hello and welcome to from on pram to the
cloud session my name is siri and i will
be presenter dude during the next 45
minutes
uh what this session is all about in
this session i'm gonna show you how
you may get access to the cloud id
microsoft cloud id
when you have some sort of access some
level of access on premises
so that's going to be the path from
on-prem id to the cloud id
and this session will be based on live
demos so you will not see a lot of
slides here most of the time i'm gonna
show you how to do it
um
live
uh before i start to show you this let
me say a few words about myself my name
is sergey once again um i am a fantastic
instructor conference speaker so i speak
at different conferences like
conferences from
microsoft headquarter
globalizer security b sites wild west
hack and fast here and adversary village
and so on
and if you want to contact me
after this session you want to ask me
something or you want to see what other
sessions i have and you want to watch
them
here's the link here's the link to
usually i announce my other my other
talks i have number of certifications
and awards you can see some of them
listed but i hope that's not your goal
to listen about me the whole session
and so let me jump to agenda and let's
start our content
all right so what we're going to cover
here
in this session i'm going to show you
first um
what is azure edit connect and how and
how it may be compromised so
like this
that's a classic way to integrate
on-prem id with to the cloud id azure id
connect and how to maybe compromise what
what may be the bad configuration
then i'm gonna show you new offering
from microsoft which is azure ad connect
cloud sync
um and we can we will see how that may
be compromised as well
then we will bypass uh mfa and
authentication prompt
and start to enumerate the cloud but for
enumeration i might i must also bypass
mz or msi
and finally we're gonna quickly talk uh
what should we do to mitigate those
problems
all right as i mentioned before
um this session will be based on live
demos so i'm going to switch to demo and
let's get started so first i want to
show you what uh azure ad connect is
just in case if you if you haven't
worked with that before
so azure id connect that's that's this
that's the tool from microsoft free tool
of course uh and this tool may be used
to synchronize your on-premise cd uh to
the cloud id
um and when you can configure this tool
one of the things that you must do you
must connect to your on-prem id here
so um
like you will type uh enterprise admin
username and password
and
ad connect will create an account that
will be used
for synchronization
so let me show you this
because i already have i already have
that configured if i go to the main
controller and go to users so here is an
account msrl underscores something
something and that just
just a regular user if i go to to to
member off just just the main user so
nothing special with this account
uh
but but
uh that account
may um
that account
may have number of permissions extra
permissions
if you enable some features one the
feature one the features which is very
popular called password hash sync if you
turn this feature on
account for synchronization let's this
adds connector account
will have extra permission it will have
permission to replicate active directory
so those permissions replicate directory
changes and replica directory changes
all
now let me let me show you where they
are
so
in my ad connect i enable password
hashing and by the way it's very
recommended option so most most
companies they enable password hash
settings so passwords uh password hash
of course synchronized from on prem to
the cloud as well uh we use that for
resiliency
and so that that's enabled for many
companies if i go to properties of my
domain
go to security
and find this msrl
so
here are
those permissions they are delegated
so
that's just just a normal typical
configuration of ad connect now where
we may have the problem the problem is
if someone can own this account
an attacker if if he or she owns the
account will have those permissions that
and those permissions are quite
privileged
are quite high so let me show you how i
can own this account first
and then what they can do with those
privileges this account
we don't know the password of this
account
so we must find the password first
let me jump back to adconnect now let me
show you how we can get that password
uh let me cancel that
so to get the pass this password is
stored in
adconnect database if i open this table
management agent
and
let me remove those columns i don't need
and let me just keep a few of them and
run that
now if i
look for
credentials look at this so it says
username is here msrl underscore
something something and password also
here but password is
encrypted not that simple so you will
not be able to just take password in a
plain text
all right but there's another way how
can we do how can we get password we
must we must decrypt that to the grid
password
what do we what we must do we must
become the main no sorry not i mean we
must become local administrator on this
ad connect server so at connect
administrator can decrypt this password
decryption process is quite tedious if
you do it manually but
luckily we have
we have people we have good researchers
and they and they
give us tools and on the tool called ad
connect dump
um so if you just run edit connect dump
look at this
i have a password
from
the sql database
and decrypt it
uh so and by the way on um so you can
find this tool on github and you will
also find the article from author of
this tool and he explains how to do all
of this manually if you want to do it
manually
but manual process will take a while so
i will not be able to fit into my my
session all right let me copy this
password
um and now what i can do so now i have
now i own user
now what i can do with this
credentials let me
open first command prompt on a different
machine
at the same time
i'm going to
run this different user
let's type a mass style user and click
ok
uh it will take some time before command
prompt will appear so let me first check
