18:28,352 --> 00:18:29,863 It's all stored the database. 402 00:18:29,863 --> 00:18:32,163 We'll talk more about it in the next slide. 403 00:18:32,163 --> 00:18:34,153 It also has fire product integration. 404 00:18:34,153 --> 00:18:34,986 So still the only viable sort of effective alternative 405 00:18:36,735 --> 00:18:38,880 against Azure smart lockout is just rotating IPS, 406 00:18:38,880 --> 00:18:41,130 which fire products does quite brilliantly. 407 00:18:41,130 --> 00:18:43,500 So it has built in fire pro integrations to make sure that 408 00:18:43,500 --> 00:18:46,890 every spraying attempt originates from a different IP, 409 00:18:46,890 --> 00:18:49,860 it has built in D has integration so that once you do the 410 00:18:49,860 --> 00:18:50,827 initial integration, it can simply just pull the records 411 00:18:50,827 --> 00:18:52,830 from DHA. 412 00:18:52,830 --> 00:18:56,023 You give it an API key and it could add it to the database 413 00:18:56,023 --> 00:18:57,690 that value as the main, as valid emails, 414 00:18:57,690 --> 00:18:59,742 it has pushover integration. 415 00:18:59,742 --> 00:19:01,920 So you can get alert to notifications when you compromise an 416 00:19:02,975 --> 00:19:04,103 account or when multiple accounts are locked out, 417 00:19:05,674 --> 00:19:08,604 it has automatic password generation in user integration 418 00:19:08,604 --> 00:19:11,160 will get more into that. But again, at least for me, 419 00:19:11,160 --> 00:19:12,975 I don't know about you guys, 420 00:19:12,975 --> 00:19:15,173 but every time you do an external spray, 421 00:19:15,173 --> 00:19:17,123 you have 40 or 50 passwords that you always go through. 422 00:19:18,294 --> 00:19:20,815 And there are almost, oh wow, I have search. 423 00:19:20,815 --> 00:19:23,280 And they are always the most common ones the summer, 424 00:19:23,280 --> 00:19:26,460 the months, the typical password, one to three, 425 00:19:26,460 --> 00:19:28,080 it's all the common stuff. 426 00:19:28,080 --> 00:19:31,560 So there's no point of having you generate that every time, 427 00:19:31,560 --> 00:19:34,044 depending on what time of the year it is, 428 00:19:34,044 --> 00:19:34,877 it could just do that for you. 429 00:19:36,462 --> 00:19:39,473 The same goes for user information. 430 00:19:39,473 --> 00:19:41,484 And we'll talk more about that, 431 00:19:41,484 --> 00:19:43,215 but it's basically just using brute, 432 00:19:43,215 --> 00:19:44,920 forcing users by using statistically likely use user names, 433 00:19:46,061 --> 00:19:48,306 which is a very common technique. 434 00:19:48,306 --> 00:19:50,215 And then sort of the bread and butter of the infiltration 435 00:19:50,215 --> 00:19:51,450 again, is the ex filtration capabilities. 436 00:19:51,450 --> 00:19:54,480 So once you compromise your user with infiltration, 437 00:19:54,480 --> 00:19:57,120 this is the data you can actually pull from that user. 438 00:19:57,120 --> 00:19:58,650 You can pull all the teams, 439 00:19:58,650 --> 00:20:01,680 chat logs and attachments as well as contact lists. 440 00:20:01,680 --> 00:20:02,700 So every chat, 441 00:20:02,700 --> 00:20:05,122 every message your user or your target has ever sent on 442 00:20:05,122 --> 00:20:05,955 teams, 443 00:20:05,955 --> 00:20:08,215 you can pull down and you can easily grip through locally on 444 00:20:08,215 --> 00:20:09,600 your machine. 445 00:20:09,600 --> 00:20:12,690 Same goes for drive every file the user has in it's one 446 00:20:12,690 --> 00:20:14,946 drive that includes both files. It has added at files. 447 00:20:14,946 --> 00:20:17,083 It has been shared or given access to, 448 00:20:17,083 --> 00:20:20,100 but in on drive you can pull down and take a look at same, 449 00:20:20,100 --> 00:20:21,600 goes for outlook, every email, 450 00:20:21,600 --> 00:20:24,000 as well as their attachments can be downloaded and took a 451 00:20:24,000 --> 00:20:25,620 look, take a look at, 452 00:20:25,620 --> 00:20:28,674 and then you have support through to pull data from the 453 00:20:28,674 --> 00:20:31,740 graph API, which is basically domain information, users, 454 00:20:31,740 --> 00:20:33,840 groups, and some basic talent information. 455 00:20:34,680 --> 00:20:37,920 And there's one module that I'm particularly excited to talk 456 00:20:37,920 --> 00:20:39,450 about. And that's the backdoor CLI, 457 00:20:39,450 --> 00:20:41,190 which we'll talk about and add demo at the end, 458 00:20:41,190 --> 00:20:42,870 which is really cool. 459 00:20:42,870 --> 00:20:45,840 Technically I don't want to claim MFI bypass or whatever, 460 00:20:45,840 --> 00:20:48,870 but the infiltration has the capabilities to enumerate the 461 00:20:48,870 --> 00:20:51,215 conditional access policy applied. 