# Az - Lateral Movement (Cloud - On-Prem)

## Az - Lateral Movement (Cloud - On-Prem)

{{#include ../../../banners/hacktricks-training.md}}

### On-Prem machines connected to cloud

There are different ways a machine can be connected to the cloud:

#### Azure AD joined

<figure><img src="../../../images/image (259).png" alt=""><figcaption></figcaption></figure>

#### Workplace joined

<figure><img src="../../../images/image (222).png" alt=""><figcaption><p><a href="https://pbs.twimg.com/media/EQZv7UHXsAArdhn?format=jpg&name=large">https://pbs.twimg.com/media/EQZv7UHXsAArdhn?format=jpg&name=large</a></p></figcaption></figure>

#### Hybrid joined

<figure><img src="../../../images/image (178).png" alt=""><figcaption><p><a href="https://pbs.twimg.com/media/EQZv77jXkAAC4LK?format=jpg&name=large">https://pbs.twimg.com/media/EQZv77jXkAAC4LK?format=jpg&name=large</a></p></figcaption></figure>

#### Workplace joined on AADJ or Hybrid

<figure><img src="../../../images/image (252).png" alt=""><figcaption><p><a href="https://pbs.twimg.com/media/EQZv8qBX0AAMWuR?format=jpg&name=large">https://pbs.twimg.com/media/EQZv8qBX0AAMWuR?format=jpg&name=large</a></p></figcaption></figure>

### Tokens and limitations <a href="#tokens-and-limitations" id="tokens-and-limitations"></a>

In Azure AD, there are different types of tokens with specific limitations:

- **Access tokens**: Used to access APIs and resources like the Microsoft Graph. They are tied to a specific client and resource.
- **Refresh tokens**: Issued to applications to obtain new access tokens. They can only be used by the application they were issued to or a group of applications.
- **Primary Refresh Tokens (PRT)**: Used for Single Sign-On on Azure AD joined, registered, or hybrid joined devices. They can be used in browser sign-in flows and for signing in to mobile and desktop applications on the device.
- **Windows Hello for Business keys (WHFB)**: Used for passwordless authentication. It's used to get Primary Refresh Tokens.

The most interesting type of token is the Primary Refresh Token (PRT).

{{#ref}}
az-primary-refresh-token-prt.md
{{#endref}}

### Pivoting Techniques

From the **compromised machine to the cloud**:

- [**Pass the Cookie**](az-pass-the-cookie.md): Steal Azure cookies from the browser and use them to login
- [**Dump processes access tokens**](az-processes-memory-access-token.md): Dump the memory of local processes synchronized with the cloud (like excel, Teams...) and find access tokens in clear text.
- [**Phishing Primary Refresh Token**](az-phishing-primary-refresh-token-microsoft-entra.md)**:** Phish the PRT to abuse it
- [**Pass the PRT**](pass-the-prt.md): Steal the device PRT to access Azure impersonating it.
- [**Pass the Certificate**](az-pass-the-certificate.md)**:** Generate a cert based on the PRT to login from one machine to another

From compromising **AD** to compromising the **Cloud** and from compromising the **Cloud to** compromising **AD**:

- [**Azure AD Connect**](azure-ad-connect-hybrid-identity/index.html)
- **Another way to pivot from could to On-Prem is** [**abusing Intune**](../az-services/intune.md)

#### [Roadtx](https://github.com/dirkjanm/ROADtools)

This tool allows to perform several actions like register a machine in Azure AD to obtain a PRT, and use PRTs (legit or stolen) to access resources in several different ways. These are not direct attacks, but it facilitates the use of PRTs to access resources in different ways. Find more info in [https://dirkjanm.io/introducing-roadtools-token-exchange-roadtx/](https://dirkjanm.io/introducing-roadtools-token-exchange-roadtx/)

## References

- [https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/](https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/)

{{#include ../../../banners/hacktricks-training.md}}



