Stealing Access Tokens

Stealing Access Tokens From Office Desktop Applications

Introduction

Dumping tokens from Microsoft Office desktop applications’ memory

Update: This only works against Microsoft 365 which is generally what organizations use. It will not work on Microsoft Office Professional Plus.

Update 2: Within a matter of days tools have already been built to dump Office desktop application tokens.


Practical

Dumping the Memory of Office Application

  • Download and install process explorer

  • Run process explorer

  • Press ctrl+F and search for any office applications (Ex: One Note, Word, Excel, etc)

  • Right click on the process

  • Select Create Dump option from the menu

  • Select Create full dump option from the drop down list

  • Save the memory dump

Extract Access Tokens from Memory Dump

  • Download and install strings application

  • Navigate to the strings folder

  • Run the below command

strings64.exe C:\Users\rohan\OneDrive\Desktop\ONENOTE.dmp | findstr /i eyJ0eX

This will return the JWT tokens which can be further decoded using https://jwt.io/ website.

FURTHER READING


REFERENCES

Last updated