Tokens

Various ways to steal and request tokens. In older versions, tokens are stored in clear text in user directories. They can also be find in powershell history. This is various tools and ideas to steal and request tokens, sometimes two different tools do the same thing. Each section is not necessarily unique in what it does.

Az PowerShell — Using Tokens with CLI

Both Az PowerShell and AzureAD modules allow the use of Access tokens for authentication. Usually, tokens contain all the claims (including that for MFA and Conditional Access etc.) so they are useful in bypassing such security controls.

If you are already connected to a tenant, request an access token for resource manager (ARM)

Get-AzAccessToken
(Get-AzAccessToken).Token

Request an access token for Microsoft Graph to access Entra ID. Supported tokens - AadGraph, AnalysisServices, Arm, Attestation, Batch, DataLake, KeyVault, MSGraph, OperationalInsights, ResourceManager, Storage, Synapse

Get-AzAccessToken -ResourceTypeName MSGraph

From older versions of Az PowerShell, get a token for Microsoft Graph

(Get-AzAccessToken -Resource "https://graph.microsoft.com").Token

1

Use the access token

Connect-AzAccount -AccountId [e-mail] -AccessToken eyJ0eXA..

2

Get all details about a service principal

Get-AzADServicePrincipal -ObjectId cdddd16e-2611-4442-8f45-053e7c37a264

3

Use other access tokens. In the below command, use the one for MSGraph (access token is still required) for accessing Entra ID

Connect-AzAccount -AccountId [e-mail] -AccessToken eyJ0eXA... -MicrosoftGraphAccessToken eyJ0eXA...

Az PowerShell — Stealing Tokens

Az PowerShell (older versions) stores access tokens in clear text in TokenCache.dat in the directory C:\Users[username].Azure. It also stores ServicePrincipalSecret in clear-text in AzureRmContext.json if a service principal secret is used to authenticate. Another interesting method is to take a process dump of PowerShell and looking for tokens in it! Users can save tokens using Save-AzContext, look out for them! Search for Save-AzContext in PowerShell console history!

Always use Disconnect-AzAccount!!

Disconnect-AzAccount

If you are already connected to a tenant, request an access token for resource manager (ARM)

Get-AzAccessToken
(Get-AzAccessToken).Token

Request an access token for Microsoft Graph to access Entra ID. Supported tokens - AadGraph, AnalysisServices, Arm, Attestation, Batch, DataLake, KeyVault, MSGraph, OperationalInsights, ResourceManager, Storage, Synapse

Get-AzAccessToken -ResourceTypeName MSGraph

From older versions of Az PowerShell, get a token for Microsoft Graph

(Get-AzAccessToken -Resource "https://graph.microsoft.com").Token

1

Use the access token

Connect-AzAccount -AccountId [e-mail] -AccessToken eyJ0eXA..

2

Get all details about a service principal

Get-AzADServicePrincipal -ObjectId cdddd16e-2611-4442-8f45-053e7c37a264

3

Use other access tokens. In the below command, use the one for MSGraph (access token is still required) for accessing Entra ID

Connect-AzAccount -AccountId [e-mail] -AccessToken eyJ0eXA..

Azure CLI — Using Tokens with CLI

az cli can request a token but cannot use it! (Actually you can)

1

Request an access token (ARM)

az account get-access-token

2

Request an access token for aad-graph. Supported tokens - aad-graph, arm, batch, data-lake, media, ms-graph, oss-rdbms

az account get-access-token --resource-type ms-graph

az cli (before 2.30.0 – January 2022) stores access tokens in clear text in accessTokens.json in the directory C:\Users[username].Azure. We can read tokens from the file, use them and request new ones too! azureProfile.json in the same directory contains information about subscriptions. You can modify accessTokens.json to use access tokens with az cli but better to use with Az PowerShell module. To clear the access tokens, always use az logout

az logout

Azure AD Module — Using Tokens with CLI

AzureAD module cannot request a token but can use one for AADGraph or Microsoft Graph!

1

Use the AAD Graph token

Connect-AzureAD -AccountId [e-mail] -AadAccessToken eyJ0eXA...

2

Use the MS Graph token with Mg module

Connect-MgGraph –AccessToken ($Token | ConvertTo-
SecureString -AsPlainText -Force)

APIs — Using Tokens

The two REST APIs endpoints that are most widely used are

• Azure Resource Manager - management.azure.com

• Microsoft Graph - graph.microsoft.com (AADGraph which is deprecated is graph.windows.net)

Get an access token and use it with ARM API. For example, list all the subscriptions

ARM API

Get an access token for MS Graph. For example, list all the users

$Token = 'eyJ0eXAi..'

$URI = 'https://graph.microsoft.com/v1.0/users'
$RequestParams = @{
    Method = 'GET'
    Uri = $URI
    Headers = @{
        'Authorization' = "Bearer $Token"
    }
}
(Invoke-RestMethod @RequestParams).value

MS Graph API

Get an access token and use it with ARM API. For example, list all the subscriptions

$Token = 'eyJ0eXAi..'

$URI = 'https://management.azure.com/subscriptions?api-version=2020-01-01'
$RequestParams = @{
    Method = 'GET'
    Uri = $URI
    Headers = @{
        'Authorization' = "Bearer $Token"
    }
}
(Invoke-RestMethod @RequestParams).value

1

Use the AAD Graph token

Connect-AzureAD -AccountId [e-mail] -AadAccessToken eyJ0eXA...

2

Use the MS Graph token with Mg module

Connect-MgGraph –AccessToken ($Token | ConvertTo-
SecureString -AsPlainText -Force)