TokenLook ‐ TokenExtract

Introduction

Extraction from Outlook app memory

• The method of extracting JWT tokens from outlook app memory has already been highlighted before https://mrd0x.com/stealing-tokens-from-office-applications/
• For our purpose, we created a simple C# program that uses legitimate Process Dump binary from Microsoft in combination with custom parsing to extract tokens from the Outlook process memory
• Process Dump binary can be downloaded from https://learn.microsoft.com/en-us/sysinternals/downloads/procdump

extract_noexfil.cs

• This version of the program is a simple extractor, that works in following steps:
  • The program first looks for ProcessDump.exe in the current directory
  • Once the Process Dump binary is found, the program looks for PID of the running Outlook APP
  • During testing it was found that Outlook APP on windows can run as either OUTLOOK.exe or otlk.exe
  • Hence the program falls back to otlk.exe if OUTLOOK.exe is not found