462 00:20:51,215 --> 00:20:53,430 Basically it BR forces using a bunch of client IDs and 463 00:20:53,430 --> 00:20:56,040 resources. And once it gets on the inside, 464 00:20:56,040 --> 00:20:58,200 it could try to refresh out again. 465 00:20:58,200 --> 00:21:01,560 So you only need one gap in your conditional access policy. 466 00:21:01,560 --> 00:21:03,044 Once you get in, 467 00:21:03,044 --> 00:21:05,520 you could refresh out on the inside using non interactive 468 00:21:06,514 --> 00:21:07,444 sun ends. 469 00:21:07,444 --> 00:21:09,653 And then yeah, I just heavily abuses refresh tokens. 470 00:21:11,730 --> 00:21:14,924 So this is sort of a simple explanation of how it works. 471 00:21:14,924 --> 00:21:17,786 So team infiltration has a centralized database that is 472 00:21:17,786 --> 00:21:19,860 stored on this. It uses light TB. 473 00:21:19,860 --> 00:21:21,960 Once you start using the iteration module, 474 00:21:21,960 --> 00:21:24,210 every time you find the valid email account, 475 00:21:24,210 --> 00:21:25,710 that data is stored in the database. 476 00:21:25,710 --> 00:21:29,455 So team infiltration is to aware of how many valued accounts 477 00:21:29,455 --> 00:21:30,288 you have enumerated. 478 00:21:30,288 --> 00:21:31,980 Once you go into the spraying module team, 479 00:21:33,615 --> 00:21:34,740 infiltration will automatically pull valued accounts from 480 00:21:37,306 --> 00:21:38,424 database and you spray them. 481 00:21:38,424 --> 00:21:40,346 It will keep track of when you sprayed, 482 00:21:40,346 --> 00:21:42,844 what password you sprayed, what the response was. 483 00:21:42,844 --> 00:21:43,860 If you have false positives during the enumeration phase and 484 00:21:45,415 --> 00:21:46,248 team infiltration finds this during the springing phase, 485 00:21:48,124 --> 00:21:49,554 it will correct for that. 486 00:21:49,554 --> 00:21:50,823 There's honestly so much logic in here though. 487 00:21:51,844 --> 00:21:52,677 I doesn't keep track of it anymore, 488 00:21:53,975 --> 00:21:55,373 but there's a lot of fun logic in here that really helps. 489 00:21:56,655 --> 00:21:58,380 And sort of, I feel makes this attack more modern than it. 490 00:21:58,380 --> 00:21:59,283 Usually again, 491 00:22:00,394 --> 00:22:02,970 you don't have to mess around with all these text files and 492 00:22:02,970 --> 00:22:04,220 then once you get access, 493 00:22:05,124 --> 00:22:07,744 hopefully team infiltration will store the access token to 494 00:22:07,744 --> 00:22:08,855 the data bill. 495 00:22:08,855 --> 00:22:10,710 It will keep track of multiple access tokens for different 496 00:22:11,593 --> 00:22:14,084 resources, so that once you're ready to ex filtrate, 497 00:22:14,084 --> 00:22:15,735 you won't sign in again, 498 00:22:15,735 --> 00:22:16,980 it will just use the access tokens you got when you 499 00:22:18,912 --> 00:22:21,984 successfully spray it and logged in the first time. 500 00:22:21,984 --> 00:22:23,074 So again, 501 00:22:23,074 --> 00:22:26,594 a bunch of logging in here that makes this auto automated 502 00:22:26,594 --> 00:22:27,804 and easy. 503 00:22:27,804 --> 00:22:30,594 Let's take a look at the integration module, 504 00:22:30,594 --> 00:22:31,946 what that looks like. 505 00:22:31,946 --> 00:22:34,434 So this is a picture of the help menu from team penetrate. 506 00:22:34,434 --> 00:22:36,305 It's rather massive within the integration module, 507 00:22:36,305 --> 00:22:38,055 you have different options. 508 00:22:38,055 --> 00:22:39,964 You specify, I think the non option ones, 509 00:22:39,964 --> 00:22:42,210 non optional ones are the dash dash domain one. 510 00:22:42,210 --> 00:22:44,100 And then you have to choose some sort of validation 511 00:22:44,100 --> 00:22:47,524 techniques. So you specify domain, let's say trust sec, 512 00:22:47,524 --> 00:22:49,283 dot com me for attack them. 513 00:22:49,283 --> 00:22:51,300 And then you choose a validation method. So out of the box, 514 00:22:51,300 --> 00:22:53,970 infiltration has three validation methods, 515 00:22:53,970 --> 00:22:54,933 validation methods, 516 00:22:56,175 --> 00:22:57,870 being methods of validating that the email accounts are 517 00:22:58,954 --> 00:23:00,484 actually valid. 518 00:23:00,484 --> 00:23:03,106 Some of them are passive. One of them are active, active, 519 00:23:03,106 --> 00:23:06,403 meaning that they actually show up at the client's endpoint. 