Alright, so let's move ahead with our next talk and before we go ahead, some little requests.
One is to keep your phones on silent because that would end up disturbing the speaker.
Apart from that, if we end the discussion, if the discussion ends and if there are some
questions that you'd like to ask, the speaker would be available in the speaker's lounge
next door. So you can reach out to him over there and continue with asking your questions
if the time ends over here.
Alright, so up next we have the very famous Dr. Nestori Sinema and he is, I mean, so we
all know him, he's a very famous person and he's a Senior Principal Information Security
Researcher at SecureWorks CTU. Previously, Dr. Sinema worked as a CIO, consultant, trainer
and a university lecturer for over 20 years. And yes, he speaks in regular conferences,
he's been Microsoft's most valuable security researcher. He also holds multiple Microsoft
certifications and yep, he has spoken in a lot of conferences with respect to Microsoft
365 and Azure AD Security. So please welcome Dr. Nestori Sinema.
Thank you, for kind words. Let's try to make them work. Okay, so...
Does it work? Of course it doesn't. That's nice.
Now we know. Okay, so well, you already introduced me, so thanks about that. So again, my name is
Dr. Nestori Sinema and I come from Finland, but everything else you said is true, so we can move
forward. By the way, follow me on Twitter or X or whatever it's called nowadays. And
Mastodon and Blue Sky, so I'm everywhere. With the same title, Dr. Azure AD. And most of you,
know me best of my two AD internals. Who has used that? Okay, if you haven't, you should,
because APT29 uses that too. Also known as Nobilium. Well, at least they have used the same
techniques according to my attack framework. Okay, what else? Yes, so...
I was in summer holiday with my wife in Spain and in July 11th, Microsoft decided to change
the name of the product, so it's not anymore Azure AD, now it's Android AD. And that's very great
for a guy whose handle is Dr. Azure AD. And the tool name is AAD internals. But that's not the
first, sorry, first part, because I actually ordered a new car before we went to the holidays
and it was then delivered after that. And I chose a vanity place to that. And of course, that's AAD.
So...
So every time Microsoft is doing rebranding, it costs me 1000 euros, so it's pretty much the same as dollars.
Okay, so I have some slides and demos.
And I asked, do you want to have recorded or live demos? And most of you wanted to have
recorded, so recorded it's going to be. Well, I have one live demo at the end, but
otherwise all the demos are recorded.
And let's start with some background information. So how many of you know what is Azure AD
or Android AD? Okay, but short introduction, just for the background information. So it's
Microsoft cloud-based identity and access management. Closer? Oh, okay.
Better? Okay. So let's try to get this to work. Okay. And it's used by, of course, Microsoft's
own products like 365 and thousands of third-party applications, so there's a lot of them.
And it has multiple authentication options, so that's important for attackers. We will get back
to it later. And usually all the stuff that is in there is synchronized from on-prem environment
or on-prem AD, so that's how it's usually done. And that is done using Azure AD Connect
or Cloud Sync, so there are two different things to do that.
Yes, so about... well, the information I'm going to share with you today, I used that actually
last year to gather some data about how many of people are using Azure AD actually.
And I think Nick's geek had a presentation earlier... well, it was yesterday, and so he
had some background information, but I have also. So let's start with Fortune 500 organizations. So
about 80 months ago, 88% was using Azure AD, which is a quite big number. But in
Finland, where I come from, the percentage is 98. So it's a lot more. And then top universities
roughly 95% is using. And this next one is funny. So in Finland, we have like 302 municipalities,
like cities and towns, and there's one who doesn't use. So it's almost 100%. But if you round up,
it's 100%. So it's fair to say that everybody in Finland is using, and globally also like 90%. So
that is very interesting to attackers. So there's a lot of organizations who are using,
but you still need to know what to attack. So not just that they are using, but are there
something that you can actually attack? So well, this is... everybody knows this. So at least some
kind of version about cyber killshame. So we are in the recon village, so we are in the first wave.
So we want to gather information so that we can start the weaponization, then the actual attack.
But we are not doing anything bad at this point. Well, oh, nothing bad. So we are not attacking,
but of course, we are gathering intelligent information. So that is kind of also bad.
But luckily, there's a lot of stuff available like for free, and even without any authentication.
