Microsoft Teams (O365)

TeamsPhisher (GitHub)

Troubleshooting

Log out and then log in. Rebooting the PC is not enough.
Try cleaning the cache.

Download video from Teams meeting

When someone shares a Teams meeting recording with you, it is hosted on SharePoint. If the option to download the video is not available, use these steps to download it.

Open the shared link with a web browser.
Right-click on the page and click Inspect to display the Developer Tools.
- Click on the Network tab.
- Filter URL (Ctrl+F) on word “manifest”. The URL usually contains “.svc.ms” and “videomanifest”.
- Right-click on the URL, and Copy->Copy link address.
On Kali Linux, install ffmpeg and download the video:

URL="https://[...].svc.ms/transform/videomanifest?provider=[...]&inputFormat=mp4&[...]"

sudo apt install ffmpeg

ffmpeg -i $URL -codec copy video.mp4

Cleartext tokens

Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs

Tokens are stored in cleartext on disk.

Windows

%AppData%\Microsoft\Teams\Cookies
%AppData%\Microsoft\Teams\Local Storage\leveldb

C:\Users\<username>\AppData\Roaming\Microsoft\Teams\Cookies

Mac OS

~/Library/Application Support/Microsoft/Teams/Cookies
~/Library/Application Support/Microsoft/Teams/Local Storage/leveldb

Linux

~/.config/Microsoft/Microsoft Teams/Cookies
~/.config/Microsoft/Microsoft Teams/Local Storage/leveldb

Extracting the tokens

Copy the “Cookies” file to Kali.

file Cookies

Cookies: SQLite 3.x database

sqlite3 Cookies ".tables"

sqlite3 Cookies "select name || ' = ' || value from cookies where upper(name) like '%AUTH%' or upper(name) like '%TOKEN%'"