# Az - Local Cloud Credentials

{{#include ../../../banners/hacktricks-training.md}}

## Local Token Storage and Security Considerations

### Azure CLI (Command-Line Interface)

Tokens and sensitive data are stored locally by Azure CLI, raising security concerns:

1. **Access Tokens**: Stored in plaintext within `accessTokens.json` located at `C:\Users\<username>\.Azure`.
2. **Subscription Information**: `azureProfile.json`, in the same directory, holds subscription details.
3. **Log Files**: The `ErrorRecords` folder within `.azure` might contain logs with exposed credentials, such as:
   - Executed commands with credentials embedded.
   - URLs accessed using tokens, potentially revealing sensitive information.

### Azure PowerShell

Azure PowerShell also stores tokens and sensitive data, which can be accessed locally:

1. **Access Tokens**: `TokenCache.dat`, located at `C:\Users\<username>\.Azure`, stores access tokens in plaintext.
2. **Service Principal Secrets**: These are stored unencrypted in `AzureRmContext.json`.
3. **Token Saving Feature**: Users have the ability to persist tokens using the `Save-AzContext` command, which should be used cautiously to prevent unauthorized access.

## Automatic Tools to find them

- [**Winpeas**](https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS/winPEASexe)
- [**Get-AzurePasswords.ps1**](https://github.com/NetSPI/MicroBurst/blob/master/AzureRM/Get-AzurePasswords.ps1)

## Security Recommendations

Considering the storage of sensitive data in plaintext, it's crucial to secure these files and directories by:

- Limiting access rights to these files.
- Regularly monitoring and auditing these directories for unauthorized access or unexpected changes.
- Employing encryption for sensitive files where possible.
- Educating users about the risks and best practices for handling such sensitive information.

{{#include ../../../banners/hacktricks-training.md}}



