From 83668108ea0015526e304b447a54d96b9c330029 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Sun, 18 Oct 2026 11:09:24 +0000 Subject: [PATCH 1/2] Add content from: Device Code Phishing Forensics: What We Learned Investigatin... --- src/SUMMARY.md | 15 +++++++++++++++ .../az-conditional-access-policies-mfa-bypass.md | 10 ++++++++++ .../az-device-code-authentication-phishing.md | 5 ++++- 3 files changed, 29 insertions(+), 1 deletion(-) diff --git a/src/SUMMARY.md b/src/SUMMARY.md index f1d324eb8a..1dd080350e 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -1115,6 +1115,21 @@ - [AWS - Verified Permissions Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-verified-permissions-privesc/README.md) - [AWS - WorkSpaces Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workspaces-privesc/README.md) - [AWS - WorkDocs Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-memorydb-user-reset-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-q-business-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workspaces-appstream-privesc/README.md) + - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md) - [AWS - Services](pentesting-cloud/aws-security/aws-services/README.md) - [AWS - Security Agent Enum](pentesting-cloud/aws-security/aws-services/aws-security-agent-enum.md) - [AWS - App Mesh Enum](pentesting-cloud/aws-security/aws-services/aws-app-mesh-enum.md) diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md index ceacf41951..272491e652 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md @@ -199,6 +199,14 @@ The tool [**ROPCI**](https://github.com/wunderwuzzi23/ropci) can also be used to +### Device-code block limited to selected resources + +**Prerequisites:** A Conditional Access policy blocks [device-code phishing](../../az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md) for selected resources but not **All resources**, while the user can still authenticate through Microsoft Authentication Broker and register a device.[[7]](#references)[[21]](#references) + +Microsoft enforces authentication-flow policies on the Device Registration Service (DRS) only when the policy targets **All resources**.[[7]](#references) A block scoped to selected apps can therefore leave the Broker-to-DRS device-code path open.[[7]](#references)[[21]](#references) The attacker can use that path to register a device and request a PRT as described in [Phishing PRTs](../../az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md#phishing-prts).[[20]](#references)[[21]](#references) This is a resource-scope escape, not a bypass of the victim's MFA; later access still depends on other Conditional Access controls.[[20]](#references)[[21]](#references) + +In an authorized test, inspect the policy's **Target resources** and compare the Broker/DRS sign-in with its Conditional Access result.[[7]](#references) Targeting **All resources** closes this gap only if DRS is not explicitly excluded; Microsoft documents DRS exclusions for legitimate device enrollment, so verify the actual policy rather than the policy name.[[7]](#references)[[21]](#references) + ## Other Az MFA Bypasses ### Ring tone @@ -356,5 +364,7 @@ Invoke-WebRequest -Uri $data[0].downloadUrl -OutFile ./downloaded-file - [17] [Migrate from Azure AD Graph to Microsoft Graph](https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview) - [18] [Authentication methods in Microsoft Entra ID - Voice call](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-phone-options) - [19] [AADInternals](https://github.com/Gerenios/AADInternals) +- [20] [Phishing the Phishing Resistant](https://dirkjanm.io/assets/raw/Phishing%20the%20Phishing%20Resistant.pdf) +- [21] [Device Code Phishing Forensics: What We Learned Investigating BEC in the Wild](https://research.eye.security/device-code-phishing-forensics/) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md index 99a9a76017..725120ef37 100644 --- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md +++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md @@ -47,6 +47,8 @@ This works especially well against **Microsoft first-party public clients** beca 4. The victim opens the **real** Microsoft page, enters the code, signs in, satisfies MFA, and grants consent if requested.[[1]](#references)[[2]](#references)[[3]](#references)[[5]](#references) 5. The attacker polls the token endpoint until `authorization_pending` becomes a successful token response.[[3]](#references)[[4]](#references) +The `expires_in` value limits how long the victim can use the code. Eye Security observed roughly 15-minute codes, so a lure opened later must request a fresh code rather than reuse one embedded in a static page or message.[[24]](#references) + ### Captive-portal and staged-lure delivery Device-code phishing does not need to start with a direct code in an email. Traffic manipulation on a hotel or conference network can redirect the captive-portal flow to an operator-controlled landing page. The page can then present the Microsoft code as a normal connectivity or identity check. This context increases credibility because the user already expects to authenticate before receiving network access.[[18]](#references)[[19]](#references) @@ -162,7 +164,7 @@ DeviceCodePhishing server --domain [TENANT_DOMAIN] \ > [!CAUTION] > The project's current documentation says this automatic redirect technique no longer works for normal Entra tenants. The tool now performs a preflight check and continues only for a federated tenant. Treat this as a version- and tenant-dependent technique rather than a universal replacement for the standard device-code workflow.