Go365

Go365 v2.0

• Fixed AWS gateway issues (thanks h0useh3ad!)
• No longer dies when proxy server connections fail
• Added the graph endpoint

Please read all of this README before using Go365!

Go365 is a tool designed to perform user enumeration* and password guessing attacks on organizations that use Office365 (now/soon Microsoft365). Go365 uses a unique SOAP API endpoint on login.microsoftonline.com that most other tools do not use. When queried with an email address and password, the endpoint responds with an Azure AD Authentication and Authorization code. This code is then processed by Go365 and the result is printed to screen or an output file.

* User enumeration is performed in conjunction with a password guess attempt. Thus, there is no specific flag or funtionality to perform only user enumeration. Instead, conduct your first password guessing attack, then parse the results for valid users.

Read these three bullets!

• This tool might not work on all domains that utilize o365. Tests show that it works with most federated domains. Some domains will only report valid users even if a valid password is also provided. Your results may vary!
• The domains this tool was tested on showed that it did not actually lock out accounts after multiple password failures. Your results may vary!
• This tool is intended to be used by security professionals that are authorized to "attack" the target organization's o365 instance.

Obtaining

Option 0

Download a pre-compiled binary for your OS HERE.

Option 1

Download the source and compile locally.

1. Install Go.
2. Clone the repo.
3. Navigate to the repo and compile ya dingus.

go build Go365.go

1. Run the resulting binary

Usage

…

Examples

…

Account Locked Out! (Domain Defenses)

protip: You probably aren't actually locking out accounts.

After a number of queries against a target domain, results might start reporting that accounts are locked out.

Once this defense is triggered, user enumeration becomes unreliable since requests for valid and invalid users will randomly report that their accounts have been locked out.

…

This is a defensive mechanism triggered by the number of valid user queries against the target domain within a certain period of time. The number of attempts and the period of time will vary depending on the target domain since the thresholds can be customized by the target organization.

Countering Defenses

Wait time

The defensive mechanism is time and IP address based. Go365 provides options to include a wait time between requests and proxy options to distribute the source of the requests. To circumvent the defensive mechanisms on your target domain, use a long wait time and multiple proxy servers.

A wait time of AT LEAST 15 seconds is recommended. -w 15

SOCKS5 Proxies

If you still get "account locked out" responses, start proxying your requests. Proxy options have only been tested on SSH SOCKS5 dynamic proxies (ssh -D user@proxyserver)

Create a bunch of SOCKS5 proxies on DO or AWS or Vultr or whatever and make a file that looks like this:

127.0.0.1:8081
127.0.0.1:8082
127.0.0.1:8083
127.0.0.1:8084
127.0.0.1:8085
127.0.0.1:8086
...

The tool will randomly iterate through the provided proxy servers and wait for the specified amount of time between requests.

-w 15 -proxyfile ./proxies.txt

Amazon API Gateway

Additionally, an endpoint url may be specified so this tool can interface with Amazon API Gateway. Setup a gateway to point to the https://login.microsoftonline.com/rst2.srf endpoint, then set the -url parameter to the provided Invoke URL. Your IP should be rotated with each request.

-url https://justanexample.execute-api.us-east-2.amazonaws.com/login