520 00:23:06,403 --> 00:23:08,834 So if we take a look at validate login, 521 00:23:08,834 --> 00:23:10,223 that will just simply attempt to log in, 522 00:23:11,233 --> 00:23:12,713 and that will obviously show up in the tenant sign in logs, 523 00:23:15,052 --> 00:23:16,644 but that is the most 524 00:23:16,644 --> 00:23:17,873 accurate way of determining if the account is real, 525 00:23:19,289 --> 00:23:21,415 just attempting to log in, 526 00:23:21,415 --> 00:23:23,674 taking a look at a response it's real, or is it not. 527 00:23:23,674 --> 00:23:24,507 And then you have the validate MSL, 528 00:23:26,892 --> 00:23:28,234 which has been heavily abused for years now. 529 00:23:28,234 --> 00:23:31,143 It's the get credential type post method that everybody like 530 00:23:31,143 --> 00:23:33,210 most tool uses basically. 531 00:23:33,210 --> 00:23:35,910 And it is heavily rate limited and heavily. 532 00:23:35,910 --> 00:23:39,210 It starts to give out heavy amounts of false positives. 533 00:23:39,210 --> 00:23:41,160 And then there's validated teams. 534 00:23:41,160 --> 00:23:43,710 Now this is something that we've been using internally for 535 00:23:44,674 --> 00:23:45,923 quite a while. And I think somebody, 536 00:23:47,343 --> 00:23:49,324 I think I saw it becoming public or whatever, 537 00:23:49,324 --> 00:23:50,513 like half a year ago, eight months ago. 538 00:23:51,572 --> 00:23:52,920 And basically what the validated teams method does is that 539 00:23:52,920 --> 00:23:56,070 given a sacrificial 365 accounts, 540 00:23:56,070 --> 00:23:58,800 it will log in a turn to get to teams and then use the 541 00:23:58,800 --> 00:24:02,430 search functioning teams to look up users, cross tenants. 542 00:24:02,430 --> 00:24:04,920 Again, that depends on the tenant's configuration, 543 00:24:04,920 --> 00:24:07,230 but this is still extremely overpowered. 544 00:24:07,230 --> 00:24:10,170 You could easily do 300 lookup a second, 545 00:24:10,170 --> 00:24:12,990 a second without getting rate limited or giving maximum 546 00:24:12,990 --> 00:24:16,470 amounts of false positives. And then again, this is, yeah, 547 00:24:16,470 --> 00:24:18,690 that's sort of the main bread and butter for the iteration 548 00:24:18,690 --> 00:24:21,030 module. Being able to use validate teams, 549 00:24:21,030 --> 00:24:23,220 and then you can pull domains from dHash. 550 00:24:23,220 --> 00:24:25,470 You could supply your own list of user names. 551 00:24:26,332 --> 00:24:27,165 If you don't manual all since right. 552 00:24:28,543 --> 00:24:30,143 I don't wanna make it harsh. 553 00:24:30,143 --> 00:24:31,772 I just wanna make it a bit easier in action using some using 554 00:24:31,772 --> 00:24:34,101 statistically likely username. So there's this awesome GPO. 555 00:24:34,101 --> 00:24:36,823 I think I'll link it at the bottom. 556 00:24:36,823 --> 00:24:39,083 That's called statistically likely usernames and it contains 557 00:24:39,083 --> 00:24:43,383 multiple text files of common first names and last names in 558 00:24:43,383 --> 00:24:44,524 the us. 559 00:24:44,524 --> 00:24:47,772 So instead of doing the hard labor of finding targets 560 00:24:47,772 --> 00:24:51,720 online, you just brute force it. 561 00:24:51,720 --> 00:24:53,370 So team infiltration, 562 00:24:53,370 --> 00:24:56,160 given a domain and given the syntax will pull down, 563 00:24:56,160 --> 00:24:58,020 it will generate possible emails. 564 00:24:58,020 --> 00:25:01,410 It will brute force those emails again, just the validity of 565 00:25:01,410 --> 00:25:04,692 them, not logging in using the validate teams method. 566 00:25:04,692 --> 00:25:08,220 And this has proven to be extremely effective. 567 00:25:08,220 --> 00:25:10,443 And that's just what that looks like. 568 00:25:11,354 --> 00:25:12,810 Then you have the spraying module. 569 00:25:12,810 --> 00:25:14,970 So not gonna go through all of the options, 570 00:25:14,970 --> 00:25:18,314 but the spraying module does spraying and you have a bunch 571 00:25:18,314 --> 00:25:19,500 of different options to set it. 572 00:25:19,500 --> 00:25:22,080 So if you want to generate passwords only for seasons only 573 00:25:22,080 --> 00:25:25,103 for months, or if you only wanna use the common stuff, 574 00:25:25,103 --> 00:25:27,564 you can specify that and they will get very specifically, 575 00:25:27,564 --> 00:25:29,724 if you wanna supply your own password list, 576 00:25:29,724 --> 00:25:30,557 you can do that if you want. 577 00:25:31,792 --> 00:25:34,042 I don't think I've seen this anywhere else, 578 00:25:34,042 --> 00:25:36,563 but if you wanna hit the, I call it the us cloud. 579 00:25:36,563 --> 00:25:37,673 I I'm familiar with the exact name of it, 580 00:25:39,823 --> 00:25:42,120 but some Microsoft tenants are under the dot US domain, 581 00:25:42,120 --> 00:25:45,120 mostly most likely because their government and if you wanna 582 00:25:46,004 --> 00:25:48,203 brute force that, have to hit to do us domain. 