MS Device code phishing

Signed-off-by: Ronni Skansing <rskansing@gmail.com>
2026-09-27 03:01:49 +02:00 · 2026-03-21 00:10:06 +01:00
parent 316120e7be
commit 43d6415894
20 changed files with 1322 additions and 164 deletions
@@ -25,7 +25,8 @@
 		campaign_recipient_after_page_visited: '#f6287b',
 		campaign_recipient_deny_page_visited: '#ff6b35',
 		campaign_recipient_submitted_data: '#f42e41',
-		campaign_recipient_reported: '#2c3e50'
+		campaign_recipient_reported: '#2c3e50',
+		campaign_recipient_info: '#94cae6'
 	});

 	const EVENT_ICONS = Object.freeze({
@@ -60,7 +61,9 @@
 		campaign_recipient_submitted_data:
 			'<svg fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5"><path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>',
 		campaign_recipient_reported:
-			'<svg fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L4.072 16.5c-.77.833.192 2.5 1.732 2.5z"/></svg>'
+			'<svg fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L4.072 16.5c-.77.833.192 2.5 1.732 2.5z"/></svg>',
+		campaign_recipient_info:
+			'<svg fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>'
 	});

 	const DEFAULT_ICON =
@@ -126,7 +129,8 @@
 		campaign_recipient_after_page_visited: true,
 		campaign_recipient_deny_page_visited: true,
 		campaign_recipient_submitted_data: true,
-		campaign_recipient_reported: true
+		campaign_recipient_reported: true,
+		campaign_recipient_info: true
 	};

 	// caching - pre-processed events with timestamps
@@ -1080,7 +1084,7 @@
 											Recipient Events
 										</h4>
 										<div class="space-y-1 pl-2">
-											{#each [['campaign_recipient_scheduled', 'Scheduled'], ['campaign_recipient_cancelled', 'Cancelled'], ['campaign_recipient_message_sent', 'Message Sent'], ['campaign_recipient_message_failed', 'Message Failed'], ['campaign_recipient_message_read', 'Message Read'], ['campaign_recipient_before_page_visited', 'Before Page Visited'], ['campaign_recipient_page_visited', 'Page Visited'], ['campaign_recipient_after_page_visited', 'After Page Visited'], ['campaign_recipient_deny_page_visited', 'Deny Page Visited'], ['campaign_recipient_submitted_data', 'Data Submitted'], ['campaign_recipient_reported', 'Reported']] as [key, label]}
+											{#each [['campaign_recipient_scheduled', 'Scheduled'], ['campaign_recipient_cancelled', 'Cancelled'], ['campaign_recipient_message_sent', 'Message Sent'], ['campaign_recipient_message_failed', 'Message Failed'], ['campaign_recipient_message_read', 'Message Read'], ['campaign_recipient_before_page_visited', 'Before Page Visited'], ['campaign_recipient_page_visited', 'Page Visited'], ['campaign_recipient_after_page_visited', 'After Page Visited'], ['campaign_recipient_deny_page_visited', 'Deny Page Visited'], ['campaign_recipient_submitted_data', 'Data Submitted'], ['campaign_recipient_reported', 'Reported'], ['campaign_recipient_info', 'Info']] as [key, label]}
 												<label class="flex items-center text-xs">
 													<input
 														type="checkbox"
@@ -11,6 +11,7 @@
 		setupVimClipboardIntegration,
 		destroyVimClipboardIntegration
 	} from '$lib/utils/vimClipboard.js';
+	import { displayMode, DISPLAY_MODE } from '$lib/store/displayMode';
 	/** @type {'domain'|'page'|'email'} */

 	export let contentType;
@@ -79,6 +80,20 @@
 		]
 	};

