So the title is From Feature to Weapon, Breaking Microsoft Teams and SharePoint Integrity.
So, hello!
I'm Nestori, Dr. Nestori Sunimai from Finland, obviously.
This is our national team hockey shirt.
We are good at that.
And that's pretty much it.
And I work for CQWorks as a Senior Principal Security Researcher.
I've been doing that job for three and a half years now.
I'm on, well, social media.
So, Dr. Azure AD is the handle, so please follow me if you want to.
I might have like 15,000 followers if you do that, or even more.
Okay, I'm also Microsoft MVP.
Who knows what is MVP?
Yeah, so I'm MVP on security category, obviously.
That's why I'm here.
And I'm also Microsoft Most Valuable Researcher.
So I was able to secure that place like a third time in a row.
Okay.
And it's a nice bunch of people to be a member of.
Okay.
So, I think quite a lot of you know best me from my tool, A8 Internals.
Who has used that?
Okay.
Are you working for APT29?
Because they have done that too.
And, yeah, so basically it's just an admin hacking toolkit for Azure AD.
So that's the name, A8 Internals.
Which is funny because they changed the name.
So it's now EntraID.
So it's fucking great for a guy who handles his Azure AD and toolkit is A8 Internals.
Okay.
Yes, so today I'm going to demonstrate this tool to show some of the things I found.
But let's start.
So when my friend heard that I'm going to speak in DEF CON, he said that you need to have memes.
I was like, what is meme?
And then he explained me.
Okay.
So let's start.
So this is me speaking in, what was that?
It was Cloud Identity Summit, yes, like last year in Germany.
I was pointing some nice, really nice setting.
And this picture is taken by another MVP.
And then yet another MVP friend of mine saw that.
Is Olaf, by the way, here?
No?
So he said that that's a nice tip and also very good for meme.
Okay.
And then the guy said that we need to actually do the meme about this.
And now I have my own meme.
So now we can point things.
Okay.
Let's see.
Do I point anything today?
Okay.
So contents of the talk.
So who knows what is SharePoint?
Okay.
That's nice.
Very untypical.
Yes.
So for sure this thing that you put documents, you can do other things about that, but usually it's used for storing documents.
And it's one of the services in Microsoft 365, so it's just SharePoint Online.
But how many knew that also Teams is using SharePoint?
Okay.
That's also very untypical.
Because, yes, Teams, when you put a document in Teams,
it actually goes to SharePoint.
So it's kind of background service to store documents.
And also OneDrive is based on SharePoint technically.
So everything like SharePoint, then OneDrive, and then Teams, they are using the same thing like a technology on the background.
So what I'm going to talk about today is that, well, you know, the CIA, so we have the confidentiality, we have the availability, and then the integrity.
And I'm going to show you how you can break the integrity part.
Okay.
Of that triad with in SharePoint.
It's nice.
And I can see a couple of guys from Microsoft, so they are like doing this, all the types of high.
But you know this already.
So nothing new here.
Okay.
And, yes, so I'm presenting a stuff I found about six or seven months ago.
So I was doing a research project where I was trying to check all the different migration options you have to Microsoft 365.
Like SharePoint.
Like files, and then also like e-mails and stuff.
But I didn't find anything interesting anywhere else but from SharePoint.
So that's what I'm going to cover today.
And let's start.
So SharePoint Online, migration options.
So because I was studying migration, it's nice to have some options.
And we have three currently, what I know of.
And first is like migration manager.
And that's like a portal where you can, well, manage migration.
And what you are managing is actually an agent that is installed somewhere.
It's on server or whatever.
It depends what you are trying to migrate.
And technically, that is using the same code base as the second option called SharePoint migration tool.
So those two are using the same agent to do the migration.
And that's SPMT for short.
And the third one is cross-tenant one-time migration, which I don't know anything about.
So basically you should say that I want to migrate this to the other tenant.
Hit the enter and magic happens.
But today, we are talking about the middle one, which is that SharePoint migration tool.
And what is it?
So it's a free, easy-to-use option to help you migrate stuff to cloud.
And it supports migration to three things.
So SharePoint Online and OneDrive and Teams.
And where you can migrate from, well, of course, different kind of SharePoint servers.
But usually, people are migrating network shares.
But, of course, if you have some team site, you might want to, in on-prem, you might want to migrate that also to, like, Teams or SharePoint Online.
Okay.
Now, what's the process then?
