Offensive Azure Security
summary
Demonstrates concrete compromises across three scenarios: Hybrid AD, VM-hosted apps, and managed App Service. Shows that AD Connect’s password-hash-sync grants replicate rights and that the AD Connect DB stores an encrypted service account password retrievable by local admins with adconnectdump, then abused via mimikatz DCSync and pass‑the‑hash to become domain admin. Shows cached Azure CLI tokens and that a Reader can use Azure Run Command to execute system‑level shells on VMs, and that FTP publish profile credentials let an attacker upload a web shell, extract Key Vault secrets and query Azure SQL.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 2:03Agenda
- 5:20Password Hash Sync
- 13:25Legacy Application
- 14:25Domain Admin Application
- 18:25Run Commands
- 23:07App Service
- 26:50Key Rotation
- 29:20Functions
- 31:10Command Prompt
- 32:25Extract credentials
- 34:35Server firewall
- 36:55Public access denied
- 37:30Application to Database
- 43:40Application Gateway
- 44:30SQL Injection
- 47:05Mod Security
- 48:45Offensive Azure Security
related talks
51mAdvanced Attack Vectors in Azure Environments
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
50mHybrid Active Directory Attacks: Anatomy and Defenses
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
53mThe Importance of Identity-Centric Security in 2024
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
38mAll You Need is Guest
55mAzure Attacks Unpacked: Real-World Threats & Lessons