TokenSmith : A Versatile Tool For Entra ID Token Management

TokenSmith is a powerful tool designed to generate Entra ID access and refresh tokens, catering to offensive engagements such as adversary simulations, penetration testing, or even administrative tasks.

Built with operational security (OpSec) in mind, TokenSmith is compatible with popular Azure offensive tools and provides flexibility for various use cases.

Key Features

1. Token Generation: TokenSmith simplifies the process of obtaining Entra ID tokens using the Authorization Code flow. Users can authenticate via a browser and redeem tokens directly through the command line.
2. Intune Bypass: Version 0.8 introduces the ability to bypass Intune-compliant device Conditional Access policies, allowing token generation from non-compliant devices with the --intune-bypass flag.
3. OpSec-Focused Design: TokenSmith avoids bundling a web browser or requiring execution on the same host as the browser, reducing the risk of detection during authentication flows.
4. Integration with Offensive Tools: Tokens generated by TokenSmith work seamlessly with tools like GraphRunner and Roadrecon, enhancing its utility in offensive operations.

TokenSmith can be installed by building it from source or using pre-built binaries available in its release directory. To build from source:

git clone https://github.com/jumpseclabs/tokensmith.git
cd tokensmith
go get .
go build -o tokensmith main.go

For Windows, use GOOS=windows go build -o tokensmith.exe main.go.

Authorization Code Flow

1. Run ./tokensmith authcode with optional flags for client ID, resource, or redirect URI.
2. Authenticate using the generated URL in a browser.
3. Paste the redirected URI back into TokenSmith to redeem access and refresh tokens.

Intune Bypass

To bypass Intune Conditional Access, add the --intune-bypass flag to the authcode command.

Refresh Token Flow

Use an existing refresh token to obtain new tokens:

./tokensmith reftoken -r REFRESH_TOKEN [flags]

TokenSmith prioritizes OpSec by enabling flexible authentication methods without requiring risky binary execution on critical devices. Authentication can occur on a separate device, minimizing exposure.

Future updates aim to include:

• Device Code flow support.
• Expanded documentation and usage guides.
• A lightweight PowerShell version.

TokenSmith is an indispensable tool for professionals seeking efficient Entra ID token management while maintaining robust OpSec practices.