0:15 Introduction: The speaker, a cybersecurity professional, shares his journey that began with a simple goal: automate the sending of phishing simulations using Microsoft's platform.
2:20 Initial Approach & Challenges: The speaker initially explored Microsoft's Attack Simulation Training platform but abandoned it due to vulnerabilities.
7:55 Creating a Custom Solution: The speaker developed their own phishing simulation platform using Go Fish.
8:03 Allow-Listing Issues: The speaker encountered difficulties allow-listing their platform's IP address in Exchange Online, leading to the discovery of an "override for the override" called Advanced Delivery.
10:29 Microsoft Support Outsourced: The speaker's support ticket for the allow-listing issue was handled by Shanghai Wicresoft Co., Ltd., a Chinese company co-founded by Microsoft. They requested the speaker's access tokens, raising security concerns.
12:40 Automating Through the Portal: The speaker analyzed the security portal's behavior to automate the allow-listing process, discovering a regional backend API and its endpoints.
14:37 Backend API Access: The speaker obtained an access token to interact with the backend API and automate the configuration of phishing simulation overrides.
15:38 Accidental Access to Another Tenant: While automating the process, the speaker's script accessed another tenant's data, revealing a security boundary issue.
17:01 Backend Server Behavior: The speaker discovered that the backend API was setting a cookie to maintain a session with a specific backend server, acting as a smart load balancer.
18:11 Session Hijacking: By manipulating the cookie value, the speaker could switch between backend servers and potentially hijack existing PowerShell sessions.
19:19 Reproducing the Hijack: The speaker developed a script to consistently reproduce the session hijack by sending requests to multiple backend servers.
19:53 Potential Impact of Hijacked Sessions: The speaker highlighted that the hijacked sessions had access to the Security & Compliance PowerShell environment, which could be used to access sensitive data through features like content search and export.
21:01 Resolution and Updates: Microsoft eventually addressed the issues, migrating the functionality to Exchange Online PowerShell and simplifying the process.
21:29 Additional Vulnerability (UI Issue): The speaker discovered another vulnerability related to the gdap (Granular Delegated Admin Privileges) migration tool, which allowed them to create and approve gdap relationships with arbitrary tenants, though Microsoft deemed it a UI issue.
25:29 Key Takeaways: The speaker emphasized the importance of using mature cloud products, understanding the risks associated with exposing sensitive data to the cloud, and focusing on edge cases for bug bounty hunting.
26:35 Q&A: The speaker clarified that the vulnerabilities discussed in the talk have been fixed by Microsoft.