Az- Synchronising New Users

Reading time: 2 minutes

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Syncing AzureAD users to on-prem to escalate from on-prem to AzureAD

I order to synchronize a new user from AzureAD to the on-prem AD these are the requirements:

  • The AzureAD user needs to have a proxy address (a mailbox)
  • License is not required
  • Should not be already synced
powershell
Get-MsolUser -SerachString admintest | select displayname, lastdirsynctime, proxyaddresses, lastpasswordchangetimestamp | fl

When a user like these is found in AzureAD, in order to access it from the on-prem AD you just need to create a new account with the proxyAddress the SMTP email.

An automatically, this user will be synced from AzureAD to the on-prem AD user.

caution

Notice that to perform this attack you don't need Domain Admin, you just need permissions to create new users.

Also, this won't bypass MFA.

Moreover, this was reported an account sync is no longer possible for admin accounts.

References

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks