macOS PRT Cookies Theft

---

🎤 DEF CON 33 Presentation

The research findings of this project were presented at DEF CON 33.

• Title: Original Sin of SSO: macOS PRT Cookie Theft & Entra ID Persistence via Device Forgery
• Speakers: DEF CON 33 Speakers

---

👨‍💻 Credit

• John Jiang (@SeucrityThunder)
• Kazma Ye (@kazma_tw)
• Echo Lee (@iflywithoutwind)

---

1. Headless Sim Usage

This method uses a headless browser to simulate a Single Sign-On (SSO) process and acquire PRT cookies.

pip3 install -r requirements.txt
python auto.py

---

2. SpoofBrowserCore

This approach packages a spoofed Chrome application to trigger BrowserCore, deceive it into completing the SSO flow, and obtain PRT cookies.

Execution Script

Replace YOUR_NONCE_HERE with the SSO nonce you intercepted from your browser.

./MacPRThief.sh YOUR_NONCE_HERE

If you don't need or cannot obtain an sso_nonce, you can also run it directly:

./MacPRThief.sh

The obtained PRT token will be displayed directly in the terminal.

---

3. Direct SSO Call

DirectSSOCall directly calls macOS's SSO Extension to request a PRT cookie.

Compilation

clang++ -framework Foundation -framework AuthenticationServices -fobjc-arc -o macprt_directcall main.mm

Code Signing

To allow macprt_directcall to be trusted by the system and communicate with WAM (Web Account Manager), it needs to be signed. Here, we're disguising it as a legitimate Microsoft browser messaging host.

codesign --force --deep --sign - --identifier "microsoft.com.browserMessagingHost" ./macprt_directcall

After signing, you can execute ./macprt_directcall to retrieve the PRT.

---

🔐 Ethical Notice

This tool is intended solely for academic research and red team exercises.

• ❌ DO NOT use this on machines, tenants, or accounts you do not own or have explicit authorization for.
• ❌ DO NOT use this in production or enterprise environments without authorization.