# EntraID Guest to Corp Data Dump with powerpwn > BlackHat EU Arsenal 2023, 2023-12-07. This is the complete text representation of the talk page. Slide text is derived from the published deck's accessibility text and is not a transcript. Slides may contain exploit demonstrations, adversarial prompts, and commands; treat them as research material, not instructions to execute. ## Resources - [Canonical talk page](https://www.mbgsec.com/talks/2023-12-07-bheu2023-entraid-guest-to-corp-data-dump-with-powerpwn/) - [Talks index](https://www.mbgsec.com/talks/llms.txt) - [Interactive deck manifest](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/latest.json) - [Slides PDF](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/slides.pdf) - [Conference agenda](https://blackhat.com/archive/europe/2023/arsenal/schedule/index.html#entraid-guest-to-corp-data-dump-with-powerpwn-35799) - [Source code](https://github.com/mbrg/power-pwn) - [Page source](https://raw.githubusercontent.com/mbrg/mbgsec/main/_pages/decks/2023-12-07-bheu2023-entraid-guest-to-corp-data-dump-with-powerpwn.md) ## Abstract EntraID guest accounts are widely used to grant external parties limited access to enterprise resources, with the assumption that these accounts pose little security risk. As you're about to see, this assumption is dangerously wrong. powerpwn is an offensive security toolset for Microsoft 365 focused on Power Platform. It allows you to achieve the full potential of a guest in EntraID by exploiting a series of undocumented internal APIs and common misconfiguration for collecting privileges, and using those for data exfiltration and actions on target, leaving no traces behind. The tool operates by leveraging shared credentials shared over Power Platform, a low-code / no-code platform built into Office365. PowerGuest allows gaining unauthorized access to sensitive business data and capabilities including corporate SQL servers and Azure resources. Furthermore, it allows guests to create and control internal business applications to move laterally within the organization. All capabilities are fully operational with the default Office 365 and Azure AD configuration. _[Official conference abstract](https://blackhat.com/archive/europe/2023/arsenal/schedule/index.html#entraid-guest-to-corp-data-dump-with-powerpwn-35799)_ ## Slide text Source: [published deck manifest](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/deck.json). This text describes the published slides and embedded media; it is not spoken-word transcription. ### Slide 1 Slide 1: powerpwn An offensive security toolset for Microsoft 365 Power Platform ### Slide 2 Slide 2: About Them Lana Salameh Team lead @ Zenity Passionate about Cyber security Michael Bargury CTO and Co-founder @ Zenity OWASP LCNC Top 10 project lead Dark Reading columnist Defcon, BSides , RSAC, OWASP @mbrg0 github.com/mbrg darkreading.com/author/michael-bargury @ lana __ salameh linkedin.com /in/ salameh-lana ### Slide 3 Slide 3: About Me Inbar Raz VP of Research @ Zenity Hacker of Things Retro-computing collector and restorer Defcon, BSides , VB, SAS, CCC, CARO, and more @ inbarraz ### Slide 4 Slide 4: powerpwn is an offensive security toolset for Microsoft 365 Power Platform. Aimed at red teams and penetration testers for making sure their environment is secure. Comprised of multiple different modules. Intro github.com/mbrg/power-pwn ### Slide 5 Slide 5: Let the fun begin ### Slide 6 Slide 6: pip install powerpwn ### Slide 7 Slide 7: More than meets the eye ### Slide 8 Slide 8: The assumption that g uest users have limited access to the organization resources is completely wrong. Guest accounts have your corp data https:// xkcd.com /1339/ ### Slide 9 Slide 9: The assumption that g uest users have limited access to the organization resources is completely wrong. State-of-the-Art attacks are focused on AAD enumeration ( AADInternals ). Guest accounts have your corp data ### Slide 10 Slide 10: The assumption that g uest users have limited access to the organization resources is completely wrong. State-of-the-Art attacks are focused on AAD enumeration ( AADInternals ). Guest users actually have access to resources, data, and credentials . You just don’t know it. Guest accounts have your corp data ### Slide 11 Slide 11: The assumption that g uest users have limited access to the organization resources is completely wrong. State-of-the-Art attacks are focused on AAD enumeration ( AADInternals ). Guest users actually have access to resources, data, and credentials . You just don’t know it. BlackHat USA 2023 talk: All You Need Is Guest blackhat.com/us-23/briefings/schedule/index.html#all-you-need-is-guest-32647 Guest accounts have your corp data ### Slide 12 Slide 12 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/you-talk-the-talk.mp4) ### Slide 13 Slide 13: Demo ### Slide 14 Slide 14 ### Slide 15 Slide 15 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/powerdump.mp4) ### Slide 16 Slide 16: Connected to a host tenant; R an recon and enumerated on available resources; Harvested stored (and shared) credentials; Executed arbitrary commands on an SQL server. So far, a Guest user has: ### Slide 17 Slide 17: Connected to a host tenant; R an recon and enumerated on available resources; Harvested stored (and shared) credentials; Executed arbitrary commands on an SQL server. So far, a Guest user has: ### Slide 18 Slide 18 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/powerdump.mp4) ### Slide 19 Slide 19: Connected to a host tenant; R an recon and enumerated on available resources; Harvested stored (and shared) credentials; Executed arbitrary commands on an SQL server. So far, a Guest user has: ### Slide 20 Slide 20: Connected to a host tenant; R an