So first, you need to install the tool.
Then you create a migration task.
And then you can monitor how it goes.
And then finally, you will see the report that what was migrated and whatnot.
So let's see how that works.
Has anybody used this ever?
SPMT?
Yeah, okay.
Some of you.
So this is no news to you.
So how this works.
So sorry, the print might be a bit small, but I'll just walk it through.
So basically, you start the tool, and you choose from where you want to copy stuff.
And we choose file set, and you provide the share.
And do you want to migrate everything or just that one?
So it can also do the sub.
Sub, folders, and the content.
And then where you want to copy stuff.
In this case, Teams.
Now we select which team.
And you can also select which channel where you want to put things.
And then you review, choose some options, and finally, you just wait.
Usually a lot of time.
Yeah.
So this is how the tool looks like.
And when the tool is working, it creates some temp files.
So we have the app data.
App data, roaming, Microsoft migration, tool storage.
And what we have here, we have the domain name of the target migration user.
We have a work folder.
There are some files.
We have migration task.
And then some database index files.
And finally, the interesting stuff is here.
So the stuff that is actually going to be sent to Cloud is right there.
And if we open that folder.
that's on the left side and then and then on the right side is the actual share folder
we can see well i can see you can see it's a small print but the file sizes are exactly the same but
the file names are different so on the right side we can see well there's some application file and
the left side it's just an kuid.dat and those files are encrypted
and when they are sent to cloud you also send well actually before you are technically how this tool
works is that it asks from sharepoint that give me an encryption key and then it will encrypt stuff
and then when you they are sent back to cloud cloud can then decrypt those with that key but
anyways they are encrypted and that was the data the actual files but then there's also metadata
and the most important file is manifest can you see it it's right there
and what is inside the manifest so basically you have two things that you
send to clouds so the files and then the manifest or metadata and the manifest is
the most important one and what is inside that well it's an xml who loves xml yeah nobody
but okay so we have the sp file object here and then we have the reference to that content file
so that so that dat file then we have a initialization vector for decrypting the file
content right and well what else we have well we have a matching sp list item so those who
know the how sharepoint works they usually also list items but for rest of you it doesn't matter
we don't
we are not interested on that one but what what else we can see here we can see timestamps
so that's metadata which is sent to cloud and it contains timestamps but it also contains author
okay so at this point what i did was that i implemented the same protocol to my tool
a18 internals and because i'm sending those files
those files which i selected but also this metadata which which i have full control of
it means that i have full control of metadata and i was like
excellent so what this means that i can create documents as any person
to that target site whether it's teams or onedrive or sharepoint and i can also replace files
and just make up the user who did that and the timestamp, so I have full control over that.
There's just one catch. You need to be an admin. And actually you need to be a site collection admin.
Now, it turns out that, well, who of you have ever created a team or whatever that's called?
Okay? So you are that admin. So the person who creates teams have those permissions required to do this.
And it's quite nice, for instance, so let's imagine that my boss would tell me that,
hey, Nestori, why don't you create a team site with our company traveling policy?
And I say, okay. Then I will create that and create a document as our CEO who said that I can always travel in first class.
That would be nice, right? Okay. So I have a demo.
So let's see how this works. So this is actually quite easy.
So we just create a new team. I always say teams, but team.
And let's create it from scratch. And we select private one so we don't invite anyone here.
And then I'm going to give it a name. And then I create the team.
And we don't want to, for demo, we don't want to invite anyone.
Okay. So now if we go to files and select the root folder here.
Because at that time when I recorded this video, that was the only option.
So we can see that this folder general was created by Diego Siciliani.
Well, maybe you can't see, but trust me, it's Diego Siciliani.
Who was the guy who created this.
And now I open it in SharePoint so that I can copy the URL also on a site.
And now I put this information in my tool.
And I am going to create the file as another user called Nestor W or Nestor Wilkie.
And the date should be 10 year past, in the past.
And when you download, upload this, it doesn't take that long.
But when you start the job, it can take anything from 10 seconds to 30 seconds.
Maybe 10 minutes.
So I have clicked a bit of this video.
Now, when I go back, back here, I refresh this and then go back to documents.
There should be another file.
Created by a totally different person and with a different time.
So this means that I can spoof documents.
And I can also tamper with existing documents.
And this kind of totally breaks the integration of the...
Well, every service is based on SharePoint.
Now, the most funny part is this.
