diff --git a/reports/trr0000/azr/README.md b/reports/trr0000/azr/README.md new file mode 100644 index 0000000..4c298f6 --- /dev/null +++ b/reports/trr0000/azr/README.md @@ -0,0 +1,205 @@ +# Password Hash Synchronization: Microsoft Entra ID + +## Metadata + +| Key | Value | +|--------------|-------------------------------| +| ID | TRR0000 | +| External IDs | [T1556.007] | +| Platforms | Active Directory, IaaS | +| Contributors | Logan Darger | + +## Technique Overview + +Adversaries may patch, modify, or otherwise backdoor cloud authentication +processes that are tied to on-premises user identities in order to bypass +typical authentication mechanisms, access credentials, and enable persistent +access to accounts. This attack primarily targets environments utilizing Hybrid +Identity—a setup where local Active Directory (AD) credentials and attributes +are synchronized with a cloud identity platform. Adversaries who successfully +compromise the synchronization mechanism can gain access to core credential +material—namely password hashes—which allows them to bypass traditional +authentication safeguards and establish persistent access. [^1] + +## Technical Background + +Password Hash Synchronization (PHS) is a critical process for enabling hybrid +identity by synchronizing a hash of a user's passwords from on-premise data +sources to a cloud-based directory service. This allows users to sign in using +the same credentials across both local and cloud resources. PHS involves a +privileged agent taking password hashes and synchronizing them from the +on-premises environment to the cloud environment, usually through a multi-step +process. In Entra ID hybrid environments, this privileged agent is [Microsoft +Entra Connect Sync] (previously known as [Azure AD Sync]). Entra Connect Sync +can be connected to any data repositories that organize its data in a +database-like format and that provides standard data-access methods though only +Active Directory and Entra ID are relevant to this proceedure set as connected +data sources. [^2] The sync service itself consists of two components: the +on-premises Microsoft Entra Connect Sync component and the service side in +Microsoft Entra ID called Microsoft Entra Connect Sync service [^3]. + +### Connector Agent Configuration + +Password hash sync is the recommended method of hybrid authentication for single +forest/single Entra tenant environments and is configured within Microsoft Entra +Connect Sync. Though it is possible to install the sync engine directly on an +Active Directory DC, best practice documentation recommends that it be installed +on a separate, domain joined machine. Entra Connect Sync can be installed either +via express settings or custom installation, with the express settings option +supporting only the single forest/single tenant topology. Regardless of the +method chosen, there are three accounts that are required for the PHS process to +function. These accounts are created by the Entra Connect Sync install wizard at +setup time: + +| Account | Purpose +|-----------------------------------| ------------------------------------| +| [AD DS Connector account] | Used to read and write information to +Windows Server AD by using Active Directory Domain Services (AD DS). | +| [ADSync service account] | Used to run the sync service and access +the SQL Server database. | +| Microsoft Entra Connector account | Used to write information to Microsoft +Entra ID. | + +It should be noted that in order to apply the correct permissions to the +accounts for PHS functionality, creation of the AD DS Connector account requires +an Enterprise Administrator at setup. The AD DS Connector account name is always +prefixed with `MSOL_` and is created with a long, complex password that doesn't +expire. [^4] + +When password hash sync features are enabled for the first time, the agent +performs an initial synchronization of the passwords of all in-scope users. +Furthermore, while environments with multiple connectors may disable password +hash sync for some connectors but not others, it is not possible to explicitly +define a subset of user passwords that you want to synchronize. After initial +configuration of the sync engine, the agent will automatically request hashes +from the domain controller every two minutes. This sync is one way: when a +password is synchronized, it overwrites existing cloud passwords but cloud +passwords are not automatically sync with the on-premise domain controller +(though there are indirect exceptions to this). The synchronization of a +password has no impact on a user that is currently signed in—if a password +change is synchronized while a user is signed in to a cloud service, that user's +current session remains unaffected. + + +### PHS Synchronization Flow + +The PHS process involves a multi-stage transfer of credential data: + +![PHS Workflow](images/arch3d.png) + +1. Every two minutes, the password hash synchronization agent on the AD Connect +server requests stored password hashes (the `unicodePwd` attribute) from a DC. +This request is via the standard Directory Replication Service Remote Protocol +([MS-DRSR]) used to synchronize data between DCs. +2. The DC encrypts the MD4 password hash by using a key that is a MD5 hash of +the Remote Procedure Call (RPC) session key and a salt. It then sends the result +to the password hash synchronization agent over RPC. +3. After the password hash synchronization agent has the encrypted envelope, it +uses MD5CryptoServiceProvider and the salt to generate a key to decrypt the +received data back to its original MD4 format. +4. The password hash synchronization agent expands the 16-byte binary password +hash to 64 bytes +5. Adds a per user salt, consisting of a 10-bytes. +6. The password hash synchronization agent then combines the MD4 hash plus the +per user salt, and inputs it into the PBKDF2 function. +7. The password hash synchronization agent takes the resulting 32-byte hash, +concatenates both the per user salt and the number of SHA256 iterations to it +then transmits the string over TLS. +8. When a user attempts to sign in to Microsoft Entra ID and enters their +password, the password is run through the same MD4+salt+PBKDF2+HMAC-SHA256 +process and attempts to match the hash stored in Entra ID + +The process