Az - Pass the PRT
Last updated
Last updated
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Katika sehemu ya SSO State, unapaswa kuona AzureAdPrt imewekwa kwenye NDIO.
Katika matokeo sawa unaweza pia kuona ikiwa kifaa kimeunganishwa na Azure (katika uwanja AzureAdJoined):
Keki ya PRT kwa kweli inaitwa x-ms-RefreshTokenCredential na ni JSON Web Token (JWT). JWT ina sehemu 3, header, payload na signature, zilizogawanywa na . na zote zimeandikwa kwa url-safe base64. Keki ya kawaida ya PRT ina header na mwili ufuatao:
The actual Primary Refresh Token (PRT) is encapsulated within the refresh_token, which is encrypted by a key under the control of Azure AD, rendering its contents opaque and undecryptable to us. The field is_primary signifies the encapsulation of the primary refresh token within this token. To ensure that the cookie remains bound to the specific login session it was intended for, the request_nonce is transmitted from the logon.microsoftonline.com page.
The LSASS process will send to the TPM the KDF context, and the TPM will used session key (gathered when the device was registered in AzureAD and stored in the TPM) and the previous context to derivate a key, and this derived key is used to sign the PRT cookie (JWT).
The KDF context is a nonce from AzureAD and the PRT creating a JWT mixed with a context (random bytes).
Therefore, even if the PRT cannot be extracted because it's located inside the TPM, it's possible to abuseLSASS to request derived keys from new contexts and use the generated keys to sign Cookies.
As a regular user it's possible to request PRT usage by asking LSASS for SSO data. This can be done like native apps which request tokens from Web Account Manager (token broker). WAM pasess the request to LSASS, which asks for tokens using signed PRT assertion. Or it can be down with browser based (web) flows where a PRT cookie is used as header to authenticate requests to Azure AS login pages.
As SYSTEM you could steal the PRT if not protected by TPM or interact with PRT keys in LSASS using crypto APIs.
For more info about this way check this post. ROADtoken will run BrowserCore.exe from the right directory and use it to obtain a PRT cookie. This cookie can then be used with ROADtools to authenticate and obtain a persistent refresh token.
To generate a valid PRT cookie the first thing you need is a nonce. You can get this with:
Au kutumia roadrecon:
Kisha unaweza kutumia roadtoken kupata PRT mpya (endesha katika zana kutoka kwa mchakato wa mtumiaji kushambulia):
Kama oneliner:
Kisha unaweza kutumia keki iliyoandaliwa ili kuunda tokeni za kuingia ukitumia Azure AD Graph au Microsoft Graph:
Get-AADIntUserPRTToken inapata token ya PRT ya mtumiaji kutoka kwa kompyuta iliyojiunga na Azure AD au Hybrid. Inatumia BrowserCore.exe kupata token ya PRT.
Au ikiwa una thamani kutoka Mimikatz unaweza pia kutumia AADInternals kuunda tokeni:
Nenda kwenye https://login.microsoftonline.com, safisha vidakuzi vyote vya login.microsoftonline.com na uingize kidakuzi kipya.
Kisha nenda kwenye https://portal.azure.com
Mengineyo yanapaswa kuwa ya kawaida. Hakikisha unaweza kuhuisha ukurasa na kuki haiondoki, ikiwa inafanya hivyo, huenda umekosea na unahitaji kupitia mchakato tena. Ikiwa haiondoki, unapaswa kuwa salama.
PRT (Primary Refresh Token) inachukuliwa kutoka LSASS (Local Security Authority Subsystem Service) na kuhifadhiwa kwa matumizi ya baadaye.
Key ya Kikao inachukuliwa ifuatayo. Kwa kuwa funguo hii inatolewa mwanzoni kisha inarudishwa kwa usalama na kifaa cha ndani, inahitaji ufichuzi kwa kutumia DPAPI masterkey. Taarifa za kina kuhusu DPAPI (Data Protection API) zinaweza kupatikana katika rasilimali hizi: HackTricks na kwa kuelewa matumizi yake, rejelea Pass-the-cookie attack.
Baada ya ufichuzi wa Key ya Kikao, funguo iliyotokana na muktadha wa PRT inapatikana. Hizi ni muhimu kwa kuunda kuki ya PRT. Kwa haswa, funguo iliyotokana inatumika kwa kusaini JWT (JSON Web Token) inayounda kuki. Maelezo ya kina kuhusu mchakato huu yameandikwa na Dirk-jan, yanapatikana hapa.
Kumbuka kwamba ikiwa PRT iko ndani ya TPM na sio ndani ya lsass mimikatz haitakuwa na uwezo wa kuichukua.
Hata hivyo, itakuwa inawezekana kupata funguo kutoka kwa funguo iliyotokana na muktadha kutoka kwa TPM na kuitumia kusaini kuki (angalia chaguo 3).
Unaweza kupata maelezo ya kina ya mchakato uliofanywa ili kuchukua maelezo haya hapa: https://dirkjanm.io/digging-further-into-the-primary-refresh-token/
Hii haitafanya kazi hasa baada ya marekebisho ya Agosti 2021 kupata PRT za watumiaji wengine kwani ni lazima mtumiaji apate PRT yake (meneja wa ndani hawezi kufikia PRT za watumiaji wengine), lakini anaweza kufikia yake.
Unaweza kutumia mimikatz kuchukua PRT:
(Images from https://blog.netwrix.com/2023/05/13/pass-the-prt-overview)
Nakili sehemu iliyoandikwa Prt na uihifadhi.
Pia toa funguo ya kikao (the KeyValue ya uwanja wa ProofOfPossesionKey) ambayo unaweza kuona ikiwa imeangaziwa hapa chini. Hii imefichwa na tutahitaji kutumia funguo zetu za DPAPI kuzifungua.
Ikiwa huoni data yoyote ya PRT inaweza kuwa kwamba huna PRT yoyote kwa sababu kifaa chako hakijajiunga na Azure AD au inaweza kuwa unatumia toleo la zamani la Windows 10.
Ili kufungua funguo ya kikao unahitaji kuinua mamlaka yako hadi SYSTEM ili kukimbia chini ya muktadha wa kompyuta ili uweze kutumia funguo ya DPAPI kufungua. Unaweza kutumia amri zifuatazo kufanya hivyo:
Sasa unataka kunakili thamani ya Muktadha:
Na thamani ya ufunguo iliyotokana:
Hatimaye unaweza kutumia taarifa hizi zote kuunda vidakuzi vya PRT:
Nenda kwenye https://login.microsoftonline.com, safisha vidakuzi vyote kwa login.microsoftonline.com na uingize kidakuzi kipya.
Kisha nenda kwenye https://portal.azure.com
Mengineyo yanapaswa kuwa ya kawaida. Hakikisha unaweza kuhuisha ukurasa na kuki haiondoki, ikiwa inafanya hivyo, huenda umekosea na unahitaji kupitia mchakato tena. Ikiwa haiondoki, unapaswa kuwa salama.
Fanya upya PRT kwanza, ambayo itahifadhiwa katika roadtx.prt:
Sasa tunaweza kuomba tokeni kwa kutumia kivinjari cha mwingiliano na roadtx browserprtauth. Ikiwa tutatumia amri ya roadtx describe, tunaona tokeni ya ufikiaji inajumuisha madai ya MFA kwa sababu PRT niliyotumia katika kesi hii pia ilikuwa na madai ya MFA.
Kuwa na muktadha na funguo zilizotokana zilizotolewa na mimikatz, inawezekana kutumia roadrecon kuunda cookie mpya iliyosainiwa kwa:
Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
