Exporting Microsoft Authenticator TOTP secrets

README.md

Background

Workplaces may enforce TOTP 2FA to be enabled Office 365 accounts, which require the Microsoft Authenticator app to be installed.

Regular TOTP applications (such as Aegis, Authy, or LastPass) cannot be used as Microsoft uses a proprietary scheme called phonefactor. Furthermore, the application requires Google Services Framework (GSF) to be installed (likely to provide device notifications), and will refuse to work when it is not present on the device.

Forunately, after the registration is complete, the underlying mechanism the app uses to generate TOTP codes is regular otpauth, and its secrets can be exported with a little bit of effort.

Extracting the keys

1. To extract the keys, a complete registration must first be done with a rooted Android device. I used a virtual Android device created with Android Studio's Device Manager.

2. Once complete, an SQLite database storing the keys can be found on the device at:

   /data/data/com.azure.authenticator/databases/PhoneFactor

   (accessing the /data partition is what requires root)

3. ADB can then be used to connect to the device/emulator, using its bundled sqlite3 tool to view the database:

   $ adb root  # Ensure we run as the root user 
   $ adb shell  # Launch a shell as the root user 
   emu64xa:/ # whoami
   root 
   emu64xa:/ # sqlite3 /data/data/com.azure.authenticator/databases/PhoneFactor  # Connect to the database file
   sqlite> SELECT name, username, oath_secret_key from accounts;
   GitHub|Chowder@github.com|w0swofa8wl02vqml0pkbzphvp54zyx5x
   

   The 32-length string in the oath_secret_key column can then be imported into any TOTP application.

My two cents:

BlueStacks & WSL instead of Android Studio & rootAVD (no rooting required)

In case you already have BlueStacks & WSL installed (IMHO much more likely than Android Studio 🙂) you can do this instead to extract the PhoneFactor database:

• Ensure cloud Backup in your Microsoft Authenticator is enabled.
• Install Microsoft Authenticator in Bluestacks
  • Select Restore from Backup when opening first time (don't login and then try to restore.) - See picture in post from @kitsumed above.
• If you can now see your TOTP codes in Microsoft Authenticator in Bluestacks then
  • close Microsoft Authenticator (maybe even force close?)
  • wait a minute (to ensure files have actually been written to disk - I don't know of any way to force a sync)
  • close/shutdown Bluestacks. (You can use BlueStacks multi instance manager to ensure, that it is completely stopped. I couldn't find any official reference if this really does shutdown the android instance or if it does some kind of hibernate - many people seem to assume it's shutdown, I was just wandering because I got a warning on mount, that the fs was not cleanly unmounted before. Everything still worked without a problem though...)

Now using WSL (default ubuntu distro) to mount the android instances rootfs and read the data via sqlite3:

sudo apt update
sudo apt install sqlite3 qemu-utils

sudo modprobe nbd
sudo qemu-nbd --connect /dev/nbd0 --read-only /mnt/c/ProgramData/BlueStacks_nxt/Engine/Pie64/Data.vhdx
sudo partprobe -s /dev/nbd0
mkdir /tmp/android-data-mount/
sudo mount /dev/nbd0p1 /tmp/android-data-mount/ -o ro,noload

mkdir /mnt/c/ms-auth-export
cd /mnt/c/ms-auth-export
sudo sqlite3 /tmp/android-data-mount/data/com.azure.authenticator/databases/PhoneFactor '.headers on' '.mode csv' '.output accounts.csv' 'SELECT * FROM accounts;'

sudo umount /tmp/android-data-mount
rmdir /tmp/android-data-mount/
sudo partprobe -d /dev/nbd0
sudo qemu-nbd --disconnect /dev/nbd0
sudo modprobe -r nbd

explorer.exe 'C:\ms-auth-export\'

Note that autocompletion for sqlite database path does not work for two reasons: (1) folder com.azure.authenticator is owned by a user unknown to WSL and has restrictive permissions and (2) file PhoneFactor does not end in .db so sqlite3's bash autocompletion pattern doesn't match.

You should now see accounts.csv

Microsoft account base64 eight digit code

As mentioned in @ChrisIdema's comment, Microsoft's own account uses an eight digit TOTP that is stored not as base32 but base64 and can be converted using python:

python -c 'import base64; print (base64.b32encode(base64.decodebytes(b"<base64 encoded MS secret>")).decode())'

Passwordmanagers with only a textbox for the TOTP secret might accept an URI like this to specify, that it is an 8 digit code:

otpauth://totp/Microsoft:username@outlook.com?period=30&digits=8&algorithm=SHA1&secret=<base32 encoded MS secret>

I specifically know that this works for Bitwarden/Vaultwarden.