[[22]](#references) -For refresh-token pivoting, FOCI behavior, and other token exchange tricks, check [Az - Tokens & Public Applications](../az-basic-information/az-tokens-and-public-applications.md). +For refresh-token pivoting, FOCI behavior, and other token exchange tricks, check [Az - Tokens & Public Applications](../az-basic-information/az-tokens-and-public-applications.md). For the Conditional Access resource-scope gap in the Broker/DRS path, check [Conditional Access Policies & MFA Bypass](../az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md#device-code-block-limited-to-selected-resources). ## Detection & Hunting @@ -229,5 +231,6 @@ For authorization-code handoff and DRS abuse, correlate several weak signals ins - [21] [Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks](https://www.volexity.com/blog/2025/12/04/dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phishing-attacks/) - [22] [DeviceCodePhishing](https://github.com/denniskniep/DeviceCodePhishing) - [23] [Microsoft identity platform and OAuth 2.0 authorization code flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow) +- [24] [Device Code Phishing Forensics: What We Learned Investigating BEC in the Wild](https://research.eye.security/device-code-phishing-forensics/) {{#include ../../../banners/hacktricks-training.md}} From 68f56b1c1f2bef9991a99b81092b7bf40de7208c Mon Sep 17 00:00:00 2001 From: SirBroccoli Date: Sun, 18 Oct 2026 13:23:14 +0200 Subject: [PATCH 2/2] docs: repair PR placement and formatting after editorial review --- src/SUMMARY.md | 15 --------------- .../az-conditional-access-policies-mfa-bypass.md | 6 +++--- .../az-device-code-authentication-phishing.md | 2 +- 3 files changed, 4 insertions(+), 19 deletions(-) diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 1dd080350e..f1d324eb8a 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -1115,21 +1115,6 @@ - [AWS - Verified Permissions Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-verified-permissions-privesc/README.md) - [AWS - WorkSpaces Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workspaces-privesc/README.md) - [AWS - WorkDocs Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-memorydb-user-reset-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-q-business-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workspaces-appstream-privesc/README.md) - - [Readme](pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md) - [AWS - Services](pentesting-cloud/aws-security/aws-services/README.md) - [AWS - Security Agent Enum](pentesting-cloud/aws-security/aws-services/aws-security-agent-enum.md) - [AWS - App Mesh Enum](pentesting-cloud/aws-security/aws-services/aws-app-mesh-enum.md) diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md index 272491e652..d3185d2ee1 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md @@ -201,11 +201,11 @@ The tool [**ROPCI**](https://github.com/wunderwuzzi23/ropci) can also be used to ### Device-code block limited to selected resources -**Prerequisites:** A Conditional Access policy blocks [device-code phishing](../../az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md) for selected resources but not **All resources**, while the user can still authenticate through Microsoft Authentication Broker and register a device.[[7]](#references)[[21]](#references) +**Prerequisites:** A Conditional Access policy blocks the [device code flow](../../az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md) for selected resources rather than **All resources**, and the user is allowed to register a device.[[7]](#references)[[21]](#references) -Microsoft enforces authentication-flow policies on the Device Registration Service (DRS) only when the policy targets **All resources**.[[7]](#references) A block scoped to selected apps can therefore leave the Broker-to-DRS device-code path open.[[7]](#references)[[21]](#references) The attacker can use that path to register a device and request a PRT as described in [Phishing PRTs](../../az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md#phishing-prts).[[20]](#references)[[21]](#references) This is a resource-scope escape, not a bypass of the victim's MFA; later access still depends on other Conditional Access controls.[[20]](#references)[[21]](#references) +Microsoft enforces authentication-flow policies on the Device Registration Service (DRS) only when they target **All resources**. A block limited to selected apps can therefore leave the Microsoft Authentication Broker-to-DRS device-code path open.[[7]](#references)[[21]](#references) If the victim completes that flow, the attacker can register a device and exchange the Broker refresh token for a Primary Refresh Token (PRT), as described in [Phishing PRTs](../../az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md#phishing-prts).[[20]](#references)[[21]](#references) The victim still performs MFA, and later access remains subject to other Conditional Access controls.[[20]](#references) -In an authorized test, inspect the policy's **Target resources** and compare the Broker/DRS sign-in with its Conditional Access result.[[7]](#references) Targeting **All resources** closes this gap only if DRS is not explicitly excluded; Microsoft documents DRS exclusions for legitimate device enrollment, so verify the actual policy rather than the policy name.[[7]](#references)[[21]](#references) +Check the policy's **Target resources** and the Conditional Access result of Broker/DRS sign-ins. An **All resources** policy does not cover DRS if that resource is explicitly excluded for device enrollment.[[7]](#references) ## Other Az MFA Bypasses diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md index 725120ef37..e132ef71d5 100644 --- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md +++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md @@ -47,7 +47,7 @@ This works especially well against **Microsoft first-party public clients** beca 4. The victim opens the **real** Microsoft page, enters the code, signs in, satisfies MFA, and grants consent if requested.[[1]](#references)[[2]](#references)[[3]](#references)[[5]](#references) 5. The attacker polls the token endpoint until `authorization_pending` becomes a successful token response.[[3]](#references)[[4]](#references) -The `expires_in` value limits how long the victim can use the code. Eye Security observed roughly 15-minute codes, so a lure opened later must request a fresh code rather than reuse one embedded in a static page or message.[[24]](#references) +The `expires_in` response field limits how long the user code is valid. Microsoft documents a default of 15 minutes, so a delayed lure must request a fresh code instead of reusing one embedded in a static page or message.[[3]](#references)[[24]](#references) ### Captive-portal and staged-lure delivery