Modules: Copilot M365 Discovery

Description

Extracts files with sensitive information that the current user has access to. Files that contain PII such as:

1. Social Security Numbers
2. Employee Records
3. Employee Start Dates and End Dates
4. Contact Information such as emails, phone numbers and addresses
5. Employee Salaries
6. IP Addresses
7. Driver's License and Passport Numbers
   

and more

Usage

powerpwn cli

• Run the following command:
  powerpwn copilot discovery --user {user} --password {password} --scenario {scenario} --verbose {verbosity level}
  

The access token is cached in tokens.json local cache file if acquired successfully. The pii.txt will be provided by Zenity and should be included in the root directory

• Run the discovery command with following arguments to use the cached access token:
  powerpwn copilot discovery --user {user} --cached-token --scenario {scenario} --verbose {verbosity level}
  

Command Parameters

• user: The email of the connected user. Required parameter.
  
  
• password: The password of the connected account. Required parameter.
  
  
• scenario: Copilot application to connect to. 'teamshub' for Teams and 'officeweb' Business Chat web applications. NOTE: only 'officeweb' should be used for Discovery. Required parameter.
  
  
• verbose: Verbosity flag for writing logs to a local file with name 'session_{session_id}.log'. Options are 'off', 'mid' and 'full'. Default is 'off'
  
  
• cached-token: If presents in the command arguments, it tries to use the cached access token if exists, otherwise it falls back to user/password authentication if password is provided.
  

Notice:
The final findings are saved to 'oversharedfiles_report1.xlsx' in the root directory

python

from powerpwn.copilot.models.chat_argument import ChatArguments
from powerpwn.copilot.enums.copilot_scenario_enum import CopilotScenarioEnum
from powerpwn.copilot.enums.verbose_enum import VerboseEnum
from powerpwn.copilot.oversharing.discovery import Discovery

args = ChatArguments(
        user="USER",
        password="PASSWORD",
        verbose=VerboseEnum.full,
        scenario=CopilotScenarioEnum.teamshub,
        use_cached_access_token=False
    )

Discovery(args).run()