Another blog on the Primary Refresh Token! Thx
@gentilkiwi
for figuring this out with me! Tl;Dr: PRT can be extracted from lsass with
#mimikatz
🥝. If with TPM, session key is protected. Still possible to extract derived keys and sign your own PRT cookies.
7
158
315
Replies
Oh and Credential Guard doesn't seem to protect CloudAP, so even with that on this is possible 🤷🏼♂️
4
1
16
@_dirkjan
@gentilkiwi
I learned some pretty useful reversing techniques from this post! It's interesting for everyone, not only for Azure AD folks😀
1
0
1
@_mohemiv
@gentilkiwi
Glad to hear it's useful! And hope you picked up some Azure AD knowledge too ;)
0
0
2
@_dirkjan
@NathanMcNulty
@gentilkiwi
Could the same technique be used on a personal Win10 device that has a work account added?
1
0
1
@_dirkjan
@gentilkiwi
@Alex_A_Simons
anyone from your part of the MSFT org who can offer some perspective on this?
1
0
1
