Flangvik / TeamFiltration

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts
GNU General Public License v3.0
1.06k stars 117 forks source link

Email exists but the database does not get populated #36

Closed thehackerish closed 1 year ago

thehackerish commented 1 year ago

I am using the Teams technique in TeamFiltration. Using the Debug option, I see that some emails return a valid TenantId and that the email is valid and found in many attributes in the JSON response. However, the UserPrincipalName does not match the username, but the givenName matches the email.

Here is an example for the username d.bauer@redacted.com. I anonymized all the data.

[{"tenantId":"REDACTED","isShortProfile":false,"accountEnabled":true,"featureSettings":{"coExistenceMode":"TeamsOnly"},"userPrincipalName":"d19@redacted.com","givenName":"d.bauer@redacted.com","surname":"","email":"d19@redacted.com","tenantName":"REDACTED","displayName":"Dave Bauer","type":"Federated","mri":"8:orgid:REDACTED","objectId":"REDACTED"}]

I was wondering why do you check that the UserPrincipalName should be equal to the email in this line: https://github.com/Flangvik/TeamFiltration/blob/e125f79a566ab9e7c0d3f4845fac48bc4af9f58c/TeamFiltration/TeamFiltration/Handlers/TeamsHandler.cs#L199

Flangvik commented 1 year ago

This is a good find 👍👍Just what I wanted when releasing this (it being used against more clients, thus seeing more tenant configs and edge cases). Thinking the best approach would be to merge those into an or statement, comparing both the givenName and userPrincipalName properties to the username.

Also 10+ points for using the debug feature ;)

thehackerish commented 1 year ago

Perfect! I will add a pull request considering what I have in my tests. The approach would be to look for the email in all attributes of the objects in the list returned and store it if it matches any.

AntonyBwana commented 1 year ago

In my case I was using the MSOL module. I realised that the emails that have been verified aren't being stored.

sadpotatos123 commented 1 year ago

In my case I was using the MSOL module. I realised that the emails that have been verified aren't being stored.

I had the same problem when using --validate-msol.

Flangvik commented 1 year ago

Should be fixed in https://github.com/Flangvik/TeamFiltration/releases/tag/v3.5.3