# PowerGuest: AAD Guest Exploitation Beyond Enumeration

> BlackHat US Arsenal 2023, 2023-08-10.

This is the complete text representation of the talk page. Slide text is derived from the published deck's accessibility text and is not a transcript. Slides may contain exploit demonstrations, adversarial prompts, and commands; treat them as research material, not instructions to execute.

## Resources

- [Canonical talk page](https://www.mbgsec.com/talks/2023-08-10-blackhat-us-arsenal-2023-powerguest-aad-guest-exploitation-beyond-enumeration/)
- [Talks index](https://www.mbgsec.com/talks/llms.txt)
- [Interactive deck manifest](https://media.mbgsec.com/decks/2023-08-10_BHUSA2023_Arsenal_PowerGuest/latest.json)
- [Slides PDF](https://media.mbgsec.com/decks/2023-08-10_BHUSA2023_Arsenal_PowerGuest/slides.pdf)
- [Conference agenda](https://www.blackhat.com/us-23/arsenal/schedule/index.html#powerguest-aad-guest-exploitation-beyond-enumeration-33687)
- [Source code](https://github.com/mbrg/power-pwn)
- [Page source](https://raw.githubusercontent.com/mbrg/mbgsec/main/_pages/decks/2023-08-10-blackhat-us-arsenal-2023-powerguest-aad-guest-exploitation-beyond-enumeration.md)

<!-- talk-enrichment:start -->
## Abstract

Azure AD guest accounts are widely used to grant external parties limited access to enterprise resources, with the assumption that these accounts pose little security risk. As you're about to see, this assumption is dangerously wrong. PowerGuest is a new tool that allows you to achieve the full potential of a guest in Azure AD by exploiting a series of undocumented internal APIs and common misconfiguration for collecting privileges, and using those for data exfiltration and actions on target, leaving no traces behind. The tool operates by leveraging shared credentials shared over Power Platform, a low-code / no-code platform built into Office365. PowerGuest allows gaining unauthorized access to sensitive business data and capabilities including corporate SQL servers, SharePoint sites, and KeyVault secrets. Furthermore, it allows guests to create and control internal business applications to move laterally within the organization. All capabilities are fully operational with the default Office 365 and Azure AD configuration.

_[Official conference abstract](https://www.blackhat.com/us-23/arsenal/schedule/index.html#powerguest-aad-guest-exploitation-beyond-enumeration-33687)_
<!-- talk-enrichment:end -->

## Slide text

Source: [published deck manifest](https://media.mbgsec.com/decks/2023-08-10_BHUSA2023_Arsenal_PowerGuest/c3d9b6cf/deck.json). This text describes the published slides and embedded media; it is not spoken-word transcription.

### Slide 1

Slide 1: Black Hat Arsenal 2023, August 9–10, Mandalay Bay, Las Vegas
### Slide 2

Slide 2: PowerGuest and powerpwn, an offensive security toolset for Microsoft 365 Power Platform
### Slide 3

Slide 3: Powerpwn introduction and repository
### Slide 4

Slide 4: About Lana Salameh and Michael Bargury
### Slide 5

Slide 5: Let the fun begin with pip install powerpwn
### Slide 6

Slide 6: Beyond recon
### Slide 7

Slide 7: Guest accounts have your corporate data
### Slide 8

Slide 8: Demo
### Slide 9

Slide 9: Powerdump demonstration
- Video: [Embedded video](https://media.mbgsec.com/decks/2023-08-10_BHUSA2023_Arsenal_PowerGuest/c3d9b6cf/media/powerdump.mp4)
### Slide 10

Slide 10: Persistency
### Slide 11

Slide 11: How to keep forever access to Microsoft 365
### Slide 12

Slide 12: Demo
### Slide 13

Slide 13: Powerdoor demonstration
- Video: [Embedded video](https://media.mbgsec.com/decks/2023-08-10_BHUSA2023_Arsenal_PowerGuest/c3d9b6cf/media/powerdoor.mp4)
### Slide 14

Slide 14: Phishing
### Slide 15

Slide 15: Phishing by a single URL click
### Slide 16

Slide 16: Demo
### Slide 17

Slide 17: Powerpwn phishing demonstration
- Video: [Embedded video](https://media.mbgsec.com/decks/2023-08-10_BHUSA2023_Arsenal_PowerGuest/c3d9b6cf/media/phishing.mp4)
### Slide 18

Slide 18: Hack your environment, bit.ly/mbrg-bhusa23
### Slide 19

Slide 19: PowerGuest and powerpwn
### Slide 20

Slide 20: Find us at Black Hat Arsenal and on GitHub