relies heavily on the MS-DRSR replication protocol to access the +[unicodePwd] attribute—the physical location where the password hash is stored +in Active Directory. Additionally, to execute this retrieval, the dedicated AD +DS Connector account must be granted elevated permissions on the local Domain +Controllers. These include the `Replicate Directory Changes` and `Replicate +Directory Changes All` rights available to the Connector account by default upon +installation (Note that these privileges can persist even if PHS is disabled). + +### Softmatching and Password Writeback + +While PHS is designed as a one way operation (on-prem hashes are only +automatically synced to Entra ID and not vice-versa), it is nevertheless +possible to utilize Entra Connect Sync to return passwords of cloud users +through indirect means with softmatching and password writeback. When you start +synchronizing with Microsoft Entra Connect, the Microsoft Entra service API +checks every new incoming object and tries to find an existing object to match. +There are three attributes used for this process: userPrincipalName, +proxyAddresses, and sourceAnchor/immutableID. A match on userPrincipalName or +proxyAddresses is known as a "soft match."[^5] It is possible for administrators +to block soft matching by enabling the `BlockSoftMatch` feature within their +tenant. + +Microsoft Entra self-service password reset (SSPR) is a feature that allows +users to reset their passwords or unlock their accounts using a web browser. If +this feature is configured, it is possible to enable password writeback within +Entra Connect Sync to maintian password consistency across a hybrid +environment.[^6] As described in more detail below, by using these two feature +in conjuction, it is possible for an attacker to retrieve the hashes of cloud +users to a rogue domain controller. + +## Proceedures +| ID | Title | Tactic | +|---------------|---------------------------------|-------------------| +| TRR0000.AZR.A | Entra Connect Sync: Rogue Cloud | Credential Access | +| TRR0000.AZR.B | Entra Connect Sync: Rogue DC | Credential Access | + +### Proceedure A: Entra Connect Sync: Rogue Cloud + +![Proceedure A DDM](ddms/trr0000_azr_a.png) + +If an attacker has gained enterprise administrator credential material, they can +leverage this to create an Entra Connect Sync server connected to an attacker +controlled cloud environment as a means of exfiltrating user password hashes +from the environment. + +As most logging regarding the connection of the sync server is stored in either +the sync server itself or the entra environment, the only consistent way of +monitoring this activity is through user account creation events (4720) within +the Windows Security Audit logs of the victim DC. The account name for this +event is prefixed with `MSOL_`. This is always the naming convention used for AD +DS Connector accounts created during the installation of the sync server + +### Proceedure B: Entra Connect Sync: Rogue DC + +![Proceedure B DDM](ddms/trr0000_azr_b.png) + +An attacker that obtains hybrid administrator credential material of an Entra +environment is able to use this to connect a cloud environment to a rogue domain +controller. By enabling password writeback, the attacker can softmatch user +principals in the rogue domain and require the user to reset their password at +next login. If SSPR is configured, the new user created password is then synced +back to the rogue DC. + +There are two distinct events depicting this activity within the Entra Audit +logs. The first is Activity Type `Add Application` in which the DisplayName +field begins with `ConnectSyncProvisioning`. The second event is the Activity +Type of `Enable password writeback for directory` which is a required step in +order to retrieve passwords from the cloud environment. + +## References + +- [Password hash synchronization with Microsoft Entra ID] +- [AAD Attack Paths] +- [Entra ID Lateral Movement] +- [Microsoft Entra Connect Sync Service Manager] + +[Password hash synchronization with Microsoft Entra ID]: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization +[AAD Attack Paths]: https://guardsix.com/blog/compromises-in-azure-ad-through-aad-connect +[Entra ID Lateral Movement]: https://dirkjanm.io/assets/raw/US-25-Mollema-Advanced-AD-to-Entra-ID-lateral-movement-techniques-final.pdf +[Microsoft Entra Connect Sync Service Manager]: https://docs.azure.cn/en-us/entra/identity/hybrid/connect/how-to-connect-sync-service-manager-ui-connectors + +[T1556.007]: https://attack.mitre.org/techniques/T1556/007/ +[Microsoft Entra Connect Sync]: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-whatis +[Azure AD Sync]: https://blog.quest.com/understanding-azure-ad-sync-an-overview-of-azure-ad-connect-sync-and-cloud-sync/ +[AD DS Connector account]: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-configure-ad-ds-connector-account +[ADSync service account]: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/concept-adsync-service-account +[unicodePwd]: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6e803168-f140-4d23-b2d3-c3a8ab5917d2] +[MS-DRSR]: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47 +[^1]: https://www.redfoxsec.com/blog/azure-hybrid-identity-attacks +[^2]: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/concept-azure-ad-connect-sync-architecture +[^3]: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-syncservice-features +[^4]: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions +[^5]: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-existing-tenant +[^6]: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback diff --git a/reports/trr0000/azr/ddms/trr0000_azr_a.png b/reports/trr0000/azr/ddms/trr0000_azr_a.png new file mode 100644 index 0000000..2f9c2f9 Binary files /dev/null and b/reports/trr0000/azr/ddms/trr0000_azr_a.png differ diff --git a/reports/trr0000/azr/ddms/trr0000_azr_b.png b/reports/trr0000/azr/ddms/trr0000_azr_b.png new file mode 100644 index 0000000..ceed84d Binary files /dev/null and b/reports/trr0000/azr/ddms/trr0000_azr_b.png differ diff --git a/reports/trr0000/azr/images/arch3d.png b/reports/trr0000/azr/images/arch3d.png new file mode 100644 index 0000000..10a015d Binary files /dev/null and b/reports/trr0000/azr/images/arch3d.png differ