Okay, so I told you that there are multiple authentication options. And usually you have
connected your on-prem to cloud. And here are four, at least currently, available authentication
options. So I'm not going to deep dive into the details, but still, I'm going to introduce each
of those. So the version on the left is called Identity Federation, or ADFS is the, well,
the product or Windows feature you use to implement that. So have any of you heard about
golden time attacks? Yes, so this is the one. You can do that. Okay. And this was the first
available option that allows you to use the same credentials in on-prem and cloud.
Okay, but it's very like a big environment. So you need to have at least four servers to run that.
And that's not a very good option for small businesses, for instance. So then Microsoft
introduced the password hash synchronization. So basically we have a component, this Azure AD Connect,
and it's synchronizing both users and other objects, but also password hashes, but not the
NT hashes. Well, technically yes, but they are re-hashed a thousand times, so that's okay.
And then there's a new stuff introduced a couple of years ago called password authentication,
which means that you install a small agent on your on-prem environment. And then when people
are trying to authenticate, those credentials are sent to that agent, and then it tries to
log in using your Windows domain, and if that's okay, the user gets in. And the last one is
certificate-based authentication. And also there's a funny thing called seamless single sign-on,
which is Kerberos-based single sign-on, which all the deficiencies that the Kerberos has.
So basically, if you are able to steal a certain NT hash from your on-prem AD,
you can log in as any user you want to cloud, if they are using that.
So there's five different ways, at least, how you can attack the authentication stuff.
And why this is important? Well, I have a couple of slides here. So first one is for ADFS. So there
are actually eight different ways, at least, how you can obtain the token signing certificate and
perform calls and attacks. So this is very complicated, and you can just get one of those
paths and you are good to go. So if you want to protect against those, that's not that easy,
and it's good for attackers, right? And the second one is for PTA. And the PTA is a very interesting
product, because if you are able to compromise the server that is running that PTA agent,
you can export the certificate, and after that you have a persistent undetectable way to perform
denial-of-service attacks, and also use that as a backdoor. And that's quite neat. So if they are
using that, it would be nice to know. Well, unfortunately, at least now we can't know if
they are using PTA. Other methods, yes, but not the PTA. But this is just to show you that these
things are very complicated, and when they're complicated, they are always vulnerable somehow.
Okay, then about hybrid cloud security, a couple of words. So
people have asked me for years, is cloud safe? And I would say that yes, it is.
At least until recently when they stole that token signing certificate, but usually it's okay.
So if you want to, as a user, access the cloud, you need to have like
some proof of identity, and that's it. So it's easy to use. But it's not good for bad guys,
because they don't have the proof of identity. So they have two options. So they can either
get the proof of identity, like using phishing, and then they are able to log in, or they can
spoof the identity. And how can they do that? Well, if you have connected your on-prem environment
to cloud, you're actually drilling holes to that safe cloud. And now the attackers can attack
using the old methods they already know to those on-prem components, and via them they can go
and attack your cloud. So this is what happened with Solarigate, actually.
Okay, and then some goals to our recon. So what we want to do, we want to enumerate
authentication options, so that we know where to attack. We want to find valid accounts and
domains, so that we might do some social engineering, for instance. And of course,
we could do phishing much easier if we know the valid accounts. And we don't want to leave any
traces, meaning that we don't want a target organization to detect us, obviously. That
would be otherwise quite a stupid recon. Okay, so then how to get OSINT, or open source intelligence?
So we have two options. So we have anonymous API calls, and this is for everybody. So everyone
can use these APIs to get that information. And then another way is to use authenticated APIs
calls, and that requires that you need to have an Azure AD tenant. It doesn't have to be the
target tenant. You can just sign up for a trial, and that's it. You just need to have one,
which means that you need to log into your own tenant, so that you can get information
from other tenants. So this is how Azure AD is done, or built.
Okay, so what can you get using these anonymous API calls? So first of all, you will get
all registered domains that the target tenant has. You may find out that is that domain
managed or federated, and if it's federated, it's open for code on some attacks.
That's always good to know. And by the way, you only need one domain being federated, so that you
can do those attacks. And of course, you can have DNS information, so are there any mail exchange
records, or SPF records, and so on. So you know that is that organization routing mail through
Microsoft 365. You can have tenant ID with domain name. You can find out does the user exist.