who am i
here
i'm i'm using your data let's take a
look if i have permissions to enumerate
a c drive from the main controller
no access denies so i'm just a regular
maybe i'm a local admin but i'm not the
administrator on the main controller so
i don't have to maintain admin
permissions all right let's try
something else let's let's type who am i
here
and this user this command prompt from
ms oil user let's try to enumerate
domain controller as well access the
knight again so no luck
but we don't really need that at this
moment because
now we have permission to replicate
directory changes
with this permission i can i can
synchronize i can replicate information
and and password hashes of any user in
the in the
in the company in this network in this
domain so
let me go to see
tools
oh
mimi cats and let me run very well known
tool called mini cats
now in mimikatz what i want to do i want
to i want to say dc uh
lsa dump dc sync and i want to
synchronize information about trainer
and trainer he is
he or she is the main administrator
so let's see that
now i can see hash
password hash of this user now let's go
to
let's open mimikat again
uh let's run mimics here
and let's say privileged debug
and i want to run command which is very
well known called pass the hash i will
copy this ntlm and paste here
and now i have another command prompt
let's try to dr dc
fingers crossed
yay
now i have
access to the main controller that means
i became the main administrator
so um when you when we have
when we have
uh at connect when we have ad connect
uh
and password hash sync is enabled which
is quite common
uh
what what what may happen
uh this account first for hds account
will have quite a lot of quite a lot of
permissions and so you must be very
careful uh
who
when you delegate permissions who is who
is ad connect administrator
so please be careful with 80 connect
administrators don't provide this
permissions to
like middle level administrators because
they can become the main admins quite
easily
all right so that's that's that's the
first thing that's that's the classic
configuration ad connect when we install
the whole server inside of our network
um and so we have it uh we can
compromise like this there's a num
there's there's a there are some other
ways how can we achieve this result um
because if you google a lot you will
find some other ways if you have like a
past pass through authentication and
some other ways to authenticate and id
connect um how they may also be
compromised so i'm not going to show you
all of those
all of all of those ways to compromise
it connect uh
just check this one and make sure
on the domain administrators can i can
manage ad connect all right so uh we
discussed the ad connect ad connect uh
how it may be used to
synchronize accounts and then the more
important how we can compromise that and
what misconfigurations what should you
not do
um let's take a look on another option
which is azure ad cloud sync azure id
connect cloud sync cloud sync that's
when we don't have the full
engine on premises so we don't install
the full server
the actual engine will be in the cloud
but on pram we just going to install
agent so let's take a look here
here lightweight agent installation mode
so we just install agent on premises
so that this configuration doesn't
support all the features of ad connect
so nowadays not that popular
but
i guess because that's the new offering
from microsoft it will have more and
more features later on
so what if you decide to switch to cloud
scene um
how it will look like let me just go to
um
to
the cloud and if i go to azure id
so here we can uh in azure
active directory we can find azure 80
connect blade
and and under that there is a manage
azure 80 cloud sync click here
and so what i must do first i must
download agent and install to one of the
servers
if i switch to that server look at this
so i have a server where i have this ad
connect installed
and what how can you find this ad
connect presence if you go to
services
um find microsoft
ad connect provision agent so this agent
is installed
uh and so what you can do here by the
way don't worry about degradation that
that
it's because my demo environment was
turned off for a long time
so if i go to configuration
here in the cloud
i can
configure
my sync also by the way i can
synchronize password hashes as well
and if we stick on as password hashes so
we may uh face the same issue that the
passports may be uh replicated by the
account
but the problem here with with this
cloud sync not a problem that's that
like
like like like a difference between uh
ad connect and cloud sync in case of
cloud sync we don't have server we don't
have uh like a
user account we don't don't have sql
database where where this account is
stored so that's a bit different let's
take a look um how it will be will be
configured in case of ad connect cloud
sync if i click on the agent i can find
that the agent
is work on behalf of a group managed
service account or gmsa
and
so
in case of gmsa there is no password
which is stored locally
so that's an account in uh in active
directory on primary directory and some
sort of servers may retrieve password of
this account from id
let me show you this if i go to the main
controller
here is a group manager's account
uh nothing here if i go to properties
so if you go to attribute editor you may
find here like information about pass
for password id
password interval because this password
will be changed by the series account
all right so now i can see that this
account is not typical
um but how we can uh take this account
over
um let me go back to my server
i'm going to to to
open powershell
let me type one command let me just type
this
now it says
uh that this
this account
um there's a principle that allowed to
retrieve manage path manage password and
this principle is uh agent so the name
of this principle is agent let's take a
look
who
hostname not where my hostname
[Music]
and i can see the agent that's the
current server so if i'm an
administrator on this server which is
agent server
i can achieve literally the same so let
me show you a few ways how can we do it
