Dirk-jan Mollema - I'm in Your Cloud: Pwning Your Azure Environment
Demonstrates a complete Azure Active Directory attack chain from initial access through Global Administrator privilege escalation.
Summary
Azure AD Attack Chain
Dirk-jan Mollema (security researcher, Fox-IT) presents a comprehensive attack chain against Microsoft Azure environments, starting from a compromised employee workstation and escalating to full Azure tenant compromise.
Pass-the-Hash to Azure AD
From a domain-joined Windows machine, the attacker extracts NTLM hashes and uses them against Azure AD's legacy authentication endpoints (Basic Auth, NTLM over WinRM), bypassing modern MFA policies that don't apply to legacy protocols.
AADConnect Exploitation
Mollema reveals that Azure AD Connect sync accounts (required for hybrid identity) hold excessive privileges. Extracting the sync account credentials from the AADConnect server's encrypted configuration allows on-premises-to-cloud lateral movement with Directory Synchronization account rights.
Global Admin Privilege Escalation
Chaining these techniques, the attacker escalates from a standard user to Global Administrator in the Azure tenant, achieving full control over all Azure subscriptions, O365, and Intune-managed devices.
Related talks
Main Stage·36 min
Aviv Sasson
Aviv Sasson details discovering FabricEscape, a severe vulnerability in Microsoft Service Fabric allowing unprivileged containers to seize full cluster admin rights.
Main Stage·43 min
Aviv Sasson
Aviv Sasson presents the complete technical breakdown of FabricEscape (CVE-2022-30137), breaking out of Linux containers to seize full Azure Service Fabric cluster control.
Main Stage·32 min
Alexander Hagenah · nyxgeek
Alexander Hagenah details unauthenticated, zero-log user enumeration techniques across Microsoft Azure, Teams, and OneDrive spanning millions of accounts.