├── App.config
├── FodyWeavers.xml
├── LICENSE
├── Program.cs
├── Properties
└── AssemblyInfo.cs
├── README.md
├── SharpGetEntraToken.csproj
├── SharpGetEntraToken.sln
├── msalruntime.dll
├── msalruntime_x86.dll
└── packages.config
/App.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
--------------------------------------------------------------------------------
/FodyWeavers.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | BSD 3-Clause License
2 |
3 | Copyright (c) 2024, hotnops
4 |
5 | Redistribution and use in source and binary forms, with or without
6 | modification, are permitted provided that the following conditions are met:
7 |
8 | 1. Redistributions of source code must retain the above copyright notice, this
9 | list of conditions and the following disclaimer.
10 |
11 | 2. Redistributions in binary form must reproduce the above copyright notice,
12 | this list of conditions and the following disclaimer in the documentation
13 | and/or other materials provided with the distribution.
14 |
15 | 3. Neither the name of the copyright holder nor the names of its
16 | contributors may be used to endorse or promote products derived from
17 | this software without specific prior written permission.
18 |
19 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
20 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
22 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
23 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
25 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 |
--------------------------------------------------------------------------------
/Program.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections.Generic;
3 | using System.Linq;
4 | using System.Net.Http;
5 | using System.Net;
6 | using System.Threading.Tasks;
7 | using Microsoft.Identity.Client;
8 | using Microsoft.Identity.Client.Broker;
9 | using System.Security.Authentication;
10 |
11 | namespace AcquireTokenSilentExample
12 | {
13 | public class StaticClientWithProxyFactory : IMsalHttpClientFactory
14 | {
15 | private static readonly HttpClient s_httpClient;
16 |
17 | static HttpClientHandler handler;
18 |
19 | static StaticClientWithProxyFactory()
20 | {
21 | handler = new HttpClientHandler();
22 | handler.SslProtocols = SslProtocols.Tls12;
23 | s_httpClient = new HttpClient(handler);
24 | }
25 |
26 | public HttpClient GetHttpClient()
27 | {
28 | return s_httpClient;
29 | }
30 | }
31 |
32 | class Program
33 | {
34 |
35 | static async Task Main(string[] args)
36 | {
37 | Console.WriteLine("[*] Getting token");
38 | IMsalHttpClientFactory httpClientFactory = new StaticClientWithProxyFactory();
39 | // Replace these values with your app's values from the Azure portal
40 | // If no args are provided
41 | if (args.Length < 3)
42 | {
43 | Console.WriteLine("[*] Not enough args");
44 | return;
45 | }
46 |
47 | string clientId = args[0];
48 | string tenantId = args[1];
49 | string[] scopes = new string[] { args[2] };
50 |
51 | // Authority URL for Microsoft identity platform (Entra ID)
52 | string authority = $"https://login.microsoftonline.com/{tenantId}";
53 |
54 | // Create a PublicClientApplication instance
55 | var app = PublicClientApplicationBuilder.Create(clientId)
56 | .WithAuthority(authority)
57 | .WithHttpClientFactory(httpClientFactory)
58 | .WithBroker(new BrokerOptions(BrokerOptions.OperatingSystems.Windows))
59 | .Build();
60 |
61 | if (app == null)
62 | {
63 | Console.WriteLine("[*] Failed to initialize app");
64 | return;
65 | }
66 |
67 | // Attempt to acquire token silently
68 | IEnumerable accounts = await app.GetAccountsAsync();
69 | if (accounts == null)
70 | {
71 | Console.WriteLine("[*] Cannot obtain accounts enumerable");
72 | return;
73 | }
74 |
75 | IAccount accountToLogin = accounts.FirstOrDefault();
76 | if (accountToLogin == null)
77 | {
78 | accountToLogin = PublicClientApplication.OperatingSystemAccount;
79 | }
80 | try
81 | {
82 | var result = await app.AcquireTokenSilent(scopes, accountToLogin).ExecuteAsync();
83 | Console.WriteLine(result.AccessToken);
84 | }
85 | catch (MsalUiRequiredException)
86 | {
87 | Console.WriteLine("[!] MsalUiRequiredException. Interactive login required");
88 | return;
89 | }
90 | catch (Exception ex)
91 | {
92 | Console.WriteLine("[!] " + ex.Message);
93 | Console.WriteLine(ex.ToString());
94 | return;
95 | }
96 | }
97 | }
98 | }
99 |
--------------------------------------------------------------------------------
/Properties/AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | using System.Reflection;
2 | using System.Runtime.CompilerServices;
3 | using System.Runtime.InteropServices;
4 |
5 | // General Information about an assembly is controlled through the following
6 | // set of attributes. Change these attribute values to modify the information
7 | // associated with an assembly.
