|
1 | 1 | # Az - Lateral Movement (Cloud - On-Prem) |
2 | 2 |
|
3 | | -## Az - Lateral Movement (Cloud - On-Prem) |
4 | | - |
5 | 3 | {{#include ../../../banners/hacktricks-training.md}} |
6 | 4 |
|
7 | | -### On-Prem machines connected to cloud |
8 | | - |
9 | | -There are different ways a machine can be connected to the cloud: |
10 | | - |
11 | | -#### Azure AD joined |
12 | | - |
13 | | -<figure><img src="../../../images/image (259).png" alt=""><figcaption></figcaption></figure> |
| 5 | +## Basic Information |
14 | 6 |
|
15 | | -#### Workplace joined |
| 7 | +This section covers the pivoting techniques to move from a compromised Entra ID tenant into the on-premises Active Directory (AD) or from a compromised AD to the Entra ID tenant. |
16 | 8 |
|
17 | | -<figure><img src="../../../images/image (222).png" alt=""><figcaption><p><a href="https://pbs.twimg.com/media/EQZv7UHXsAArdhn?format=jpg&name=large">https://pbs.twimg.com/media/EQZv7UHXsAArdhn?format=jpg&name=large</a></p></figcaption></figure> |
| 9 | +## Pivoting Techniques |
18 | 10 |
|
19 | | -#### Hybrid joined |
| 11 | +- [**Arc Vulnerable GPO Desploy Script**](az-arc-vulnerable-gpo-deploy-script.md): If an attacker can control or create an AD computer account and access the Azure Arc GPO deployment share, they can decrypt the stored Service Principal secret and use it to authenticate to Azure as the associated service principal, fully compromising the linked Azure environment. |
20 | 12 |
|
21 | | -<figure><img src="../../../images/image (178).png" alt=""><figcaption><p><a href="https://pbs.twimg.com/media/EQZv77jXkAAC4LK?format=jpg&name=large">https://pbs.twimg.com/media/EQZv77jXkAAC4LK?format=jpg&name=large</a></p></figcaption></figure> |
| 13 | +- [**Cloud Kerberos Trust**](az-cloud-kerberos-trust.md): How to pivot from Entra ID to AD when Cloud Kerberos Trust is configured. A Global Admin in Entra ID (Azure AD) can abuse Cloud Kerberos Trust and the sync API to impersonate high-privilege AD accounts, obtain their Kerberos tickets or NTLM hashes, and fully compromise on-prem Active Directory—even if those accounts were never cloud-synced—effectively bridging cloud-to-AD privilege escalation. |
22 | 14 |
|
23 | | -#### Workplace joined on AADJ or Hybrid |
| 15 | +- [**Cloud Sync**](az-cloud-sync.md): How to abuse Cloud Sync to move from the cloud to on-premises AD and the other way around. |
24 | 16 |
|
25 | | -<figure><img src="../../../images/image (252).png" alt=""><figcaption><p><a href="https://pbs.twimg.com/media/EQZv8qBX0AAMWuR?format=jpg&name=large">https://pbs.twimg.com/media/EQZv8qBX0AAMWuR?format=jpg&name=large</a></p></figcaption></figure> |
| 17 | +- [**Connect Sync**](az-connect-sync.md): How to abuse Connect Sync to move from the cloud to on-premises AD and the other way around. |
26 | 18 |
|
27 | | -### Tokens and limitations <a href="#tokens-and-limitations" id="tokens-and-limitations"></a> |
| 19 | +- [**Domain Services**](az-domain-services.md): What is the Azure Domain Services Service and how to pivot from Entra ID to the AD it generates. |
28 | 20 |
|
29 | | -In Azure AD, there are different types of tokens with specific limitations: |
| 21 | +- [**Federation**](az-federation.md): How to abuse Federation to move from the cloud to on-premises AD and the other way around. |
30 | 22 |
|
31 | | -- **Access tokens**: Used to access APIs and resources like the Microsoft Graph. They are tied to a specific client and resource. |
32 | | -- **Refresh tokens**: Issued to applications to obtain new access tokens. They can only be used by the application they were issued to or a group of applications. |