the first way
i can open command prompt but let me do
it as an administrator because i must be
a local administrator
i'm going to go to see
tools
and here i'm going to run ps exact and
in my ps exact i'm going to open cmd as
this
agent account i don't need to know any
passwords because this
specific server may retrieve this
password from id
um all right now if i open mimikatz
mimikatz and around this lsa um lsa
dc sync
yes i i was able to
replicate information about
hashes
all right that's that's that's the most
simple way to do it if you get if you
can just locally uh run that um and
execute mimikatz on this on this machine
but maybe that's not the case maybe you
cannot run mimikatz here
and we need to do it in a different
manner
so let me clear the screen
i also i also need command prompt as an
administrator and let me
open
powershell as a local system so let's
say who am i i'm local system so we know
that agent
can retrieve passport password
um so if i become the machine local
system it means um i'm an agent now i'm
a local machine
and so i can try to retrieve password
from active directory let me do it like
this
not the password itself by the way it
will be hash
and so now i extract password hash what
can i what can i do next
yes pass the hash
and so
that
account will allow me to run elevate
permissions how to do pass the hash he
already saw before i don't think i need
to
show to you again
um all right so uh that's that's two
ways how we can
um
extract
um
how we can extract credentials
um
and with those credentials we can get
access to the main to them to the
administrator to the main administrator
uh permissions
but wait but you may say wait a second
this session is called uh from on-prem
to the cloud and yes you use something
cloud-based like ad connect but you did
not show us how to become a cloud
administrator you just said you just you
just showed how to become local admin i
mean the main admin
based on the ad connect installation or
edit connect cloud scene but not how to
elevate in the cloud
yes
let me show you this
so
if you are the main administrator that
means that you can connect to literally
any workstation or server
in your network right
probably yes
so
and let me jump to demo again and let me
show you one interesting thing
when you have
your cloud environment you probably have
i.t professionals developers and they
use their
tool called azcli let me just type it
let's say a z account
list and let's output as a table
and look at this so it shows my
subscriptions
all right
now let's do the same on the different
machine
let me open cmd
and let me just let me even copy and
paste
copy
and paste
fingers crossed it should fail
please fail
yeah so it says you must login to azure
first but why when i opened command
prompt here
it didn't tell me anything it just
execute the command
uh the reason is i already logged in
here and the token
was cached
and token will be cached
here
if you go to your user profile there's a
folder called that azure
subfolder called that azure so if you go
there
if you take all of those files you may
take few on the few of them but
let me take all of them except config
and let's say i want to add that to
archive
let's skip 7-zip that's fine
and so here is 7zip archive let me copy
this
to
this workstation
extract that
fingers crossed
come on
yeah so now i can see
list of subscriptions did i have any
mfa prompts
no
any password prompts no
so
um but this account the
account has mfa enabled and of course it
has password
but because we use cache token we don't
need to present all of this we can just
still token
import that to the
different to the different machine like
just copy and paste and you're all set
and you are in the cloud uh and so now
depends on my permissions
um i can
do something
so
uh let's do let's try to do this
let's try to
do something let's say
i want to i want to
uh create
new user
which is called
uh we'll i'll call this user azure hound
let's create that
and the password will be quite strong
don't worry i'm going to remove this the
user later on so you will not be
able to use this pass this this user um
and also let me assign permissions uh
or either
all right so now i have user with reader
permissions on the subscription level
so what i can do with this user i want
to enumerate subscription and i will use
quite well known tool called azure hound
so have you heard about this azure
azure hound so you probably probably
heard about bloodhound which is like you
know from premises azure hound that's
the cloud version of bloodhound
all right so what i can do with this
azure hound
um
i can i can enumerate um uh this time i
can enumerate azure in the same manner i
did that um in a primary g with
bloodhound i can do this i can do
something similar in case of azure hound
let me show you this pretty quickly
i'm going to to to
find my azure hound locally let me copy
this
and let me
let me paste that to desktop
oh i even have a folder here
oh it's already there
um so i should hold this easier now what
i want to do
i want to navigate
to it
and let's say import
import module
azure
and
come
on azure hound
and look at this it says that was
blocked by your antivirus software
so i want to enumerate but i cannot do
it because
something some antivirus doesn't allow
me to do it
so what is that that's called amsi or mz
shortly um and so it's trying to test uh
the powershell commands and powershell
modules
i'm trying to run from powershell or not
only partial by the way but it's time
powershell
um so what i'm going to do now i want to
bypass mz how can we do it
um let me show you real quick i will not
give you all the details about that
because that's not the goal of the
session
um
but let me try to show it to you really
quickly so i'm gonna i'm gonna open
powershell
open powershell and let me run a tool
called fade the trace
and what i need to do i must tell to
frida
press process id of my powershell
window so it's 400 nice
let's say 400
all right now if i type command like get
service
sell that was uh that that that brown
that works fine and here i can see
output from mz i mean i mean