8 | [assembly: AssemblyTitle("SharpGetEntraToken")]
9 | [assembly: AssemblyDescription("")]
10 | [assembly: AssemblyConfiguration("")]
11 | [assembly: AssemblyCompany("")]
12 | [assembly: AssemblyProduct("SharpGetEntraToken")]
13 | [assembly: AssemblyCopyright("Copyright © 2024")]
14 | [assembly: AssemblyTrademark("")]
15 | [assembly: AssemblyCulture("")]
16 |
17 | // Setting ComVisible to false makes the types in this assembly not visible
18 | // to COM components. If you need to access a type in this assembly from
19 | // COM, set the ComVisible attribute to true on that type.
20 | [assembly: ComVisible(false)]
21 |
22 | // The following GUID is for the ID of the typelib if this project is exposed to COM
23 | [assembly: Guid("13b28332-c42a-40c2-839b-d1566b5d9e0e")]
24 |
25 | // Version information for an assembly consists of the following four values:
26 | //
27 | // Major Version
28 | // Minor Version
29 | // Build Number
30 | // Revision
31 | //
32 | // You can specify all the values or you can default the Build and Revision Numbers
33 | // by using the '*' as shown below:
34 | // [assembly: AssemblyVersion("1.0.*")]
35 | [assembly: AssemblyVersion("1.0.0.0")]
36 | [assembly: AssemblyFileVersion("1.0.0.0")]
37 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # SharpGetEntraToken
2 |
3 | ## Intro
4 | This dotnet executable is intended to be C2 capable and will obtain an Access Token for the provided client and resource. It uses the MSAL framework to obtain a token using whatever auth mechanism has been established. This has been testing with an Entra Joined OS with a PRT on Windows 11.
5 |
6 | ## Usage
7 | The msalruntime.dll file needs to be present on the bin path of the executable running this assembly. If not it, it will fail. Most OSs do not have this, so I have provided the DLLs for upload. Ensure that you use the correct arch and that it is in the binary path.