583 00:25:48,203 --> 00:25:50,970 So there's also support for that as well as the AAD D 584 00:25:50,970 --> 00:25:54,514 technique that SecureWorks found that doesn't show up in 585 00:25:54,514 --> 00:25:57,060 logs and then you can define sleep, sleeping, 586 00:25:57,060 --> 00:26:00,284 sleep marks delay. You can get push notifications. 587 00:26:00,284 --> 00:26:01,117 You can force spraying, 588 00:26:02,952 --> 00:26:04,013 even though you get locked accounts in return. 589 00:26:05,943 --> 00:26:09,033 Yeah, I think the spraying module is pretty standard for, 590 00:26:09,033 --> 00:26:11,314 with everything else. 591 00:26:11,314 --> 00:26:12,147 So this is what it looks like you do dash spray. 592 00:26:13,612 --> 00:26:15,794 If you don't give it any parameters, 593 00:26:15,794 --> 00:26:17,772 it will set a default sleeping time. 594 00:26:17,772 --> 00:26:20,823 It will generate its passwords automatically and it'll start 595 00:26:20,823 --> 00:26:22,023 spraying. 596 00:26:22,023 --> 00:26:22,962 Then the ex filtration module. 597 00:26:22,962 --> 00:26:25,154 Now this is again the bread and butter of filtration, 598 00:26:25,154 --> 00:26:27,012 and there is multiple ways to get, 599 00:26:27,012 --> 00:26:29,072 just use the ex filtration module. So you have three 600 00:26:29,072 --> 00:26:29,932 Options. One, 601 00:26:29,932 --> 00:26:31,740 you could use the account that you compromised that should 602 00:26:32,754 --> 00:26:34,154 be in the database, use that, 603 00:26:34,154 --> 00:26:35,700 and it will just run it with no options. 604 00:26:35,700 --> 00:26:38,160 And it will allow you to pick what compromised account in 605 00:26:38,160 --> 00:26:40,740 the database you want to accelerate data from. 606 00:26:40,740 --> 00:26:43,080 You could supply your own username and password if you gain 607 00:26:43,080 --> 00:26:46,612 it from some other source and then you could also provide it 608 00:26:46,612 --> 00:26:47,529 the cookie. 609 00:26:49,332 --> 00:26:51,764 So I'll have a demo later where I'll demonstrate using that 610 00:26:51,764 --> 00:26:53,594 sort of in a red team scenario, 611 00:26:53,594 --> 00:26:55,532 where you already compromised the host and you wanna just 612 00:26:55,532 --> 00:26:58,371 pull the cookie so you can give the infiltration, 613 00:26:58,371 --> 00:27:01,447 the cookie, and it will use that to pull all the data, 614 00:27:01,447 --> 00:27:02,983 which is super handy. 615 00:27:02,983 --> 00:27:05,124 And then if you specify what sort of data you want to pull, 616 00:27:05,124 --> 00:27:07,383 you don't have to pull all the data at once. You could pull, 617 00:27:07,383 --> 00:27:08,892 if you just wanna pull AAD, 618 00:27:08,892 --> 00:27:10,764 or if you just wanna pull OneDrive, 619 00:27:10,764 --> 00:27:12,703 and then you can also dump out the tokens. 620 00:27:12,703 --> 00:27:14,732 If you want to use the tokens with other tools, 621 00:27:14,732 --> 00:27:16,703 because there are a bunch of other cool tools that you could 622 00:27:16,703 --> 00:27:18,052 use to access AAD. 623 00:27:18,052 --> 00:27:20,223 That's what that looks like. So this example, I said, 624 00:27:20,223 --> 00:27:22,522 I want to actually emails and I want to ex filtrate 625 00:27:22,522 --> 00:27:23,452 OneDrive. 626 00:27:23,452 --> 00:27:24,443 And it dumped the 28 emails from this test account. 627 00:27:25,684 --> 00:27:27,180 And it also dumped out the one directory and stored that to 628 00:27:27,180 --> 00:27:28,173 disk again. 629 00:27:29,063 --> 00:27:31,380 So it's really easy to grab through it and find it. 630 00:27:31,380 --> 00:27:33,132 And then there is another module that is included. 631 00:27:33,132 --> 00:27:34,971 That's called the database module. 632 00:27:34,971 --> 00:27:38,131 The database module is simply a way to make it easy for you 633 00:27:38,131 --> 00:27:40,292 when it comes to reporting. 634 00:27:40,292 --> 00:27:43,421 So the database module allows you to export information from 635 00:27:43,421 --> 00:27:45,212 the database that might be relevant. 636 00:27:45,212 --> 00:27:47,730 So you could get a full summary of when you started 637 00:27:47,730 --> 00:27:48,990 spraying, when you stopped spraying, 638 00:27:48,990 --> 00:27:51,782 what password you used when you did that spray, 639 00:27:51,782 --> 00:27:52,874 what user you target, 640 00:27:52,874 --> 00:27:55,080 what combination of user and password you used, 641 00:27:55,080 --> 00:27:57,284 all that fun stuff that a client might ask about. 642 00:27:57,284 --> 00:28:00,810 You can just pull that and you can put it out to Jason or CV 643 00:28:00,810 --> 00:28:03,434 and CVS, or you could just show within the terminal. 644 00:28:03,434 --> 00:28:05,684 Okay. I am way ahead of time. 645 00:28:05,684 --> 00:28:09,124 So let's do the demo one external testing. 