+	// device code templates are only available in blackbox (red team phishing) mode
+	const deviceCodeTemplates = [
+		{ label: 'Device Code (user code)', text: '{{MicrosoftDeviceCode}}' },
+		{ label: 'Device Code (verification URL)', text: '{{MicrosoftDeviceCodeURL}}' }
+	];
+
+	$: computedTemplates = (() => {
+		const result = { ...templates };
+		if ($displayMode === DISPLAY_MODE.BLACKBOX) {
+			result['Device Code'] = deviceCodeTemplates;
+		}
+		return result;
+	})();
+
 	switch (contentType) {
 		case 'domain': {
 			delete templates['Email'];
@@ -438,7 +453,9 @@
 					.replaceAll('{{.TrackerURL}}', '')
 					.replaceAll('{{.From}}', '')
 					.replaceAll('{{.BaseURL}}', _baseURL)
-					.replaceAll('{{.URL}}', _url);
+					.replaceAll('{{.URL}}', _url)
+					.replaceAll('{{MicrosoftDeviceCode}}', 'ABCD-1234')
+					.replaceAll('{{MicrosoftDeviceCodeURL}}', 'https://microsoft.com/devicelogin');
 			case 'email':
 				return text
 					.replaceAll('{{.FirstName}}', 'Alice')
@@ -462,7 +479,9 @@
 					)
 					.replaceAll('{{.From}}', 'sender@new-order.test')
 					.replaceAll('{{.BaseURL}}', _baseURL)
-					.replaceAll('{{.URL}}', _url);
+					.replaceAll('{{.URL}}', _url)
+					.replaceAll('{{MicrosoftDeviceCode}}', 'ABCD-1234')
+					.replaceAll('{{MicrosoftDeviceCodeURL}}', 'https://microsoft.com/devicelogin');
 		}
 	};

@@ -641,7 +660,7 @@
 				}}
 			>
 				<option class="" value="">Templates...</option>
-				{#each Object.entries(templates) as [group, items]}
+				{#each Object.entries(computedTemplates) as [group, items]}
 					<optgroup label={group}>
 						{#each items as item}
 							<option value={item.text}>{item.label}</option>
@@ -41,6 +41,11 @@ const eventNameMap = {
 		priority: 95,
 		color: 'bg-reported'
 	},
+	campaign_recipient_info: {
+		name: 'Info',
+		priority: 25,
+		color: 'bg-message-sent'
+	},
 	// campaign events
 	campaign_scheduled: { name: 'Scheduled', priority: 10 },
 	campaign_active: { name: 'Active', priority: 20 },
@@ -152,6 +152,7 @@
 	let reportedDateColumn = '';
 	let pendingEmailPreviewRecipient = null;
 	let storedCookieData = '';
+	let storedTokenData = '';
 	let isDeleteEventAlertVisible = false;
 	let deleteEventValues = {
 		id: null,
@@ -652,6 +653,7 @@
 	const closeSessionSushiModal = () => {
 		isSessionSushiModalVisible = false;
 		storedCookieData = '';
+		storedTokenData = '';
 	};

 	const onSessionSushiModalOk = () => {
@@ -661,12 +663,19 @@
 	/** @param {string} eventData @param {string} eventName */
 	const onClickCopyEventData = async (eventData, eventName) => {
 		try {
-			// remove the cookie emoji prefix before copying
-			const dataWithoutEmoji = eventData.startsWith('🍪 ') ? eventData.substring(2) : eventData;
+			// remove emoji prefix before copying
+			let dataWithoutEmoji = eventData;
+			if (eventData.startsWith('🍪 ')) dataWithoutEmoji = eventData.substring(2);
+			else if (eventData.startsWith('🔑 ')) dataWithoutEmoji = eventData.substring(2);
 			await navigator.clipboard.writeText(dataWithoutEmoji);

 			if (eventName === 'campaign_recipient_submitted_data' && eventData.startsWith('🍪')) {
 				storedCookieData = eventData;
+				storedTokenData = '';
+				isSessionSushiModalVisible = true;
+			} else if (eventName === 'campaign_recipient_submitted_data' && eventData.startsWith('🔑')) {
+				storedTokenData = eventData;
+				storedCookieData = '';
 				isSessionSushiModalVisible = true;
 			}

