Skip to content

Beginner Friendly red team icon    azure cloud icon   

Phished for Initial Access

Follow along as we get hands on with phishing, token abuse and exfiltrating data from Office 365.

Overview

Follow along in this beginner-friendly lab as we get hands on with phishing, token abuse and exfiltrating data from Office 365. It provides a good overview of real-world techniques that threat actors use to compromise and move laterally and vertically in Azure, and how we can protect against these attacks.

 
Scenario

On a red team engagement for our client Mega Big Tech, your team has been asked to simulate opportunistic threat actors. In scope is the on-premises and Azure cloud infrastructure, and phishing is also permitted. They have recently hardened their perimeter in terms of publicly accessible services - can you show them that there are other ways in?

Lab prerequisites
  • Basic Windows and Linux command line knowledge
  • Foundational knowledge of cloud security
  • Foundational knowledge of offensive security
  • Your own cloud account to stand up an internet-accessible VM
Learning outcomes
  • Leak Net-NTLMv2 hashes to gain user credentials
  • Identify valid users and credentials using Oh365UserFinder
  • Verify MFA enforcement status using MFASweep
  • Perform token abuse using TokenTacticsV2
  • Enumerate and exfiltrate data from Azure using native tools and scripts
  • Learn how this scenario can be detected and prevented
Real-world context

Network perimeter security has improved a lot over the years, although it can still be found wanting (and arguably in the cloud, it's an IAM perimeter). Threat actors have instead turned their attention to the human element, and social engineering employees as a way to leak sensitive data or gain a foothold within an organization. In this evolving arms race, admins have increasingly been implementing multi-factor authentication (MFA) as a way to protect identities. However, as with all things admin, there any many options in how MFA can be configured, and this optionality can leave gaps in defenses that threat actors can exploit. Token abuse is also a very real issue, and this lab explores some of the factors that can make this possible, and how defenders can make this much harder to do.

KEY TAKEAWAY

Hardening the perimeter moves the entry point rather than removing it. When no service is exposed, the way in is a user making an outbound connection, and authentication material can leak from that connection without anyone entering a password.

What this lab covers

You work against an organization that has closed its externally reachable services, and establish a foothold through a user instead, capturing authentication material and using it to reach the cloud environment.

The lab requires you to stand up your own internet-accessible machine, which is deliberate. Understanding how attacker infrastructure is built and what it receives changes how you interpret outbound traffic from your own network.

It is rated intermediate and assumes foundational offensive and cloud security knowledge, with basic Windows and Linux command line familiarity.

How authentication material leaks outbound

Windows will attempt to authenticate automatically when it accesses certain remote resources. If a document, link or file reference points at a host the attacker controls, the client may negotiate authentication with it and send a challenge response derived from the user's credential.

That response is not the password, and it is enough. It can be cracked offline to recover the password if it is weak, or in some configurations relayed to another service that accepts it, and neither requires the user to type anything or approve anything.

The delivery is ordinary phishing. What makes it effective against a hardened perimeter is that it does not need an exposed service, only a user and permission to make an outbound connection, which almost every network grants by default.

How to detect this in your own environment

Alert on outbound authentication attempts to external hosts on file sharing protocols. There is essentially no legitimate reason for a workstation to authenticate to an arbitrary internet host this way, which makes it a clean detection.

Watch for the cloud sign-in that follows. A password recovered from a captured hash is used somewhere, so an authentication from an unfamiliar location shortly after suspicious outbound activity is the correlation worth building.

Monitor for documents and links that reference external hosts, since the delivery mechanism is inspectable at the mail gateway before anything is clicked.

How to prevent it

Block outbound file sharing protocols at the network edge. This is the single decisive control, it is rarely disruptive, and many organizations have never done it because nothing obviously breaks either way.

Deploy phishing-resistant authentication so a recovered password is not sufficient to sign in. That breaks the chain at the point where the captured material would otherwise become access.

Enforce signing where the protocol supports it and enable protections that prevent relayed authentication being accepted, which addresses the variant that does not require cracking at all.

Real-world context

This class of technique has persisted for many years because it depends on default protocol behavior rather than a vulnerability, and it has featured in a long series of documented intrusions against organizations with otherwise well-defended perimeters.

The hybrid dimension is what makes it a cloud concern. A password recovered on-premises frequently works in the cloud tenant, because the same identity spans both, so an on-premises capture becomes cloud access without any further exploitation.

The pattern maps to MITRE ATT&CK T1566 Phishing, T1187 Forced Authentication and T1078.004 Cloud Accounts.

Applying this at work

  • Block outbound SMB and related file sharing protocols at your perimeter, which most organizations can do without disruption.
  • Move users to phishing-resistant authentication so a recovered password does not grant access.
  • Alert on outbound authentication attempts to external hosts.
  • Check whether your on-premises and cloud identities share passwords, and what a compromise of one yields in the other.
  • Inspect inbound documents and links for references to external hosts at the mail gateway.

Frequently asked questions

How can a password leak without the user entering it?

Windows attempts authentication automatically when accessing certain remote resources. If the resource is attacker-controlled, the client sends a challenge response derived from the user's credential, which can then be cracked offline or relayed.

Does a hardened perimeter prevent this?

No. The technique needs no exposed service, only a user and an outbound connection. Closing inbound services moves the entry point to the user rather than removing it.

What is the most effective single control?

Blocking outbound file sharing protocols at the network edge. It is rarely disruptive and it removes the channel the captured material travels over, which is why it is worth checking whether yours is already blocked.

Do I need my own Azure account to practice this?

The lab environment is provisioned for you, though this one asks you to stand up your own internet-accessible machine so you understand how the receiving infrastructure works.

Which certification covers this in depth?

The Microsoft Cloud Red Team Professional (MCRTP) covers Entra ID, Azure and Microsoft 365 attack paths in full, including token abuse, phishing tradecraft and privilege escalation, and is assessed hands-on in a live tenant.

platform mock(1)

Cloud Security Training To Protect Your Business

Pwned Labs for Business gives your team access to dedicated business content, including labs and cyber ranges.

We also offer in-person or remote workshops, and our cloud penetration services are helping businesses become more secure!