646 00:28:09,124 --> 00:28:11,652 So this demo is just sort of a use case where you basically, 647 00:28:11,652 --> 00:28:14,356 my first use case, you're an external attacker. 648 00:28:14,356 --> 00:28:16,834 You want to password spray. And again, again, 649 00:28:16,834 --> 00:28:20,954 loot from attacking Microsoft office cloud. 650 00:28:20,954 --> 00:28:23,463 Let's see if I have that. 651 00:28:28,710 --> 00:28:29,670 Okay. Let's see. 652 00:28:29,670 --> 00:28:31,822 So this is a startup. 653 00:28:31,822 --> 00:28:33,503 So hopefully you can see the top portion there. 654 00:28:35,892 --> 00:28:37,463 So that's infiltration, 655 00:28:37,463 --> 00:28:41,634 I'm giving it an output path where I want the potential data 656 00:28:41,634 --> 00:28:43,811 that I gained from this store, 657 00:28:43,811 --> 00:28:47,023 as well as where the database will be stored. 658 00:28:47,023 --> 00:28:49,772 I'm giving it a configuration file. Every instance, 659 00:28:49,772 --> 00:28:52,823 every time you run the infiltration, 660 00:28:52,823 --> 00:28:55,892 you will need to give it a configuration file with standard 661 00:28:55,892 --> 00:28:56,725 one. 662 00:28:56,725 --> 00:28:59,491 Can't see the top portion. 663 00:28:59,491 --> 00:29:00,652 Oh, wow. 664 00:29:00,652 --> 00:29:02,943 Okay. Interesting. 665 00:29:02,943 --> 00:29:04,943 Two screens then, right? 666 00:29:06,804 --> 00:29:07,887 - Okay. It's. 667 00:29:12,780 --> 00:29:14,780 - Should have to get that on the screen. 668 00:29:16,484 --> 00:29:21,484 - We can try shutting down PowerPoint, 669 00:29:33,274 --> 00:29:35,594 but I don't wanna do that for 670 00:29:35,594 --> 00:29:40,594 could put two where's this play. 671 00:29:52,772 --> 00:29:54,383 - I'll probably break your setup, but. 672 00:29:56,004 --> 00:29:57,004 - There you. 673 00:29:58,242 --> 00:29:59,252 - Go. Why not? 674 00:29:59,252 --> 00:30:00,703 How about now? 675 00:30:00,703 --> 00:30:02,250 Awesome. Okay, cool. 676 00:30:02,250 --> 00:30:05,820 Okay. So yeah, so again, we're starting up the infiltration. 677 00:30:05,820 --> 00:30:07,500 You guys can see the command line at the top, right? 678 00:30:07,500 --> 00:30:09,350 You can see the actual command. Cool. 679 00:30:10,202 --> 00:30:11,213 Okay. So you have the output path, 680 00:30:12,252 --> 00:30:13,085 which is where you want to store all the data you 681 00:30:14,603 --> 00:30:17,063 potentially get from the infiltration attack and also where 682 00:30:17,063 --> 00:30:18,062 the database is. 683 00:30:18,062 --> 00:30:20,964 Storage you have to provide it adjacent configuration file 684 00:30:20,964 --> 00:30:23,520 with some values that the infiltration needs to run stuff 685 00:30:23,520 --> 00:30:27,034 like the fire proxy also want to use the de hashed API key 686 00:30:27,034 --> 00:30:28,890 you want to use and stuff like that. 687 00:30:28,890 --> 00:30:31,710 I'm telling you to go into generation module and that to 688 00:30:31,710 --> 00:30:34,620 take the use usernames for my own text file that I found 689 00:30:34,620 --> 00:30:36,810 using Osen right. 690 00:30:36,810 --> 00:30:38,073 And then I'm telling you, 691 00:30:39,012 --> 00:30:41,793 I want to validate these accounts using the validate login 692 00:30:41,793 --> 00:30:42,732 methods, 693 00:30:42,732 --> 00:30:45,034 which is technically just attempting to log in spraying 694 00:30:45,034 --> 00:30:47,223 basically right in the integration module. 695 00:30:48,074 --> 00:30:50,514 So we'll do that and we'll find a bunch of valid accounts. 696 00:30:50,514 --> 00:30:53,754 And then, so can you see the bottom one? 697 00:30:53,754 --> 00:30:57,412 And then I'll try to go straight into the spraying module. 698 00:30:57,412 --> 00:31:01,413 So now something is going to happen. It won't work. 699 00:31:03,383 --> 00:31:05,474 So I go spray and I type enter. 700 00:31:05,474 --> 00:31:06,307 And why doesn't it work? 701 00:31:07,943 --> 00:31:10,290 Because the integration method we just used attempted to log 702 00:31:11,292 --> 00:31:12,980 in. So I wanna make sure that you know, 703 00:31:14,412 --> 00:31:16,602 that you are now attempting a second route of login attempts 704 00:31:16,602 --> 00:31:17,435 and I'm stopping you unless you give it the dash force 705 00:31:18,543 --> 00:31:19,863 parameter. Again, 706 00:31:19,863 --> 00:31:21,323 this is logic that is possible because we have the database. 707 00:31:22,362 --> 00:31:25,492 I know when you're logging attempt was so I don't wanna risk 708 00:31:25,492 --> 00:31:27,473 you starting to lock out account. So I'm glad, Hey, sorry. 709 00:31:28,764 --> 00:31:29,903 You can't have to wait if you wanna keep spraying. 