June 24, 2022 2:00 PM (GMT+2) - Venkatraman Kumar // Sriraam Natarajan
Organizations are increasingly relying on cloud services from Azure, as there is native support from Microsoft. After obtaining Domain Admin privileges, it is essential to always think of attack paths or scenarios to escalate our privileges or describe the maximum impact. One such thing is escalating privileges to Azure Services. This talk would demonstrate attack paths for obtaining Global Administrator privileges on Azure AD from domain admin privilege on the on-premise network. Multiple domains can be registered under a single tenant, hence after obtaining global admin privileges on Azure it is possible for the adversary to gain administrative access over these domains.
🇬🇧 What's Next after Domain Admin?
Usage of AADInternals
In this authentication scheme, two vital pieces of data are the digital signature and the ImmutableID.
The ImmutableID is a globally unique identifier (GUID) associated with a user and stored in Azure Active Directory (Azure AD). A copy of this GUID is also stored in the on-premises Active Directory as the ms-DSConsistencyGuid attribute of the User object.
This attribute is viewable by any authenticated user in both Azure AD and on premises AD.
The foundation of the security of AD FS is the confidentiality of the token-signing certificate, which is used to digitally sign SAML tokens issued by the AD FS service.
Exposure of the token-signing certificate and private key, paired with any compromised AD account (to query users’ ImmutableIDs), would allow an attacker to issue their own forged but verifiable SAML tokens.
A one-time extraction of all ImmutableIDs and the token-signing certificate with private key would allow the attacker to issue SAML tokens for any user in the organization regardless of their password and any password resets that occur afterwards. The attacker can insert any claim they want into the SAML token.
This forged SAML token will bypass MFA requirements imposed by the cloud application.
Golden SAML Attack + Seamless SSO = Access to any applications in the Domain