Skip to content

Office365 Module

Jump to bottom
Justin Angel edited this page Aug 20, 2020 · 11 revisions

The office365_api module makes use of the O365 package.

Required Things

You'll need the following in order to use this module:

  • A Microsoft Office 365 Business Standard/Premium account
    • Set-up guidance can be found here
  • Administrative access to that account
  • User and Exchange accounts configured
    • Information on that process can be found here

Azure App Registration

WARNING: The author is not an expert on implementing Azure "apps", or Azure anything for that matter. It behooves the reader to consider these configurations insecure. This is an exemplary "just f****ng" work configuration -- probably the most common type observed with Azure.

An Azure App has to be registered for the sending domain in order for Postage to send emails on its behalf. This guidance has been largely adapted from the O365 package page and should assist with the registration process.

  1. As an administrative user, using your domain credentials log in at Microsoft's Admin Portal.
  2. Visit the RegisteredApps functionality
  3. Click New registration
  4. In the Register an application form, apply the following configurations
    • Name - Enter Postage
    • Supported account types - Select Accounts in any organizational directory (Any Azure AD directory - Multitenant)
    • Redirect URI (optional) - Select Web from the drop down and enter this URI: https://login.microsoftonline.com/common/oauth2/nativeclient
  5. Submit the form and take note of the Application (client) ID value for future reference
  6. Click Certificates & secrets from the left-hand menu
  7. Click the plus (+) symbol beside "New client secret"
  8. In the pop-up window, supply Postage as the name and select a proper lifetime for the token. One year should suffice without issue.
  9. Copy the value of the new secret. Note: This step is critical as the value will not be visually displayed a second time and is required for authentication.
  10. Click API Permissions in the left-hand menu
  11. Click Add a permission
  12. Select Microsoft Graph > Delegated Permission
  13. Enter "mail" into the search filter, enable the following, and click *Add permissions:
Mail.Send
Mail.Send.Shared
  1. Click Add a permission (yes, again)
  2. Select Microsoft Graph > Application permissions
  3. Enter "mail" into the search filter, enable the following, and click Add permissions 
Mail.Send
  1. Back at the API permissions page, click the check beside Grant admin consent for <project name> and select "yes"

Assuming the following components have been recorded for authentication, Postage should now be able to send mail on your behalf:

  • Application (client) ID (See steps 1-5)
  • Client secret value (See steps 6-9)

Authentication

As with all Microsoft products, this user experience is going to be weird/bad...mostly bad. Since we're using OAuth for authentication, you'll be prompted to visit a URL in your web browser when running Postage which will then prompt you for credentials. Use the credentials for the sending email account you've configured in Azure.

Here's how this process flows:

  1. Execute Postage using the client id and secret returned by Azure when registering the app
    • A response like the one below will be returned by the O365 package
    • Copy the provided URI
python3.8 postage.py office365_api -ci \<client id\> -cs  '\<client secret\>' -cf test_message.csv
...[snip]...

Visit the following url to give consent:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=8f56a4a...[truncated]...
  1. Paste the URL in a browser, which'll redirect you to O365
  2. Authenticate and accept all the warnings
  3. Browser will be redirected to a blank page
    • This is the expected outcome
  4. Copy the URI from the URL bar
  5. Paste it into the terminal window
  6. Hit enter
  7. Watch Postage send the emails
python3.8 postage.py office365_api -ci \<client id\> -cs  '\<client secret\>' -cf test_message.csv
...[snip]...


Visit the following url to give consent:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?...[truncated]...

Paste the authenticated url here:
https://login.microsoftonline.com/common/oauth2/nativeclient?...[truncated]...
Authentication Flow Completed. Oauth Access Token Stored. You can now use the API.

[+] Parsing: test_message.csv 
[+] Sending emails 
- Sent: sender@domain.com > justin@targetdomain.com [YET ANOTHER TEST] 
- Sent: sender@domain.com > archangel@targetdomain.com [YET ANOTHER TEST] 
[+] Finished! 
[!] Exiting

Clone this wiki locally