710 00:31:32,772 --> 00:31:35,553 So that's, what's happening here. 711 00:31:35,553 --> 00:31:39,983 It says sleeping the remaining 98 minutes since the last 712 00:31:39,983 --> 00:31:42,663 spray. And if I want to get around that, 713 00:31:42,663 --> 00:31:45,183 I have to use the dash force perimeter. 714 00:31:45,183 --> 00:31:46,016 And that's what I'll do at some point, 715 00:31:47,434 --> 00:31:49,044 here we go. 716 00:31:49,044 --> 00:31:51,330 And then it does the spray and then hopefully we'll have a 717 00:31:52,492 --> 00:31:54,159 compromised account. 718 00:31:57,714 --> 00:32:00,863 So there we go. So we have an account. 719 00:32:00,863 --> 00:32:03,063 It is the one and only BIF tan, 720 00:32:03,063 --> 00:32:05,434 who has the password of January 2022. 721 00:32:05,434 --> 00:32:07,612 And he doesn't have MFA. 722 00:32:07,612 --> 00:32:09,029 So we'll move on. 723 00:32:10,062 --> 00:32:11,483 Now. I can mean once you compromise the account, 724 00:32:12,394 --> 00:32:14,514 then sort of the easy part starts. 725 00:32:14,514 --> 00:32:15,720 So now we could just do dash dash xFi 726 00:32:18,000 --> 00:32:20,992 Kind of even knowing that we can't see the bottom line. 727 00:32:20,992 --> 00:32:21,964 Okay, I'll skip. 728 00:32:21,964 --> 00:32:24,123 So I did dash xFi, AAD, 729 00:32:24,123 --> 00:32:27,360 and OWA so AAD to pull the domain information from the graph 730 00:32:27,360 --> 00:32:29,460 API, as well as users in groups. 731 00:32:29,460 --> 00:32:32,310 And to be clear, that's all the users in the AAD tenant. 732 00:32:32,310 --> 00:32:34,470 I can pull once I got that access, right? 733 00:32:34,470 --> 00:32:37,500 And then dash O a to pull the emails. 734 00:32:37,500 --> 00:32:39,400 And now something interesting happens. 735 00:32:40,821 --> 00:32:42,870 What happens is that infiltration knows that you are pulling 736 00:32:44,452 --> 00:32:45,893 the AAD and it knows that those users, 737 00:32:47,034 --> 00:32:49,970 we might wanna spray them. 738 00:32:49,970 --> 00:32:53,612 So it takes the users from the AAD export and it puts them 739 00:32:53,612 --> 00:32:57,171 back into the database. So if you want to go back spraying, 740 00:32:57,171 --> 00:32:58,812 you can do that. 741 00:32:58,812 --> 00:33:02,261 So you now have all the users in the tenant automatically 742 00:33:02,261 --> 00:33:06,012 added to your database and you can start spraying them 743 00:33:06,012 --> 00:33:09,772 again, of quality of, of life improvements. 744 00:33:09,772 --> 00:33:11,623 So it got, you can see it here. 745 00:33:11,623 --> 00:33:13,772 It got 134 80 users pending those to the databases, 746 00:33:13,772 --> 00:33:14,954 solid users. 747 00:33:14,954 --> 00:33:16,972 And if we go into the directory, 748 00:33:16,972 --> 00:33:19,110 we can see that we should have a bunch of emails as well. 749 00:33:19,110 --> 00:33:22,290 So emails that you Excel using to infiltration are stored as 750 00:33:22,290 --> 00:33:25,020 HTML to sort of preserve the format. 751 00:33:25,020 --> 00:33:27,150 And then the attachments are stored in the separate 752 00:33:27,150 --> 00:33:30,270 directory, as well as you have a pure adjacent file. 753 00:33:30,270 --> 00:33:33,143 That's called all emails that will just have all the 754 00:33:33,143 --> 00:33:35,550 information as well, if you want to play with it. 755 00:33:35,550 --> 00:33:38,050 And that's the external penetration portion of the 756 00:33:40,250 --> 00:33:41,333 infiltration. 757 00:33:42,983 --> 00:33:44,316 - Oh, thank you. 758 00:33:46,194 --> 00:33:47,533 Thank you. 759 00:33:47,533 --> 00:33:49,173 - But that's so boring. 760 00:33:50,670 --> 00:33:53,620 We wanna do red teaming. Everybody wants to do red teaming. 761 00:33:54,600 --> 00:33:57,570 So let's show an example of red teaming. 762 00:33:57,570 --> 00:33:59,253 So this is the red team example. 763 00:34:00,660 --> 00:34:03,660 Please show up, here we go. 764 00:34:03,660 --> 00:34:04,863 And in this example, 765 00:34:06,692 --> 00:34:08,190 you have already compromised the host through fishing or 766 00:34:09,323 --> 00:34:10,156 whatever, 767 00:34:10,156 --> 00:34:11,310 and then you're on the host and you want to ex filtrate all 768 00:34:12,932 --> 00:34:14,243 the information without doing unnecessary stuff. 769 00:34:16,103 --> 00:34:18,083 So you're you dump the cookies through some method. 770 00:34:18,983 --> 00:34:20,333 In this example, I'm just using the c-sharp tool, 771 00:34:22,263 --> 00:34:23,633 sharp pro to dump out all the cookies from edge. 772 00:34:25,183 --> 00:34:26,700 So I'm just showing that I got an active session with Bruce 773 00:34:28,644 --> 00:34:29,970 Wayne and that I'm logged into teams and I'm logged into his 774 00:34:33,044 --> 00:34:34,033 outlook in the browser. 