8 |
9 | Running the executable:
10 | ```
11 | SharpGetEntraToken.exe
12 | ```
13 |
14 | Example:
15 | ```
16 | SharpGetEntraToken.exe 1950a258-227b-4e31-a9cf-717495945fc2 00000000-0000-0000-0000-000000000000 https://graph.microsoft.com/.default
17 | ```
--------------------------------------------------------------------------------
/SharpGetEntraToken.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 | Debug
8 | AnyCPU
9 | {13B28332-C42A-40C2-839B-D1566B5D9E0E}
10 | Exe
11 | SharpGetEntraToken
12 | SharpGetEntraToken
13 | v4.7.2
14 | 512
15 | true
16 | true
17 |
18 |
19 |
20 |
21 |
22 | AnyCPU
23 | true
24 | full
25 | false
26 | bin\Debug\
27 | DEBUG;TRACE
28 | prompt
29 | 4
30 |
31 |
32 | AnyCPU
33 | pdbonly
34 | true
35 | bin\Release\
36 | TRACE
37 | prompt
38 | 4
39 |
40 |
41 |
42 | packages\Costura.Fody.5.7.0\lib\netstandard1.0\Costura.dll
43 |
44 |
45 | packages\Microsoft.Identity.Client.4.63.0\lib\net472\Microsoft.Identity.Client.dll
46 |
47 |
48 | packages\Microsoft.Identity.Client.Broker.4.63.0\lib\net462\Microsoft.Identity.Client.Broker.dll
49 |
50 |
51 | packages\Microsoft.Identity.Client.NativeInterop.0.16.1\lib\net461\Microsoft.Identity.Client.NativeInterop.dll
52 |
53 |
54 | packages\Microsoft.IdentityModel.Abstractions.6.35.0\lib\net472\Microsoft.IdentityModel.Abstractions.dll
55 |
56 |
57 | packages\Microsoft.Win32.Primitives.4.3.0\lib\net46\Microsoft.Win32.Primitives.dll
58 | True
59 | True
60 |
61 |
62 |
63 | packages\System.AppContext.4.3.0\lib\net463\System.AppContext.dll
64 | True
65 | True
66 |
67 |
68 | packages\System.Buffers.4.5.1\lib\net461\System.Buffers.dll
69 |
70 |
71 |
72 | packages\System.Console.4.3.0\lib\net46\System.Console.dll
73 | True
74 | True
75 |
76 |
77 |
78 | packages\System.Diagnostics.DiagnosticSource.6.0.1\lib\net461\System.Diagnostics.DiagnosticSource.dll
79 |
80 |
81 | packages\System.Diagnostics.Tracing.4.3.0\lib\net462\System.Diagnostics.Tracing.dll
82 | True
83 | True
84 |
85 |
86 |
87 | packages\System.Globalization.Calendars.4.3.0\lib\net46\System.Globalization.Calendars.dll
88 | True
89 | True
90 |
91 |
92 |
93 | packages\System.IO.4.3.0\lib\net462\System.IO.dll
94 | True
95 | True
96 |
97 |
98 | packages\System.IO.Compression.4.3.0\lib\net46\System.IO.Compression.dll
99 | True
100 | True
101 |
102 |
103 |
104 | packages\System.IO.Compression.ZipFile.4.3.0\lib\net46\System.IO.Compression.ZipFile.dll
105 | True
106 | True
107 |
108 |
109 | packages\System.IO.FileSystem.4.3.0\lib\net46\System.IO.FileSystem.dll
110 | True
111 | True
112 |
113 |
114 | packages\System.IO.FileSystem.Primitives.4.3.0\lib\net46\System.IO.FileSystem.Primitives.dll
115 | True
116 | True
117 |
118 |
119 | packages\System.Linq.4.3.0\lib\net463\System.Linq.dll
120 | True
121 | True
122 |
123 |
124 | packages\System.Linq.Expressions.4.3.0\lib\net463\System.Linq.Expressions.dll
125 | True
126 | True
127 |
128 |
129 | packages\System.Memory.4.5.4\lib\net461\System.Memory.dll
130 |
131 |
132 | packages\System.Net.Http.4.3.0\lib\net46\System.Net.Http.dll
133 | True
134 | True
135 |
136 |
137 | packages\System.Net.Sockets.4.3.0\lib\net46\System.Net.Sockets.dll
138 | True
139 | True
140 |
141 |
142 |
143 | packages\System.Numerics.Vectors.4.5.0\lib\net46\System.Numerics.Vectors.dll
144 |
145 |
146 | packages\System.Reflection.4.3.0\lib\net462\System.Reflection.dll
147 | True
148 | True
149 |
150 |
151 | packages\System.Runtime.4.3.0\lib\net462\System.Runtime.dll
152 | True
153 | True
154 |
155 |
