🇬🇧 What’s Next after Domain Admin?
Reviews 🇬🇧 Whats Next after Domain Admin and evaluates key implications for security practitioners.
Summary
From Domain Admin to Azure
Venkat Raman Kumar (Red Wolf) and Tiramin describe pentest patterns where MSOL accounts with directory replication privileges led not to on-prem domain admin goals but straight into Azure AD. They argue clients now expect cloud compromise beyond traditional AD takeover because tenants hold PII, financial data, and multi-domain scope.
Hybrid Identity Foundations
The talk covers Azure AD versus on-premises AD differences—tenants instead of forests, SAML/OIDC instead of Kerberos, and REST APIs instead of LDAP. Hybrid sync uses password hash sync, pass-through authentication, or AD FS federation to unify identities across environments.
Reconnaissance Techniques
Unauthenticated checks include login-page redirects and tenant ID lookups via open endpoints. AADInternals enumerates authentication types, domains per tenant, and Azure subdomains via tools like MicroBurst. After DA access, NTDS dumps yield credentials testable against Azure; BloodHound and AzureHound map hybrid attack paths and Global Administrator holders.
Exploiting Azure AD Connect
Azure AD Connect creates paired service accounts whose passwords live in LSA secrets or local databases. Compromising these sync accounts bridges on-prem DA to cloud administration, including creating synced users in domains not yet owned on-premises.
Related talks
The Linux Foundation·30 min
Vlastimil Babka
Explores SLUB: whats next and evaluates key implications for security practitioners.
Linux Security Summit North America·27 min
KP Singh
Demonstrates BPF LSM - Updates and What next and evaluates key implications for security practitioners.
leHACK·53 min
Jayson E Street
Investigates 🇬🇧 JUST Hackers things with Jayson E Street and evaluates key implications for security practitioners.