775 00:34:34,033 --> 00:34:36,633 I know he is Batman, and then I'll dump the cookies. 776 00:34:38,844 --> 00:34:40,764 I'll type it out just to show that we have adjacent file of 777 00:34:40,764 --> 00:34:42,143 cookies. 778 00:34:42,143 --> 00:34:43,650 That was a bit quick, 779 00:34:43,650 --> 00:34:45,513 but basically I'm just giving the infiltration that cookie 780 00:34:45,513 --> 00:34:47,372 dump, that text file full of cookies. 781 00:34:47,372 --> 00:34:49,320 I'm telling you to infiltrate all the loot and then as you 782 00:34:49,320 --> 00:34:51,970 be able to take that cookie file and do exactly that. 783 00:34:53,002 --> 00:34:54,720 So it starts refreshing into different resources and then 784 00:34:55,902 --> 00:34:57,113 it's dumping all the information. 785 00:34:59,743 --> 00:35:01,673 And now you get to see what the team chef looks like. 786 00:35:02,892 --> 00:35:06,003 So once it's done dumping, Got some sit files. 787 00:35:09,952 --> 00:35:11,004 I probably cancel this, right? 788 00:35:11,004 --> 00:35:12,583 No, I just leave it. 789 00:35:12,583 --> 00:35:14,674 So I go into the directory of the output, 790 00:35:14,674 --> 00:35:17,612 and then this is the information that this is what it looks 791 00:35:17,612 --> 00:35:18,445 like when it's dumped. So you can see attachments, contacts, 792 00:35:20,332 --> 00:35:21,165 conversations, email attachments, emails, one drive, one, 793 00:35:23,463 --> 00:35:25,634 I've shared tokens, all that good stuff. 794 00:35:25,634 --> 00:35:26,490 I go into conversations and this is the text files 795 00:35:28,084 --> 00:35:29,790 containing the raw Jason outbursts from the team's chat 796 00:35:31,143 --> 00:35:32,183 logs. 797 00:35:32,183 --> 00:35:33,990 So I can go into them and I can be trying to find the file. 798 00:35:33,990 --> 00:35:36,052 And I can see the conversation. 799 00:35:36,052 --> 00:35:38,280 I can see that Bruce Wayne started talking to oar at some 800 00:35:38,280 --> 00:35:41,670 point and said, hi, oar told him he was Batman. 801 00:35:41,670 --> 00:35:43,133 And that oar said, no, you're Batman. 802 00:35:44,812 --> 00:35:46,740 And this is great because you wouldn't believe how many 803 00:35:47,823 --> 00:35:48,656 passwords people put in teams. 804 00:35:49,543 --> 00:35:51,090 And it's so much easier to grip it out this way and than to 805 00:35:52,244 --> 00:35:54,270 scroll through the thing forever life quality of life 806 00:35:54,270 --> 00:35:55,370 improvement, for sure. 807 00:35:56,764 --> 00:35:57,852 Cool. 808 00:35:57,852 --> 00:36:00,060 And then emails one drive that files downloaded from the $1 809 00:36:00,060 --> 00:36:03,553 directory. It keeps the same structure, cool stuff. 810 00:36:05,303 --> 00:36:09,060 And that's the red team demo. 811 00:36:09,060 --> 00:36:12,582 And then I have one final surprise demo for you guys. 812 00:36:12,582 --> 00:36:13,523 It's the back door demo. 813 00:36:16,343 --> 00:36:17,176 And the thank you very much. 814 00:36:21,057 --> 00:36:23,250 And the backdoor demo is really interesting. 815 00:36:23,250 --> 00:36:26,982 So one of the things that is sort of a red team wet dream is 816 00:36:26,982 --> 00:36:29,282 that once you get initial access externally, 817 00:36:29,282 --> 00:36:31,680 you would like to move onto a host. 818 00:36:31,680 --> 00:36:35,844 You would like to vertically move onto a host. 819 00:36:35,844 --> 00:36:39,524 And how do you do that? Well, 820 00:36:39,524 --> 00:36:42,120 so we have control over OneDrive, right? 821 00:36:42,120 --> 00:36:44,193 OneDrive has a bunch of files. 822 00:36:45,714 --> 00:36:47,610 OneDrive files are usually synced to the computer of the 823 00:36:48,564 --> 00:36:49,954 individual. 824 00:36:49,954 --> 00:36:52,204 I don't talk about you guys, 825 00:36:52,204 --> 00:36:53,790 but how many here have seen the desktop folder been synced 826 00:36:53,790 --> 00:36:54,813 to OneDrive. 827 00:36:56,314 --> 00:36:57,492 Okay. Okay. 828 00:36:57,492 --> 00:37:00,092 It's not just me. That's a good thing. 829 00:37:00,092 --> 00:37:02,863 Well, what is in the desktop folder? 830 00:37:02,863 --> 00:37:05,052 A bunch of shortcuts. 831 00:37:05,052 --> 00:37:06,210 So I created this sort of CLI interface for OneDrive that 832 00:37:08,812 --> 00:37:11,692 allows you to modify and replace files within their OneDrive 833 00:37:11,692 --> 00:37:12,594 remotely. 834 00:37:12,594 --> 00:37:13,427 So you can backdoor their files on the desktop or in the 835 00:37:15,332 --> 00:37:16,343 documents folder. 836 00:37:16,343 --> 00:37:17,994 Okay. 837 00:37:17,994 --> 00:37:21,924 This is a bit longer than also what you're seeing right here 838 00:37:21,924 --> 00:37:23,383 is the perspective of the victim. 