From ebd15ccb63115f94c0ed34306080a0eb14c86d09 Mon Sep 17 00:00:00 2001 From: carlospolop Date: Wed, 30 Jul 2025 06:27:12 +0200 Subject: [PATCH] f --- .../azure-security/az-lateral-movement-cloud-on-prem/README.md | 1 - .../az-arc-vulnerable-gpo-deploy-script.md | 1 - .../az-cloud-kerberos-trust.md | 1 - .../az-lateral-movement-cloud-on-prem/az-cloud-sync.md | 1 - .../az-lateral-movement-cloud-on-prem/az-connect-sync.md | 1 - .../az-lateral-movement-cloud-on-prem/az-domain-services.md | 2 +- .../az-lateral-movement-cloud-on-prem/az-federation.md | 1 - .../az-hybrid-identity-misc-attacks.md | 1 - .../az-local-cloud-credentials.md | 1 - .../az-pass-the-certificate.md | 1 - .../az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md | 1 - .../az-primary-refresh-token-prt.md | 1 - .../az-pta-pass-through-authentication.md | 1 - .../az-lateral-movement-cloud-on-prem/seamless-sso.md | 1 - 14 files changed, 1 insertion(+), 14 deletions(-) diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md index bccdf47be..5535eb0f2 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md @@ -40,4 +40,3 @@ This section covers the pivoting techniques to move from a compromised Entra ID {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md index bfa6c3b48..e1a95372b 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md @@ -70,4 +70,3 @@ At this point, we can gather the remaining information needed to connect to Azur {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-kerberos-trust.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-kerberos-trust.md index cd6b1837a..93b507c90 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-kerberos-trust.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-kerberos-trust.md @@ -85,4 +85,3 @@ This dumps all AD user password hashes, giving the attacker the KRBTGT hash (let {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-sync.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-sync.md index 593aa0d14..05903f7b6 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-sync.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-sync.md @@ -163,4 +163,3 @@ az rest \ {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-connect-sync.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-connect-sync.md index b2ffdf5ac..b92515790 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-connect-sync.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-connect-sync.md @@ -216,4 +216,3 @@ seamless-sso.md {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-domain-services.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-domain-services.md index d5cb39c57..ee27ddc18 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-domain-services.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-domain-services.md @@ -87,4 +87,4 @@ while IFS=$'\t' read -r vm_name resource_group; do done <<< "$vm_list" ``` -{{#include ../../../banners/hacktricks-training.md}} +{{#include ../../../banners/hacktricks-training.md}} \ No newline at end of file diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-federation.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-federation.md index 6f659cd3f..ce309f4bd 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-federation.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-federation.md @@ -161,4 +161,3 @@ Open-AADIntOffice365Portal -ImmutableID "aodilmsic30fugCUgHxsnK==" -Issuer http: {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-hybrid-identity-misc-attacks.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-hybrid-identity-misc-attacks.md index 8d720114c..be753fc7a 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-hybrid-identity-misc-attacks.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-hybrid-identity-misc-attacks.md @@ -29,4 +29,3 @@ In order to synchronize a new user from Entra ID to the on-prem AD these are the {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md index ef60b0f86..03bb8817a 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md @@ -61,4 +61,3 @@ curl -o -L -H "Authorization: Bearer " '<@microsoft.gra {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md index ba4cd53ec..831379dce 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md @@ -39,4 +39,3 @@ Main.py [-h] --usercert USERCERT --certpass CERTPASS --remoteip REMOTEIP {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md index 78b2cc823..ff358fba8 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md @@ -36,4 +36,3 @@ Just navigate to login.microsoftonline.com and add the cookie **`ESTSAUTHPERSIST {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md index 7dc4a7c22..ae2e8b2d8 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md @@ -365,4 +365,3 @@ curl -s -X POST \ {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md index f6ad97221..34ba29d34 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md @@ -105,4 +105,3 @@ seamless-sso.md {{#include ../../../banners/hacktricks-training.md}} - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md index 55e89641f..d5763654b 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md @@ -207,4 +207,3 @@ If the Active Directory administrators have access to Azure AD Connect, they can {{#include ../../../banners/hacktricks-training.md}} -