So if you have a username, you can try that. Is that real username? And then you can see that
is the tenant using, or is the tenant ever used, a thing called Azure AD Connect Cloud Sync,
which is a new kind of tool instead of Azure AD Connect. So this Cloud Sync is a new version
that Microsoft would like us to use, but usually we don't. And then we also can find out that
is the tenant using Microsoft Defender for identity? So we will more likely get caught
if they are using. So it's good to know beforehand. Okay, so domain names. So how can we get those?
So technically, this is using Exchange Online Auto Discover Service, which is used usually for
for that, that if your user have your Outlook client, and they type in their username,
then the Outlook can go to the Auto Discover Service to get information that where that Outlook
should connect. However, if you want to, you can make a federation between two Exchange
organizations. And a federation means that if your organization A and organization B, you can allow
them to see other calendars, for instance. So that's the federation. And for that purpose, the
Auto Discover is also used that you can ask that, okay, here's a domain name, what other domains
there are. And I actually talked today with one of the Microsoft guys, he might be. So he asked me
that, is it really true that you can get this information from Azure AD? Because the documentation
said that you need to be at least a guest to get that information. And I said, no, that's not
true. So basically, there's an API endpoint, you send there a SOAP request that has a domain,
and as a return, you will get a list of all the other domains that tenant has. And it's very good
for recon, because there might be some new product name, for instance, or there might be some mergers
coming up. So they have just registered domains there and so on. So yeah, and also we can see that
the Exchange version is 2015, which is quite old. I don't know, is it really that old, but at least
it says so. So that was the first one. And then there's different APIs you can call to get
information about the domains itself. So what's the domain type, is it managed or federated,
or does the user exist? So there's different endpoints to do that. And then you can also
see that this technical name, desktop SSO, the sailing name is seamless single sign-on, is that
enabled? So that was the Kerberos stuff. So if you can get that, if he has a certain service account,
you can then log in as any user to the cloud, if they are using this. And then you can also see
that is the certificate-based authentication enabled? So a lot of information, and these
are all like open APIs. And then, I don't know, did you see Nick's talk yesterday?
But he actually found a nice way to enumerate users using OneDrives. So usually if you have a
user who has a license for Teams, for instance, that user also will have a OneDrive.
And basically what you do is that if your organization is like, let's say, Microsoft,
and the username is like user at microsoft.com, you need to normalize that, which means that you
just replace at and dots with an underscore. And then you make HTTP head request to that URL.
And if that returns 200 or something like that, the user exists. And if it's 400, it doesn't exist.
So quite a neat way. And this is good because there's no login events anywhere. So a target
organization can detect this. Only Microsoft can, but not the target organization.
And these are also not throttled. These other APIs are. So after 100,000 something, you will
get false positives that it exists, even though it doesn't. Okay. Tenant ID, just call that API,
call, sorry, that URL with a domain name, and you will get back in a JSON file where the
tenant ID exists. So you can parse it, for instance, from here. So quite easy, neat way to do that.
And then the Azure AD Connect Cloud Sync. So how do we know if the organization is using that?
Well, they decided to make their username standard. I mean, the admin, sorry, the service account
name is standard. It's always the same. AD2AD Sync service account at domain name. And if that
user exists, you know that they are using that. So quite easy way, again, to find out internal
information of the organization. And the last one is the Defender for Identity. So if these DNS
names exist, then you know that they are using that. So again, quite easy way. So just ping that
if it answers or just do other NS lookup, and if you can find that, you know that they are using
Microsoft Defender for Identity. Okay. And here are all the commands you can use with my
AD internal toolkit. So I'm going to show demos for this. So four commands, and each are doing
one bit, and then the last one is going to do all the stuff. So let's start with the first one.
So we want to get login information to a certain domain. We just give a domain name, and it is
calling three or four different APIs, and then just put them all together. So we can see that
what we can see. We can see that account type is federated, for instance. So Microsoft.com is
federated. And then let's move forward to the next one. So we're going to get the tenant ID,
but this is quite simple. You just give a domain name, and it will return you the tenant ID.
And tenant ID you will need to use in certain API calls if you are doing some hacking, if you
get inside the organization. So it's a very valuable information. And the next one, we're
going to list all the domains of the organization. And this is actually quite fast. So it's
second or something, and it will list all the domains. For instance, Microsoft has
about 280 or something domains. Like tune.net. Does anybody remember that? Yeah.