So if you are creating file using SharePoint online, it will be stored in the backend database.
Well, at least a couple of...
Well, 20 years ago it used to be Microsoft SQL Server.
And also there will be entry and unified audit log.
But if you use this technique, you send it only to the backend database.
So there is no logging whatsoever.
But it's also quite interesting.
So let's...
I'll say it again.
So you can spoof and tamper with and there's no logs.
Sounds nice, right?
So I reported this to Microsoft in November last year.
And I told exactly this.
So that I found a way that such a normal guy who creates a team can do this.
And I kind of reported that.
It would be nice that the name of that guy who actually uploaded that file would be there somewhere.
But somehow they...
It seems to me that they understood that I was criticizing that migration API.
But no, it's working as intended.
So that was not my purpose.
But it's working.
Normal feature works as it should be.
But you can do bad things about that.
And they said that customers want to preserve metadata.
Yes, I understand that.
But there's no logging whatsoever.
So you can't know who did that actually.
And the last thing is that only SharePoint site collection admin can do this.
And they should...
They probably know what they are doing.
And that's what I am...
That's what I'm afraid of.
That they actually now know that.
But this is like by design.
Which in micro terminology means that they are not going to fix that.
So now you can do that also.
I am publishing my toolkit.
The newest version.
When I have a decent internet connection.
Which I don't have here.
So maybe on Monday when I'm back in Finland.
So that was that.
So now you can do that also quite easily.
So you can try this at home.
And let's see what people who are doing auditing.
They might not like that.
We can create files without no traces whatsoever.
So it's going to be interesting.
Let's say in this way.
Okay.
But that's not all.
Let's go to next generation.
So I continue studying this.
So what can I do with this?
So is it just uploading files and replacing ones?
Well, it is.
But bear with me.
So Google.
Who loves Google?
I do.
Who use Bing?
Okay.
Because one of my friends Samy Lai here used to say that you use Bing for search.
And Google for finding stuff.
So actually I was able to find a documentation about this.
So I just Googled the tag names of that manifest file.
And I found that there's a documentation.
And I saw that that applies to SharePoint online.
But also like on-prem SharePoint.
2016, 2019, 2013.
Whatever they are.
And not many of you might know that.
But I heard Doug passed a document.
As a SharePoint admin.
So this is actually dates from 2009.
So it's like 15 years ago.
So I passed two certifications.
So I'm certified on-prem SharePoint admin.
For server version 2007.
But the first one I ever worked with was from 2003.
So that's like 20 years ago.
Some of you weren't even born at that time.
So I'm that old.
Okay.
So what did I do?
I installed, of course, SharePoint server.
On-prem.
Have any of you done that before?
It takes a while.
But yeah, I managed to do that.
So luckily Microsoft has not put any money on updating SharePoint like on-prem.
So it still looks like the same.
Like almost 20 years ago.
And...
I also knew that that documentation I found, it was describing the XML of granular backup.
And which means that if you have the on-prem site, you can export the site or list.
And that's what I did here.
So I chose export site.
And in the upright hand corner, there's the site collection which I wanted to export.
And then you need to enter a name of that.
A backup file.
So the original file extension, what it's proposing is CMP.
I don't know what that means.
But technically it is CAB or cabinet file.
It's an Asian technology from 1990s.
So it's a kind of archive.
So you just rename that to CAB and then you can open that with Windows Explorer.
And here it is.
Nice.
So we have teamsite.cab.
And when I open that up, we can see stuff.
And we can see DAT files.
So that's stuff to be restored from this backup.
And we can also see that there's metadata.
And when I now open the manifest.xml, I saw that, well, it looks pretty much the same.
So we have the SP file here.
But I also noticed that there's a file called editform.aspx.
Now...
ASPX is 20 years old.
It uses old technology also.
It's called ActiveServe Pages Extended or something like that.
Has anybody used that?
Some of you?
Yeah.
So...
Yeah.
So I was like, okay.
You can actually restore these design elements.
And I was like, okay.
Me likey.
And conclusions and hypotheses about this finding was that...
SPMT is actually using this granular backup, technically.
And it also allows you to import any site content, including those ASPX files.
So that was my hypothesis.
And therefore, we can replace design files using this API.
And...
Yeah.
And we could actually do that.
However, in SharePoint Online, there's a thing called custom script.
So...
As an admin, you can edit those pages also.
If you have permission to do that.