33 | | -- **Primary Refresh Tokens (PRT)**: Used for Single Sign-On on Azure AD joined, registered, or hybrid joined devices. They can be used in browser sign-in flows and for signing in to mobile and desktop applications on the device. |
34 | | -- **Windows Hello for Business keys (WHFB)**: Used for passwordless authentication. It's used to get Primary Refresh Tokens. |
| 23 | +- [**Hybrid Misc Attacks**](az-hybrid-identity-misc-attacks.md): Miscellaneous attacks that can be used to pivot from the cloud to on-premises AD and the other way around. |
35 | 24 |
|
36 | | -The most interesting type of token is the Primary Refresh Token (PRT). |
| 25 | +- [**Local Cloud Credentials**](az-local-cloud-credentials.md): Where to find credentials to the cloud when a PC is compromised. |
37 | 26 |
|
38 | | -{{#ref}} |
39 | | -az-primary-refresh-token-prt.md |
40 | | -{{#endref}} |
| 27 | +- [**Pass the Certificate**](az-pass-the-certificate.md): Generate a cert based on the PRT to login from one machine to another. |
41 | 28 |
|
42 | | -### Pivoting Techniques |
| 29 | +- [**Pass the Cookie**](az-pass-the-cookie.md): Steal Azure cookies from the browser and use them to login. |
43 | 30 |
|
44 | | -From the **compromised machine to the cloud**: |
| 31 | +- [**Primary Refresh Token/Pass the PRT/Phishing PRT**](az-primary-refresh-token-prt.md): What is the PRT, how to steal it and use it to access Azure resources impersonating the user. |
45 | 32 |
|
46 | | -- [**Pass the Cookie**](az-pass-the-cookie.md): Steal Azure cookies from the browser and use them to login |
47 | | -- [**Dump processes access tokens**](az-processes-memory-access-token.md): Dump the memory of local processes synchronized with the cloud (like excel, Teams...) and find access tokens in clear text. |
48 | | -- [**Phishing Primary Refresh Token**](az-phishing-primary-refresh-token-microsoft-entra.md)**:** Phish the PRT to abuse it |
49 | | -- [**Pass the PRT**](pass-the-prt.md): Steal the device PRT to access Azure impersonating it. |
50 | | -- [**Pass the Certificate**](az-pass-the-certificate.md)**:** Generate a cert based on the PRT to login from one machine to another |
| 33 | +- [**PtA - Pass through Authentication**](az-pta-pass-through-authentication.md): How to abuse Pass-through Authentication to move from the cloud to on-premises AD and the other way around. |
51 | 34 |
|
52 | | -From compromising **AD** to compromising the **Cloud** and from compromising the **Cloud to** compromising **AD**: |
| 35 | +- [**Seamless SSO**](az-seamless-sso.md): How to abuse Seamless SSO to move from on-prem to cloud. |
53 | 36 |
|
54 | | -- [**Azure AD Connect**](azure-ad-connect-hybrid-identity/index.html) |
55 | 37 | - **Another way to pivot from could to On-Prem is** [**abusing Intune**](../az-services/intune.md) |
56 | 38 |
|
57 | | -#### [Roadtx](https://github.com/dirkjanm/ROADtools) |
58 | | - |
59 | | -This tool allows to perform several actions like register a machine in Azure AD to obtain a PRT, and use PRTs (legit or stolen) to access resources in several different ways. These are not direct attacks, but it facilitates the use of PRTs to access resources in different ways. Find more info in [https://dirkjanm.io/introducing-roadtools-token-exchange-roadtx/](https://dirkjanm.io/introducing-roadtools-token-exchange-roadtx/) |
60 | | - |
61 | | -## References |
62 | | - |
63 | | -- [https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/](https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/) |
64 | 39 |
|
65 | 40 | {{#include ../../../banners/hacktricks-training.md}} |
66 | 41 |
|
|
0 commit comments