Okay. And the last one is the actual like kill chain functionality I've included in my tool.
So it provides some domain name, and it will do all the stuff. So it will gather all the
information it can, especially from the domains. So the last part is FT means format table.
But this takes a lot, so I, you know, cut away something. And here we can see a lot of new
information. And let's just scroll back up. Yes. So here we have like what is tenant brand,
tenant name, tenant ID, tenant region. That's Bird Wild. Yes. And it doesn't use desktop SSO
and the Cloud Sync they are using. So that's a good information. And then if you want to do some
phishing stuff, it's good to know that is it using this particular like domain for
for Mail Exchange? Is it sending it from the Cloud? So if there's SPF record, it means that
it is sending outside also. And DMARC is, well, it also says that it is using that for sending email.
But all that kind of information you can get. And also the STS means that what is the Federation
server name that that particular domain is using. OK. And then we have the authenticated API calls,
which means that you need to have your own tenant where you can log in and then gather stuff of
other other tenants. And what you can get is the you can get the tenant name or domain from
tenant ID. And where do you use this? Well, actually, this is more like for admins. So
if you have you can see that some people are logging in using some weird application.
You can't see who created that, but you can see the tenant ID who created that application. So
you can do like a reverse lookup for that. And then if you have the user's email, you will get
the user's object ID in Azure AD using that email. You can have a user's display name and also
user's UPN or user principal name. But this is also neat. You can see team status of that user.
If the user is using Teams. And here are the commands again, which I have in AAD internals.
So you can get the domain, you can find the Teams user, and then you can see if that user is
available. So let's start. So first, we need to get an access token because we need to be
authenticated. And this is for our own tenant. So I'm just going to get one for Microsoft Graph,
which you can use to get that tenant ID, sorry, tenant domain using tenant ID. So you need to
have that. And you need to be actually global admin in your own tenant. I don't know why,
but you need to be global admin, but because it's your own tenant, you can be. And now you can get
ask information about other tenants. The next one is, what was it? Access token for Teams.
Because Teams has quite interesting APIs, and one of them is that you can search external user.
And when you give the user principal name of the target user, it will get a lot of nice information.
Well, for obvious reasons, I'm not showing those to you, but it shows what is the user's tenant ID,
what is the user's user principal name, what is the display name, and then what is the object ID.
Now, I don't know why that information is revealed, but it is there. And one thing that you can do
with the object ID is that you can see that is that user online in Teams. So let's see how that goes.
So you can provide either user principal name or the object ID, and then it will tell you is this
user online or not. And actually, in Nick Skeak's talk, he had a nice graph that he used this API
to get information that were Microsoft employees working or not. And they had an all-hands meeting
on Friday at a certain time, because they were all offline. And now we can see that this particular
person is offline. And this is... I don't know why this information is available. Well, because,
well, information must be free and so on. Okay. But yes. So basically, that was all I got for
those internals commands. But for those who don't want to type PowerShell, I made a tool,
online tool. It's from aadinternals.com. And it can tell you the same thing that I showed to you.
And I'm going to demonstrate that, by the way, next.
So here we are. And we go to aadinternals.com. And let's zoom a bit.
So here you can give a tenant ID. You can give domain name or email address of a user.
Let's try this. So we can see that it's the CIO of Microsoft doing something.
Okay. So we can see what's the logo of that organization. We have tenant branding, tenant ID
worldwide. They are not using single sign-on, but they are using the Azure Cloud Connect sync.
No certificate-based authentication, at least for this user. And they have that much verified domains.
I might mistype this, actually. I always do that. Let's try again.
So yes. Now we can see that he's away. So there's no calling to him.
And actually, if you think about this team status, that's a very good recon information,
because you can actually follow somebody. What is he doing? So is he available? Is he not?
And then you can, like, well, you know what you can do with that information.
And you know where people are. And also, like, we have links to...
So we can click here. Let's see how this works. So it wants me to sign in.
And let's see, does this work? No, it didn't. So, but usually there's AD FS service. They are
asking that, where do you want to log in? So you can actually see
other organizations. This organization has business relationships. And that's also
more information for you to start, like, searching for more or gathering more intelligence.
Okay. But yes, that was all. Thank you.