Or you can insert a...
What is called script edit web part on a page.
And then you can add script there.
However, as it says that those are very bad things because that script can access everything
the user who is visiting that site can do.
Even beyond the SharePoint or Microsoft Graph integration.
That's not the question.
And for that reason, it is blocked by default.
So, you can't add any scripts there.
So...
Tenant level, which means the whole environment is prevented.
And also by each, like, site collection is also prevented.
And to turn those on, you need to be global admin.
Which is next to the guard in Microsoft Cloud.
Okay.
So...
Anyway.
So, if I still would be able to enter script there.
Could I do cross-site scripting?
Maybe.
So...
Modern browsers really don't allow doing this.
So, basically, it means that...
Like here.
So, if you are getting a script, like JavaScript file from this address, like SharePoint.com.
You can only call APIs.
APIs in the same domain.
So, you can make calls outside that, like to Outlook.com.
Even though that the user would have been logged in.
In another browser session.
But no.
Well, actually, technically you can.
But if you do that, there's no, like, session information or no cookies or anything.
So, they would be like anonymous calls.
But I knew that SharePoint, when you are accessing SharePoint, it can access your email, for instance.
And calendar and that kind of stuff.
And I was like, how that works then?
Because there's that same origin header which prevents JavaScript accessing other, like, domains.
So, it turned out that there's an internal API in each SharePoint site called sp.oauth.token slash acquire.
Where you can get access tokens.
But as you can see, it said that you should not communicate it directly with your solution.
But what if I do?
Well, it turned out that you can just ask access token to any resource which it is supporting.
Like here.
Can I have a token for graph.microsoft.com?
Yes, you can.
Here it is.
So, that actually allowed me to do, well, whatever I wanted to.
Whatever graph API allows users to do.
And if that user who will get this site would be, like, global admin.
You own the domain.
Okay.
Well, you own the Azure AD, not the domain.
But, yes.
Okay.
But I found out that if you have prevented using the custom script, you can do that using SharePoint online.
No SharePoint designer.
Which is a designer from ten years ago.
But it still works.
But with this, you can bypass that.
So, you can prevent that.
And that's also funny.
Okay.
So, a little story before the demo.
So, when I was recording demos for this talk, I noticed that it didn't work anymore.
So, I had to use, well, I thought that it didn't work, actually.
It did work, but I thought that it didn't.
So, I actually had to use video.
Which I actually originally sent to MSRC.
So, it's very fine print.
And there's even me talking.
But I covered myself with the pirate flag.
So, you don't see me.
But I'm going to walk you through what happens here.
So, in this demo, I modify the ASPX file of documents folder.
And I insert code there.
And what that code does is, well, you'll see.
So, let's start.
I hope this demo works now.
Yes.
So, on the upper right-hand side, we have the attacker.
Who has created the team site.
And his name is Diego Siciliani.
And then we have the victim.
Below that.
And he's Nestor Vilk.
Or Vilki.
I don't know how to pronounce that.
Even though I've done this for years.
But I still don't know.
How to pronounce that name.
But you can't pronounce mine.
So, it's a fair deal.
Okay.
So, this is just to show that we are at the same team correctly.
And now, what we need to do is that we first need to have the site collection name.
So, I'm going to open this in SharePoint.
And now, what we're going to do is that we're going to replace that all items.ASPX file.
But for that, I need that site name.
And that site name is actually quite boring.
It's a very long URL.
And then I'm going to start my tool here.
And first, I need to get an access token to use that.
So, I'm going to type there get access token for that service.
Sorry.
This is going to take a little time.
But there's a lot of typos and stuff.
But, yes.
So, it pops up a window where I just need to type my credentials, the attacker's credentials.
And again, this is just a standard user who created the team.
So, no admin rights here.
And then we're going to provide the password.
And just for demonstration purposes, there's no MFA, but you should always enable that.
And now, we have the access token.
And then, first thing, what we need to do is to download that file, that ASPX file.
And that's also neat that you can actually download these elements from SharePoint online.
I don't know what's the purpose of that, but you can do that.
So, there's a comment for that.
We provide the site name.
And then what you can see is under that or behind that download all items stuff.
But then you're going to provide the path of that file.
So, site name and then the file name inside that site collection.
And that should do it.
And now it says that file saved to all items.ASPX.
And then you can open that file in your favorite editor.
And mine is Notepad++.
So, that's the file.
And I just drop it in Notepad.