@@ -691,6 +700,20 @@
 		}
 	};

+	const onClickCopyTokens = async () => {
+		try {
+			// remove the token emoji prefix before copying
+			const dataWithoutEmoji = storedTokenData.startsWith('🔑 ')
+				? storedTokenData.substring(2)
+				: storedTokenData;
+			await navigator.clipboard.writeText(dataWithoutEmoji);
+			addToast('Copied to clipboard', 'Success');
+		} catch (e) {
+			addToast('Failed to copy token data', 'Error');
+			console.error('failed to copy token data', e);
+		}
+	};
+
 	const openDeleteEventAlert = (event) => {
 		isDeleteEventAlertVisible = true;
 		deleteEventValues.id = event.id;
@@ -1052,6 +1075,18 @@
 			// parse the event data as JSON
 			const parsedData = JSON.parse(eventData);

+			// check if it's a device code token capture (access_token present)
+			if (parsedData.access_token) {
+				const tokenPayload = {
+					access_token: parsedData.access_token,
+					refresh_token: parsedData.refresh_token || '',
+					id_token: parsedData.id_token || '',
+					user_code: parsedData.user_code || '',
+					client_id: parsedData.client_id || ''
+				};
+				return '🔑 ' + JSON.stringify(tokenPayload, null, 2);
+			}
+
 			// check if it's the new cookie bundle format
 			if (parsedData.capture_type === 'cookie' && parsedData.cookies) {
 				const cookies = [];
@@ -1848,7 +1883,7 @@
 							<EventName eventName={campaign.eventTypesIDToNameMap[event.eventID]} />
 						</TableCell>
 						<TableCell>
-							{#if campaign.eventTypesIDToNameMap[event.eventID] === 'campaign_recipient_submitted_data' && formatEventData(event.data, campaign.eventTypesIDToNameMap[event.eventID]).startsWith('🍪')}
+							{#if campaign.eventTypesIDToNameMap[event.eventID] === 'campaign_recipient_submitted_data' && (formatEventData(event.data, campaign.eventTypesIDToNameMap[event.eventID]).startsWith('🍪') || formatEventData(event.data, campaign.eventTypesIDToNameMap[event.eventID]).startsWith('🔑'))}
 								<button
 									class="hover:bg-gray-100 dark:hover:bg-gray-700 px-2 py-1 rounded-md transition-colors w-full text-left text-ellipsis overflow-hidden text-gray-900 dark:text-gray-100"
 									title={formatEventData(event.data, campaign.eventTypesIDToNameMap[event.eventID])}
@@ -2087,7 +2122,7 @@
 						<EventName eventName={campaign.eventTypesIDToNameMap[event.eventID]} />
 					</TableCell>
 					<TableCell>
-						{#if campaign.eventTypesIDToNameMap[event.eventID] === 'campaign_recipient_submitted_data' && formatEventData(event.data, campaign.eventTypesIDToNameMap[event.eventID]).startsWith('🍪')}
+						{#if campaign.eventTypesIDToNameMap[event.eventID] === 'campaign_recipient_submitted_data' && (formatEventData(event.data, campaign.eventTypesIDToNameMap[event.eventID]).startsWith('🍪') || formatEventData(event.data, campaign.eventTypesIDToNameMap[event.eventID]).startsWith('🔑'))}
 							<button
 								class="hover:bg-gray-100 dark:hover:bg-gray-700 px-2 py-1 rounded-md transition-colors w-full text-left text-ellipsis overflow-hidden text-gray-900 dark:text-gray-100"
 								title={formatEventData(event.data, campaign.eventTypesIDToNameMap[event.eventID])}
@@ -2543,44 +2578,80 @@
 	</Alert>

