Stealing Access Tokens
Stealing Access Tokens From Office Desktop Applications
Introduction
Dumping tokens from Microsoft Office desktop applications’ memory
Update: This only works against Microsoft 365 which is generally what organizations use. It will not work on Microsoft Office Professional Plus.
Update 2: Within a matter of days tools have already been built to dump Office desktop application tokens.
Practical
Dumping the Memory of Office Application
Download and install process explorer
Run process explorer
Press ctrl+F and search for any office applications (Ex: One Note, Word, Excel, etc)
Right click on the process
Select Create Dump option from the menu
Select Create full dump option from the drop down list
Save the memory dump
Extract Access Tokens from Memory Dump
Download and install strings application
Navigate to the strings folder
Run the below command
This will return the JWT tokens which can be further decoded using https://jwt.io/ website.
FURTHER READING
REFERENCES
Last updated