Illicit Consent Grant
Last updated
Last updated
When we have initial access to a user, we can create a application (this is a default setting).
A recommendation is to deny users to create applications
With this application we can ask another user to consent their permissions to our application. When the user consents, we get their access token. With this access token we can interact with perhaps the Graph API.
We first go to https://portal.azure.com and register a application from our initial access user. We should use a url that we own as redirect url. So for example https://172.16.150.60/login/authorized. For the permissions, we add User.ReadBasic.All:
Next, we spin up a tool called 365-stealer. Which is a tool created by Altered Security to give a GUI to manage our phishing attack. https://github.com/AlteredSecurity/365-Stealer. This tool allows us to fill in the app's information:
If we save and run the attack, a shell pops up with a phishing link:
We sent this link to the victim. If the victim consents to our application, we receive a update on the GUI:
We can copy the access_token and use that to connect to Microsoft Graph.