156 | packages\System.Runtime.CompilerServices.Unsafe.6.0.0\lib\net461\System.Runtime.CompilerServices.Unsafe.dll
157 |
158 |
159 | packages\System.Runtime.Extensions.4.3.0\lib\net462\System.Runtime.Extensions.dll
160 | True
161 | True
162 |
163 |
164 | packages\System.Runtime.InteropServices.4.3.0\lib\net463\System.Runtime.InteropServices.dll
165 | True
166 | True
167 |
168 |
169 | packages\System.Runtime.InteropServices.RuntimeInformation.4.3.0\lib\net45\System.Runtime.InteropServices.RuntimeInformation.dll
170 | True
171 | True
172 |
173 |
174 | packages\System.Security.Cryptography.Algorithms.4.3.0\lib\net463\System.Security.Cryptography.Algorithms.dll
175 | True
176 | True
177 |
178 |
179 | packages\System.Security.Cryptography.Encoding.4.3.0\lib\net46\System.Security.Cryptography.Encoding.dll
180 | True
181 | True
182 |
183 |
184 | packages\System.Security.Cryptography.Primitives.4.3.0\lib\net46\System.Security.Cryptography.Primitives.dll
185 | True
186 | True
187 |
188 |
189 | packages\System.Security.Cryptography.X509Certificates.4.3.0\lib\net461\System.Security.Cryptography.X509Certificates.dll
190 | True
191 | True
192 |
193 |
194 | packages\System.Text.RegularExpressions.4.3.0\lib\net463\System.Text.RegularExpressions.dll
195 | True
196 | True
197 |
198 |
199 |
200 |
201 |
202 |
203 |
204 |
205 | packages\System.Xml.ReaderWriter.4.3.0\lib\net46\System.Xml.ReaderWriter.dll
206 | True
207 | True
208 |
209 |
210 |
211 |
212 |
213 |
214 |
215 |
216 |
217 |
218 |
219 |
220 |
221 |
222 |
223 |
224 | This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.
225 |
226 |
227 |
228 |
229 |
230 |
231 |
232 |
233 |
--------------------------------------------------------------------------------
/SharpGetEntraToken.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 17
4 | VisualStudioVersion = 17.9.34728.123
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SharpGetEntraToken", "SharpGetEntraToken.csproj", "{13B28332-C42A-40C2-839B-D1566B5D9E0E}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|Any CPU = Debug|Any CPU
11 | Release|Any CPU = Release|Any CPU
12 | EndGlobalSection
13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
14 | {13B28332-C42A-40C2-839B-D1566B5D9E0E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15 | {13B28332-C42A-40C2-839B-D1566B5D9E0E}.Debug|Any CPU.Build.0 = Debug|Any CPU
16 | {13B28332-C42A-40C2-839B-D1566B5D9E0E}.Release|Any CPU.ActiveCfg = Release|Any CPU
17 | {13B28332-C42A-40C2-839B-D1566B5D9E0E}.Release|Any CPU.Build.0 = Release|Any CPU
18 | EndGlobalSection
19 | GlobalSection(SolutionProperties) = preSolution
20 | HideSolutionNode = FALSE
21 | EndGlobalSection
22 | GlobalSection(ExtensibilityGlobals) = postSolution
23 | SolutionGuid = {4F6D052F-6954-420D-90BC-D80FDD34FA99}
24 | EndGlobalSection
25 | EndGlobal
26 |
--------------------------------------------------------------------------------
/msalruntime.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/hotnops/SharpGetEntraToken/56838c0c3e5073ada105a23efbee971f4373f7f1/msalruntime.dll
--------------------------------------------------------------------------------
/msalruntime_x86.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/hotnops/SharpGetEntraToken/56838c0c3e5073ada105a23efbee971f4373f7f1/msalruntime_x86.dll
--------------------------------------------------------------------------------
/packages.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
45 |
46 |
47 |
48 |
49 |
50 |
51 |
52 |
53 |
54 |
55 |
56 |
57 |
58 |
59 |
--------------------------------------------------------------------------------