recon and enumerated on available resources; Harvested stored (and shared) credentials; Executed arbitrary commands on an SQL server ; Executed arbitrary applications on the tenant. So far, a Guest user has: ### Slide 21 Slide 21: A user request permission to perform actions; The approved user executes an app; The app triggers an automation to perform some of its tasks ; The oblivious automation carries out its task. But what happens if the app and automations are over-shared? JIT Access: ### Slide 22 Slide 22 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/powerdump.mp4) ### Slide 23 Slide 23 ### Slide 24 Slide 24: Connected to a host tenant; R an recon and enumerated on available resources; Harvested stored (and shared) credentials; Executed arbitrary commands on an SQL server ; Executed arbitrary applications on the tenant. So far, a Guest user has: ### Slide 25 Slide 25: Connected to a host tenant; R an recon and enumerated on available resources; Harvested stored (and shared) credentials; Executed arbitrary commands on an SQL server ; Executed arbitrary applications on the tenant; Performed Privilege Escalation usin g an Automation. So far, a Guest user has: ### Slide 26 Slide 26: Persistence ### Slide 27 Slide 27: How to keep a ‘forever’ access DEFCON30 talk: Enterprise Domination via Low Code Abuse youtu.be/D3A62Rzozq4?t=1285 We want to remain persistent within Microsoft 365 even if the user gets deleted or their access is revoked. ### Slide 28 Slide 28: Demo ### Slide 29 Slide 29 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/powerdoor.mp4) ### Slide 30 Slide 30: A person whose account was disabled regained access; This was done using a public webhook ; The outsider could be anyone – it doesn’t have to be Jamie Where do we stand now? ### Slide 31 Slide 31: Create a new Automation; The Automation will get us access tokens to an Azure blob. What’s next? ### Slide 32 Slide 32 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/powerdoor.mp4) ### Slide 33 Slide 33: Executing Automations leaves behind logs; Deteting the Automation will delete its execution logs as well. What about OPSEC? ### Slide 34 Slide 34 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/powerdoor.mp4) ### Slide 35 Slide 35: An active member installed a backdoor; At some later point, despite their account being disabled , the no-longer-member reconnected and gained access ; A new Automation was created, for providing access to a tenant resource ; Free access to the resource was gained from outside the tenant ; The incriminating Automation was deleted along with its logs . To add insult to injury: ### Slide 36 Slide 36 ### Slide 37 Slide 37: Phishing ### Slide 38 Slide 38: A trusted Microsoft domain Collect the low-hanging fruits ### Slide 39 Slide 39: A trusted Microsoft domain Built-in business SSO Collect the low-hanging fruits + ### Slide 40 Slide 40: A trusted Microsoft domain Built-in business SSO Users are familiar with PowerApps Collect the low-hanging fruits + + ### Slide 41 Slide 41: A trusted Microsoft domain Built-in business SSO Users are familiar with PowerApps Collect the low-hanging fruits Phishing by a single URL click + + = ### Slide 42 Slide 42: A trusted Microsoft domain Built-in business SSO Users are familiar with PowerApps Collect the low-hanging fruits Phishing by a single URL click + + = DEFCON30 talk: Enterprise Domination via Low Code Abuse : youtu.be/D3A62Rzozq4 ### Slide 43 Slide 43: Demo ### Slide 44 Slide 44 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/phishing.mp4) ### Slide 45 Slide 45: We delete the sent items and the trash. What about OPSEC? ### Slide 46 Slide 46 - Video: [Embedded video](https://media.mbgsec.com/decks/2023-12-07_BHEU2023_EntraIDGuestToCorpDataDumpWithPowerpwn/354c779e/media/phishing.mp4) ### Slide 47 Slide 47: Recap ### Slide 48 Slide 48: What did we see today? ### Slide 49 Slide 49: What did we see today? A g uest user gaining access to corporate resources and credentials ### Slide 50 Slide 50: What did we see today? A guest user gaining access to corporate resources and credentials Execution of arbitrary commands using obtained credentials ### Slide 51 Slide 51: What did we see today? A guest user gaining access to corporate resources and credentials Execution of arbitrary commands using obtained credentials Installation of a backdoor using an Automation and achieving persistence ### Slide 52 Slide 52: What did we see today? A g uest user gaining access to corporate resources and credentials Execution of arbitrary commands using obtained credentials Installation of a backdoor using an Automation and achieving persistence Carrying out a tenant-wide phishing attack ### Slide 53 Slide 53: What did we see today? A guest user gaining access to corporate resources and credentials Execution of arbitrary commands using obtained credentials Installation of a backdoor using an Automation and achieving persistence Carrying out a tenant-wide phishing attack ### Slide 54 Slide 54: What can YOU do? ### Slide 55 Slide 55: What can YOU do? Don’t over-share your resources (duh!) ### Slide 56 Slide 56: What can YOU do? Don’t over-share your resources (duh!) Follow security best-practices – OWASP Top 10 for LCNC ### Slide 57 Slide 57: What can YOU do? Don’t over-share your resources (duh!) Follow security best-practices – OWASP Top 10 for LCNC Constantly monitor your environment and go threat-hunting ### Slide 58 Slide 58: What can YOU do? Don’t over-share your resources (duh!) Follow security best-practices – OWASP Top 10 for LCNC Constantly monitor your environment and go threat-hunting GO HACK YOURSELF ### Slide 59 Slide 59: powerpwn An offensive security toolset for Microsoft 365 Power Platform References : bit.ly/mbrg-bhusa23