839 00:37:23,383 --> 00:37:26,634 He has his desktop and he has this Microsoft document that 840 00:37:26,634 --> 00:37:28,983 is his daily notes. 841 00:37:28,983 --> 00:37:32,273 He uses it every day to keep track of notes from his 842 00:37:32,273 --> 00:37:34,252 meetings or whatever else. 843 00:37:34,252 --> 00:37:37,383 So he has that same on drive. 844 00:37:37,383 --> 00:37:40,364 And then this is the attackers perspective. 845 00:37:40,364 --> 00:37:41,820 So in this example, 846 00:37:41,820 --> 00:37:45,284 we already compromised the account of that individual 847 00:37:45,284 --> 00:37:46,434 through whatever means. 848 00:37:48,210 --> 00:37:50,190 And we run the back to our module, 849 00:37:50,190 --> 00:37:53,804 the back module prompt you, Hey, what user do on to target? 850 00:37:53,804 --> 00:37:54,803 Because you might have multiple users. 851 00:37:55,983 --> 00:37:58,890 If you're lucky that we can target will pick out this and 852 00:37:58,890 --> 00:38:01,551 then geo infiltration will access wonder, 853 00:38:01,551 --> 00:38:03,772 and it will list out the files and folders in the route 854 00:38:03,772 --> 00:38:05,372 directory. 855 00:38:05,372 --> 00:38:08,124 And it will sort of give you a semi interactive CLI that you 856 00:38:08,124 --> 00:38:09,083 could use to navigate these files and folders, 857 00:38:10,462 --> 00:38:11,550 pick out the files and folders as you wanna download and 858 00:38:13,364 --> 00:38:14,343 replace them. 859 00:38:14,343 --> 00:38:16,200 So I see that the individual here has a daily notes filed 860 00:38:17,474 --> 00:38:19,403 and that it was very recently modified in my mind. 861 00:38:20,564 --> 00:38:22,222 That's a saying that, oh, 862 00:38:22,222 --> 00:38:24,583 he might open this tomorrow as well, 863 00:38:24,583 --> 00:38:27,004 or he might open it to coming weeks. 864 00:38:27,004 --> 00:38:29,370 So just typing the help, 865 00:38:29,370 --> 00:38:30,540 command to get some help and then I'll type replace the file 866 00:38:32,634 --> 00:38:33,467 index. And then the file I want to replace it with. 867 00:38:37,563 --> 00:38:39,823 So in this scenario, 868 00:38:39,823 --> 00:38:44,623 I have created a malicious macro document that I would like 869 00:38:44,623 --> 00:38:46,343 to replace his original document with. 870 00:38:46,343 --> 00:38:49,701 I'll use to replace command to do that index five copy path, 871 00:38:49,701 --> 00:38:51,804 and then go, and then infiltration will delete the file. 872 00:38:51,804 --> 00:38:53,644 Give it a few seconds, then upload it again. 873 00:38:53,644 --> 00:38:54,813 Now you will be amazed how effective this is. 874 00:38:55,903 --> 00:38:56,880 And you will also be amazed that there is no notification 875 00:38:58,703 --> 00:39:01,422 from one driver's perspective when you do it like this. 876 00:39:01,422 --> 00:39:04,263 So just look here, I'll swim in. 877 00:39:04,263 --> 00:39:08,443 And then suddenly it's a micro document. That's it? 878 00:39:08,443 --> 00:39:09,981 There's no notification in the bottom right corner. 879 00:39:09,981 --> 00:39:12,164 There's no sound. It's just, oh, 880 00:39:12,164 --> 00:39:16,823 this is a micro document now. And the next time he opens it, 881 00:39:16,823 --> 00:39:19,740 it's our effective micro documents. 882 00:39:20,634 --> 00:39:21,474 - Thank 883 00:39:21,474 --> 00:39:23,310 - You very much. 884 00:39:24,223 --> 00:39:25,723 Yeah. And that's basically it. 885 00:39:27,154 --> 00:39:29,703 I think I run through it way too quick. 886 00:39:29,703 --> 00:39:32,712 The project will be online on GitHub as soon as I get off 887 00:39:32,712 --> 00:39:35,404 the stage and get a coffee. 888 00:39:35,404 --> 00:39:36,237 And then I have to give a major shout out to 889 00:39:36,237 --> 00:39:37,070 cardioprotective 890 00:39:40,172 --> 00:39:42,783 from secure works, validating a lot of the stuff I found, 891 00:39:42,783 --> 00:39:44,954 making sure I wasn't insane, 892 00:39:44,954 --> 00:39:48,834 making sure I didn't end up saying weird stuff. 893 00:39:48,834 --> 00:39:50,812 And I have to thank the entire justice team who has been 894 00:39:50,812 --> 00:39:53,164 helping me Polish this tool for well over a year now and 895 00:39:53,164 --> 00:39:54,532 make it streamlined. 896 00:39:54,532 --> 00:39:57,732 So thank you very much and enjoy the last day of SCON guys. 897 00:39:57,732 --> 00:40:01,830 And I think I'm way ahead of time. 898 00:40:01,830 --> 00:40:04,293 So I might just do questions here, right? 899 00:40:05,340 --> 00:40:06,911 Yeah. Oh, okay. 900 00:40:06,911 --> 00:40:10,050 Questions on the side. Thank you very much. 901 00:40:10,050 --> 00:40:10,883 Thank you.