feat: add legacy-auth Conditional Access bypass scenario

[ChrisJr404]

Summary

Adds Scenario 7 – Legacy Loophole: When MFA Forgot the Side Door, a new Beginner-tier challenge that teaches the classic legacy-auth gap in Conditional Access. An MFA-only CA policy that does not also block legacy authentication leaves a real, regularly-exploited path past MFA, and this scenario lets defenders practice spotting it end-to-end.

What the lesson teaches

Conditional Access clientAppTypes is an allow-list, not deny-all. If a CA author leaves the policy scoped to browser + mobileAppsAndDesktopClients only (the modern-auth defaults), every legacy-auth path — Resource Owner Password Credentials (ROPC), IMAP, POP, SMTP AUTH, Exchange ActiveSync, "Other clients" — falls outside policy scope and is never challenged for MFA. An attacker holding a valid password can sign in via ROPC or SMTP AUTH and never see the MFA prompt.

Defender objectives

• Audit existing Conditional Access policies for clientAppTypes coverage.
• Apply Microsoft's Block legacy authentication Conditional Access template tenant-wide (learn.microsoft.com).
• Use the Authentication Methods policy (and Exchange Online Set-CASMailbox / Set-OrganizationConfig) to disable basic auth per-protocol where business-justified (SMTP AUTH, POP, IMAP, MAPI, OAB, RPC, ActiveSync).
• Filter sign-in logs on Client app == Other clients / IMAP4 / POP3 / SMTP / Exchange ActiveSync using the Microsoft-published "Sign-ins using Legacy Authentication" workbook before flipping the block.
• For genuine legacy-auth use cases, scope the exclusion to a single SP / service account, not tenant-wide.

Red-team walkthrough summary

1. Foothold as low-priv mail systems engineer (raj.patel).
2. Recon the CA posture and notice the policy's clientAppTypes does not include exchangeActiveSync or other.
3. Identify the messaging admin account (EntraGoat-admin-s7), still using a stale Helpdesk-reset password.
4. Bypass the MFA requirement by sending a ROPC token request directly to https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token — ROPC is classified as "Other clients" and is unscoped by the policy.
5. With the admin token, read onPremisesExtensionAttributes.extensionAttribute1 and recover the flag.

MITRE ATT&CK mapping

• T1110.003 – Brute Force: Password Spraying (legacy-auth surface).
• T1556.006 – Modify Authentication Process: Multi-Factor Authentication (CA misconfiguration leaves MFA path unenforced for legacy clients).
• T1078.004 – Valid Accounts: Cloud Accounts.

Files added

• scenarios/EntraGoat-Scenario7-Setup.ps1 – provisions the vulnerable CA policy + admin account.
• cleanups/EntraGoat-Scenario7-Cleanup.ps1 – removes the policy + users.
• solutions/EntraGoat-Scenario7-Solution.ps1 – step-by-step walkthrough with defender remediation checklist.
• frontend/public/scripts/challenge7/{setup,cleanup}.ps1 – Web UI mirrors of the scenario scripts.

Files modified

• EntraGoatGUI/Data/Challenges.ps1 – register challenge 7 (PowerShell GUI).
• frontend/src/App.js – register challenge 7 (Web UI default state).
• README.md, docs/challenges.md – add the new row to the scenario tables.

Prerequisites

• Microsoft Entra ID P1 (or higher) — Conditional Access requires P1.
• Test/trial tenant with Global Administrator (matches the existing scenario prereqs).
• Microsoft.Graph PowerShell SDK, including Microsoft.Graph.Identity.SignIns for the CA cmdlets.

Notes

• Setup follows the same patterns as Scenarios 1–6 (UPN convention EntraGoat-admin-s7@<tenant>, flag in extensionAttribute1, ===== separator, Write-Host colour scheme, optional -Verbose output).
• PSScriptAnalyzer on the new files surfaces the same baseline rule classes (PSAvoidUsingWriteHost, PSAvoidUsingPlainTextForPassword) as the existing scenarios — no new rule classes were introduced.
• Implements EntraGoat scenario suggestion: legacy-auth Conditional Access bypass.

Test plan

• Run scenarios/EntraGoat-Scenario7-Setup.ps1 against a P1 trial tenant and verify the CA policy is created with clientAppTypes = browser, mobileAppsAndDesktopClients only.
• Walk the solution: ROPC token request returns an access token for EntraGoat-admin-s7 with no MFA prompt.
• Confirm onPremisesExtensionAttributes.extensionAttribute1 returns the flag.
• Run cleanups/EntraGoat-Scenario7-Cleanup.ps1 and verify the CA policy + both users are gone.
• Smoke-test that adding the Microsoft "Block legacy authentication" CA template breaks the bypass (defender remediation works).

[apiiro]

WORKFLOW-1 · PR Annotation (Risks)

Policies: "Secret with unknown validity in public, applicative code added"

Secrets

• ⚠ New secret User password (setup.ps1:28) - $AdminPassword = "•••••"
• ⚠ New secret User password (EntraGoat-Scenario7-Setup.ps1:28) - $AdminPassword = "•••••"
• ⚠ New secret User password (EntraGoat-Scenario7-Solution.ps1:87) - $adminPassword = "•••••"
• ⚠ New secret User password (setup.ps1:29) - $LowPrivPassword = "•••••"
• ⚠ New secret User password (EntraGoat-Scenario7-Setup.ps1:29) - $LowPrivPassword = "•••••"
• ⚠ New secret User password (EntraGoat-Scenario7-Solution.ps1:85) - $attackerPassword = "•••••"

Repository: EntraGoat

View in Apiiro

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca