M365Pwned

Red Team tooling for Microsoft 365 exploitation via Microsoft Graph API.

Two WinForms GUI tools for enumerating, searching, and exfiltrating data from M365 environments using application-level OAuth tokens — no user interaction required.

⚠️ Disclaimer

These tools are intended exclusively for authorised red team engagements, penetration testing, and security research.
Using them against systems you do not own or have explicit written permission to test is illegal and may violate computer fraud laws (CFAA, Computer Misuse Act, etc.).
The authors accept no liability for any misuse or damage caused.

Requirements

• PowerShell 5.1 (Windows PowerShell — no PS7 required)
• A registered Azure AD application with admin-consented Application permissions (see per-tool sections below)

Authentication

Three authentication methods are supported by both tools:

Client Secret

-TenantId <guid> -ClientId <guid> -ClientSecret <secret>

Certificate (thumbprint)

-TenantId <guid> -ClientId <guid> -CertificateThumbprint <thumb>

Raw Access Token (pass-the-token)

-AccessToken <jwt>

MailPwned-GUI.ps1

Overview

WinForms GUI for enumerating, searching, reading, and exfiltrating email from M365/Exchange Online environments.

Permissions

Note: /v1.0/search/query with message entityType does not support application permissions. User enumeration + per-mailbox search is the only viable approach with app tokens — this is exactly what MailPwned implements.

Usage

powershell.exe -STA -File .\MailPwned-GUI.ps1

-STA (Single-Threaded Apartment) is required for WinForms.

Features

• Connect using tenant ID + client ID + secret, certificate thumbprint, or raw token
• Region selector for sovereign/GCC clouds (EUR, FRA, NAM, GBR, APC, AUS, CAN, IND, JPN)
• Load mailbox — browse folder tree, read emails with full HTML rendering
• Global search — search across all tenant mailboxes without loading a specific one
• Scoped search — search within a loaded mailbox
• HTML email preview — full rendering with inline image support (no external requests)
• Attachment download — single or bulk
• Compose / Reply / Reply-All / Forward — send impersonation emails
• Mark read/unread, Delete
• Export to CSV
• API log panel — real-time color-coded request/response log for debugging

Red Team Use Cases

• Credential hunting — search all mailboxes for password, credentials, VPN, secret, etc.
• Lateral phishing — read ongoing email threads and send convincing replies impersonating the compromised account
• Intelligence gathering — enumerate who is emailing whom, find sensitive projects, HR data, investor communications
• Exfiltration — bulk download attachments matching a search query
• Persistence discovery — search for MFA codes, password reset emails, token confirmations

SharePwned-GUI.ps1

CLI version

A CLI version developped by Ethical-Kaizoku can be found here

Overview

WinForms GUI for enumerating, browsing, searching, previewing, and downloading files from SharePoint sites and OneDrive drives across the tenant.

Permissions

Fallback: When Sites.Read.All is unavailable, SharePwned falls back to per-user drive enumeration via Files.Read.All.

Usage

powershell.exe -STA -File .\SharePwned-GUI.ps1

Features

• Connect using tenant ID + client ID + secret, certificate thumbprint, or raw token
• Region selector for sovereign/GCC clouds
• Enumerate all SharePoint sites across the tenant
• Browse drive trees — navigate site document libraries and OneDrive folders
• Full-text search — keyword search across all drives (/v1.0/search/query with driveItem entity)
• Fallback search — per-drive search when Sites.Read.All is absent
• File preview — text extraction for documents, inline preview panel
• Download files — single file download with progress
• File type icons — extension-aware icon display in the file browser
• API log panel — real-time color-coded request/response log for debugging

Red Team Use Cases

• Credential hunting — search all SharePoint/OneDrive for password, secret, private key, config files, .env, etc.
• Intelligence gathering — enumerate project sites, HR drives, finance document libraries
• Exfiltration — download files of interest without leaving a large audit trail
• Access mapping — enumerate all sites the compromised app can reach to understand the blast radius

Region Header

The Prefer: exchange.region=<region> header routes requests to the correct datacenter. Required when targeting tenants in non-default regions.

OPSEC Notes

• All requests go directly to https://graph.microsoft.com — no proxy or relay
• The app token contains the roles claim; Graph logs will show application-level access under the registered app's identity
• Loading mailboxes from a file (MailPwned) avoids calling GET /users — lower footprint when a UPN list is already available from OSINT or prior access
• Downloaded HTML emails embed inline images as data: URIs — no outbound requests when opened
• Both tools suppress script errors and run fully offline after token acquisition

License

For educational and authorised security testing use only.