um msi output and every time i can see
this msi context hmm
so what this context is all about let me
copy this
and this time i want to open win debug
debugger
all right and i'm going to attach
powershell
and so let me just
dc into
this address
and look at this so it says
here i can see
something with title
uh msi like a header a header msi header
so
if i
if i i remove this header
msi will stop the work
how can we remove this header
let me detach that
how can i remove this header i can do it
through debugger or i can even do it
from powershell let me just
type something like
this um and now if i try to
do something like invoke
mimikatz
mimic ads
uh it will fail because i don't have
this module but but antivirus will not
block it yeah antivirus did not block it
all right let me try to use this bypass
[Music]
here
all right and let's try to import that
again
yay that's working that's working and so
now i just need to run
um
something like invoke azure hound oh
sorry um
but uh to do it
i must first connect to azure id so let
me say connect azure id
azure hound
and password
um so let's keep that first
now
what i can do i can say invoke
azure hound
and now it will start to collect
information from
my azure id not only azure id from azure
in general including azure ad of course
it depends on my permissions but because
i delegate permissions to read
everything so it may collect a lot of
information and so the output will be
soon here in this folder
so for the second time let me jump to my
bloodhound gui
i already pre-create the azure hound
file so let me just say
upload data
and here is azure hound collection
and now
oh not
so statistics here is not
not very nice if i just close that
and around again
let's see
yay we have look at this az applications
ac devices ac groups
uh users tenants subscriptions so we
learn a lot
unfortunately or maybe fortunately we
don't have pre-built queries for azure
so we must run our custom
queries
we must run our custom query so let me
run a custom query
oh damn it let me just first
copy here
paste here
um and now i can see um like accounts i
have
in my environment and those accounts
and you may say wait a second what the
hell is that um because um
quite hard to understand yes
unfortunately currently that is not
super friendly
uh but
at least i can build a graph in the
similar manner like bloodhound um
there's a very nice article you may find
here
um azure hound cipher cheat sheet and
here's a number of those queries that
you may try to
and it will return some data
that you want
um
all right
um
i hope uh that that
um that demo convinced you a lot to that
you should protect your ad connect
server or if you if you prefer to use
cloud sync you must protect agent
and you should not
provide permissions even to middle level
administrators to manage those servers
because they may easily escalate to the
main administrators and from the main
administrators to cloud administrators
um
there's a number of ways to achieve that
like if you have if you are cloud
administrator you may
use an intune you may become the main
administrator so when you have hybrid id
you must protect both environments
pretty well because from one environment
you may get get access to another
another and vice versa
so um
the last slide here
and it will be slide so what you can do
to protect your
to protect your environment better
so if you want to avoid compromising um
a deforest account first of all keep in
mind so ad connect or cloud sync the
agent they are tier zero
so
it means that you should not allow like
a regular administrators um management
ad connect management do not allow
administrator
server administrator to manage agent or
ad connect server because they may have
they may become the main admins quite
easily
um
so
please use principles privileges
also by the way if you use azure id
connect cloud sync
it
may be considered more secure because uh
configuration may be not done in the
cloud on premise you have only agent but
keep in mind uh you should not allow
access to
this server and access this server to
middle level administrators
when we we're talking about credentials
when i can steal credentials
here good idea will be use
privileged access workstation and around
administration and administer or run
development from the separate
workstation which is not part of those
your your infrastructure
um
so it means it will have multiple layers
of protection
uh mz bypass
here you may audit partial commands and
also use powershell constraint language
of course it's possible to bypass this
language as well but uh the more you
have then better
the more secure you are
and communication with azure hound in
this case principal is privileges that's
the best thing you can do because um to
enumerate to get information from igd
you must run
that command with some sort of
permissions so if you don't have those
permissions you will not be able to run
it
all right so that is about mitigations
so
please keep in mind
um
the configuration ad connect or even
any connect nowadays that's quite
typical quite typical and um password
hashing also enabled so make sure
um
you will not become the
victim
uh even even your ins even your users
inside the company they may do something
like this maybe they are not malicious
maybe they are not going to you know
steal data from the company but at least
maybe they want to have more permissions
like middle level admin want to have
like just in case to have the main
permissions as well
um so make sure that
you control access to ad connect server
or maybe cloud sync if you're going to
use that in the future
make sure you connect you
you configure permissions correctly
all right so i hope that session was
informative
and if you have any questions it's time
to ask those questions of course you may
ask questions during the session as well
but now because i'm finishing
go ahead and ask them now if you have
if not
thank you anyway um and
the best thing i can recommend you is to
check your own environment and make sure
you don't have those
not
the best
not the most optimal configurations
all right thank you very much
enjoy the conference