Taking a Dump in the Cloud: Extracting Secrets from Office Integration
Melvin Langvik reverses Microsoft Office desktop cloud integration, demonstrating how attackers extract cached OAuth tokens, PRTs, and cloud credentials from memory.
Summary
The Convergence of Desktop Applications and Cloud Services
Modern Microsoft Office desktop applications maintain continuous, seamless authenticated sessions with Azure AD, SharePoint, and OneDrive.
Reverse Engineering Office Authentication Internals
Melvin Langvik investigates the undocumented IPC mechanisms and memory structures used by desktop Office binaries to interact with the Web Account Manager (WAM).
Harvesting Primary Refresh Tokens and OAuth Secrets
Langvik demonstrates dumping unencrypted cloud access tokens, refresh tokens, and session credentials directly from unprivileged user processes.
Threat Hunting and Token Protection Mitigations
The author provides defensive teams with behavioral detection patterns and discusses hardware-backed token binding implementations to stop token replay attacks.
Related talks
Main Stage·38 min
Dagan Henderson · Will Kline
Dagan Henderson and Will Kline audit popular Kubernetes add-ons, exposing how third-party storage, logging, and observability tools introduce cluster takeover paths.
Main Stage·40 min
Michael Bargury
Michael Bargury explores enterprise domination through low-code shadow IT, abusing Microsoft Power Platform connectors and flows to exfiltrate corporate data.
Main Stage·39 min
Eran Segal
Eran Segal investigates Windows container isolation (Process Isolation & Hyper-V), demonstrating novel container escape techniques via Silo IPC mechanisms.