And here you can see, well, it's a fine print, but it's just an ASPX file.
So, it's pretty much a template file referring other template files and so on.
But I can paste code here.
So, my attacker code is right here.
I'm going to paste that.
Save that.
And then I'm going to send it back.
And it's actually interesting that when you download that file, there will be a log entry.
But when you update that, there's none.
So, pretty much the same thing, but a different direction.
So, I need to update AD in SPO file.
And again, when this starts, it can take anything from 10 seconds to 10 minutes.
So, that's also one thing I don't want to do this like.
That's a live demo.
Because it might take an hour or 10 minutes.
So, it's better this way.
Okay.
So, now I'll just hit enter.
And you can see some stuff going on in there.
So, it sent the files, created the metadata file.
And then it's going to start pulling that when the job is done.
And it took like six or seven minutes in this case.
And now it's there.
And the next thing is that now we need to get the victim to visit that site.
So, let's do that.
But let's move the attacker window to the left before that.
And then I'm going to open the Outlook tab so that we can see if there's any email.
Yeah.
And now we're going to choose the other window and emulate that.
Now we have somehow lured the victim to visit our site.
And actually, my POC, it kind of...
Brokes this because it says that you can read that.
But actually, you can.
You just need to type in the correct URL.
Like that.
And now when the victim visits the documents, it runs the code.
And what the code does, it gets first the access token to Graph API.
And then it loops through all the...
The victim's OneDrive documents and shares them with the attacker.
And now they should be dropping like mails in attacker mailbox that, hey, this guy shared the file with you.
So, this way you can get access to pretty much any documentation you want.
So, everybody who visits that page, you can run that code as that user.
So, quite neat, right?
And yes.
So, that was the demo.
So, you could actually use the same technique so that you can run whatever code you want to.
And you can also use like Graph API, so not just the SharePoint.
So, quite nice, right?
So, I reported this to Microsoft.
And just a recap.
I reported that you can spoof documentation or documents.
You can tamper with them.
And they were in design.
And now when I was reporting this to Microsoft,
this XSS attack, they said that, okay, that's spoofing.
And I was like, what the hell is this?
But we had a discussion with them.
And at that time, they were just categorizing everything like this spoofing.
Now it's a bit different.
Okay.
Okay, now back to the story.
So, when I was starting to record demos for this talk, I noticed that it didn't work anymore.
And this is the error I got.
So, I was not able to get an access to it anymore from that API, I told.
That was part of every, like, SharePoint site collection.
And it says that you are missing a refresh token.
Well, actually, that wasn't the fix at all.
So, but anyway, I asked from Microsoft, what is the status of this fix?
So, is it already fixed?
Because I saw something that it could be.
And they said, yeah, it's actually fixed.
I was, okay, fine.
But when I was playing around, it turned out that I just had to visit to some other SharePoint site.
SharePoint page before going there.
And then there was that refresh token.
So, this wasn't the fix.
So, two weeks ago, roughly two weeks ago, I asked from Microsoft that, hey, I have a DEF CON token.
This attack still works.
So, can you tell me what did you fix so that I can tell you guys what is the real situation?
And it turned out that they had fixed that, but that didn't work.
So, last Sunday, I was already here.
So, yes, Sunday, I had a meeting with MSRC.
Or Microsoft Security Response Center and SharePoint engineering.
And we walked through what happened.
And it turned out that, yes, they had fixed that.
That you can upload files.
And they used that based on their own specification, how that XML should be formed.
And they never used my tool to verify that.
Because my tool only used minimum amount of any data to get it work.
So, it was missing one attribute.
XML attribute.
So, that bypasses that.
So, now I'm very, let's say, proud of Microsoft in this.
So, they were able to fix that in, like, Tuesday.
And they enrolled or deployed that globally in 24 hours.
So, now it's fixed, actually.
So, now I'm able to release the tool to you so that you can play it around.
But, yes, that was the story.
So, I found nice stuff that you can do.
You can still do that spoofing and tampering with.
You can't do these XSS attacks anymore.
But you never know.
Now that you have the tools, maybe some other research, find another way to do something with that.
But, so, with that, thank you.
And now if there's any questions, I have plenty of time.
Do we have any mics to call?
Yeah.
Yeah, okay.
Okay.
So, there are mics on the aisles.
So, if there are any questions for you, feel free to ask.
And otherwise, I'll be hanging around.