TeamFiltration

TeamFiltration

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 EntraID accounts. See the TeamFiltration wiki page for an introduction into how TeamFiltration works and the Quick Start Guide for how to get up and running!

This tool has been used internally at TrustedSec since January 2021 and was publicly released in my talk Taking a Dump In The Cloud during DefCON30.

Download

You can download the latest precompiled release for Linux, Windows and MacOS

The releases are precompiled into a single application-dependent binary. The size go up, but you do not need NET or any other dependencies to run them.

Fork Changes

The AWS Fireprox functionality has been removed from the spray and enumeration modules. Instead, the tool can route all traffic through the proxy defined in your configuration file. The proxy is automatically used for spraying and enumeration. If you want to use the proxy for exfiltration, you must enable the --debug flag.

Usage

…

Credits

• GitHub - KoenZomers/OneDriveAPI: API in .NET to communicate with OneDrive Personal and OneDrive for Business
• Research into Undocumented Behavior of Azure AD Refresh Tokens
• WS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation
• Credits to Ryan for validating and discussing my observations / questions!
• The entire TrustedSec team for helping me polish this tool!
• The OneDrive enumeration method found by @nyxgeek and script onedrive_user_enum