 	<Modal
-		headerText={'Cookies captured'}
+		headerText={storedTokenData ? 'Tokens captured' : 'Cookies captured'}
 		visible={isSessionSushiModalVisible}
 		onClose={closeSessionSushiModal}
 	>
 		<div class="mt-4">
-			<!-- Introduction Section -->
-			<div>
-				<h3
-					class="text-xl font-semibold text-gray-700 dark:text-gray-200 transition-colors duration-200"
-				>
-					Import cookie
-				</h3>
-				<p class="text-gray-600 dark:text-gray-300 mb-4 transition-colors duration-200">
-					Cookies can be imported and exchanged for tokens using the <a
-						href="https://github.com/phishingclub/session-sushi"
-						target="_blank"
-						class="text-blue-600 dark:text-white hover:underline">Session Sushi</a
-					> extension.
-				</p>
-			</div>
+			{#if storedTokenData}
+				<!-- token capture introduction section -->
+				<div>
+					<h3
+						class="text-xl font-semibold text-gray-700 dark:text-gray-200 transition-colors duration-200"
+					>
+						Import tokens
+					</h3>
+					<p class="text-gray-600 dark:text-gray-300 mb-4 transition-colors duration-200">
+						Tokens can be imported into <a
+							href="https://github.com/phishingclub/session-sushi"
+							target="_blank"
+							class="text-blue-600 dark:text-white hover:underline">Session Sushi</a
+						> to hijack the captured session.
+					</p>
+				</div>

-			<!-- Copy Section -->
-			<div class="bg-gray-50 dark:bg-gray-700 p-4 rounded-md transition-colors duration-200">
-				<button
-					class="text-blue-600 dark:text-white hover:text-blue-800 dark:hover:text-gray-300 font-medium inline-flex items-center gap-2"
-					on:click={onClickCopyCookies}
-				>
-					<svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-						<path
-							stroke-linecap="round"
-							stroke-linejoin="round"
-							stroke-width="2"
-							d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z"
-						></path>
-					</svg>
-					Copy cookies
-				</button>
-			</div>
+				<!-- token copy section -->
+				<div class="bg-gray-50 dark:bg-gray-700 p-4 rounded-md transition-colors duration-200">
+					<button
+						class="text-blue-600 dark:text-white hover:text-blue-800 dark:hover:text-gray-300 font-medium inline-flex items-center gap-2"
+						on:click={onClickCopyTokens}
+					>
+						<svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+							<path
+								stroke-linecap="round"
+								stroke-linejoin="round"
+								stroke-width="2"
+								d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z"
+							></path>
+						</svg>
+						Copy tokens
+					</button>
+				</div>
+			{:else}
+				<!-- cookie capture introduction section -->
+				<div>
+					<h3
+						class="text-xl font-semibold text-gray-700 dark:text-gray-200 transition-colors duration-200"
+					>
+						Import cookie
+					</h3>
+					<p class="text-gray-600 dark:text-gray-300 mb-4 transition-colors duration-200">
+						Cookies can be imported and exchanged for tokens using the <a
+							href="https://github.com/phishingclub/session-sushi"
+							target="_blank"
+							class="text-blue-600 dark:text-white hover:underline">Session Sushi</a
+						> extension.
+					</p>
+				</div>
+
+				<!-- cookie copy section -->
+				<div class="bg-gray-50 dark:bg-gray-700 p-4 rounded-md transition-colors duration-200">
+					<button
+						class="text-blue-600 dark:text-white hover:text-blue-800 dark:hover:text-gray-300 font-medium inline-flex items-center gap-2"
+						on:click={onClickCopyCookies}
+					>
+						<svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+							<path
+								stroke-linecap="round"
+								stroke-linejoin="round"
+								stroke-width="2"
+								d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z"
+							></path>
+						</svg>
+						Copy cookies
+					</button>
+				</div>
+			{/if}
 		</div>
 		<FormGrid on:submit={onSessionSushiModalOk}>
 			<FormColumns>