Steal365

Obtaining and using access tokens from m365

Dump memory

• Steal365.cs (C#)
• Steal365.ps1 (Powershell)

Dump cache files (TBRES)

• Invoke-TBRESDecryptor.ps1

Search leaks in SharePoint, Teams and Outlook

• OfficeLeak.ps1

Inspired by

Stealing Access Tokens From Office Desktop Applications
WAM BAM - Recovering Web Tokens From Office
Introducing GraphRunner: A Post-Exploitation Toolset for Microsoft 365