dafthack/mfasweep

A tool for checking if MFA is enabled on multiple Microsoft Services

Beau Bullock

Hi, I'm Beau. I hack things and play guitar. Since 2014 I have been carrying out penetration tests and red team assessments for Black Hills Information Security. I contribute as much as I can to the InfoSec community by authoring open-source tools, speaking at conferences and on webcasts, writing blogs, and teaching the training course that I authored, Breaching the Cloud.

NOBANDWIDTH is my primary musical endeavor that is heavily inspired by both cyberpunk media and retro-futurism. The compositions are a combination of dark synthwave and metal along with some lead guitar work. A theme of "music to hack to" can be found throughout the tracks.

mfasweep's Issues

Plain Text Passwords

This tool looks good, but I think it it could better if you passed the user credentials as secure strings instead of using plain text. Could you do something like:
$Password = ConvertTo-SecureString -String "" -AsPlainText -Force to take the password parameter?`

Legacy and Basic Authentication

With Microsoft's off/on intentions to disable legacy and basic authentication methods, is it possible to add support to check for legacy and basic authentication support? These methods do not allow MFA requirements and would fit well with the tool. I understand that you can connect via other methods and see if it is supported, but this is not automated.

To be clear, this is not my area of expertise; so I may be lacking in some of my understanding here. Hence let me know if I am missing something.

Single Factor Access results not working correctly

I tested this a few days ago with a Conditional Access Policy that allowed Android access.

The script looks for some hard-coded string in the login response which is not there (anymore).

Looking at the response code instead fixed the issue, as it can tell apart whether MFA gets asked for or not.

UseBasicParsing not enabled which kills Invoke-Webrequest

Just attended your webinar today " Getting Started in Pentesting The Cloud: Azure w/ Beau Bullock (1-Hour) -- Thursday, May 27, 2021, 1:00 PM - 2:00 PM EDT (UTC -4)"

So I played with some of the tools/scripts you presented and also this one. Unfortunately this throws an error on my Windows 10 because of the Invoke-Webrequest function. I forked it and added and tested the basic parsing switch which fixes the script.

Catch Conditional Access Policy login failures.

Authenticating to Microsoft Graph API... and Authenticating to Azure Service Management API... could use a catch for login being denied for a conditional access policy.

# Conditional Access Policy

ElseIf($RespErr -match "AADSTS53003")
{
Write-Output "[*] WARNING! The account $username appears to be protected by a Conditional Access Policy."
}

using this script

Can't seem to use this script. It's calling invoke commands that don't exist and I can't find online. Your readme file is lacking information on usage.

Powershell 6+ (in this case v7) - GetResponseStream

$resp = $_.Exception.Response.GetResponseStream() this line causes a problem as GetResponseStream() seems to be deprecated since powershell v6+.

I ran into this error with the latest powershell v7.
A possible fix would be a wrapper like this one here: https://stackoverflow.com/a/48154663/16052146

    if ($PSVersionTable.PSVersion.Major -lt 6) {
        if ($Error.Exception.Response) {  
            $Reader = New-Object System.IO.StreamReader($Error.Exception.Response.GetResponseStream())
            $Reader.BaseStream.Position = 0
            $Reader.DiscardBufferedData()
            $ResponseBody = $Reader.ReadToEnd()
            if ($ResponseBody.StartsWith('{')) {
                $ResponseBody = $ResponseBody | ConvertFrom-Json
            }
            return $ResponseBody
        }
    }
    else {
        return $Error.ErrorDetails.Message
    }
}

try {
    $result = Invoke-WebRequest ...
}
catch {
    ParseErrorForResponseBody($_)
}

Tried it out but it then breaks

710 | $reader = New-Object System.IO.StreamReader($resp)

This script contains malicious content and has been blocked by your antivirus software.

Hey!

Loving the script, but I have started getting the error below when trying to run it.
I suspect Windows Defender doesn't like the base64 encoded EWS DLL binary that is inline.

Has anyone else seen this?

Suggestions for verifying the script is still safe?