Downloaded 28 times
Uploaded byKarl Fosaaen
Attacking ADFS Endpoints - DerbyCon
The document presents a detailed examination of attacks on Active Directory Federation Services (ADFS) using PowerShell, covering user enumeration, phishing, and dictionary attacks. It provides a comprehensive guide on setting up a test environment, identifying federated endpoints, and mitigation strategies to enhance security. Key insights include the importance of dual-factor authentication and monitoring of federated services to protect against common vulnerabilities.
More Related Content
Similar to Attacking ADFS Endpoints - DerbyCon
![Carlos García - Pentesting Active Directory [rooted2018]](https://cdn.slidesharecdn.com/ss_thumbnails/carlosgarcia-slides-180312234839-thumbnail.jpg?width=640&height=640&fit=bounds)
![Governance, Deployment & Methodologies for Agentic Automation [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day2-251112135038-a386476d-thumbnail.jpg?width=640&height=640&fit=bounds)
Attacking ADFS Endpoints - DerbyCon
- 1. Attacking ADFS Endpointswith PowerShell Karl Fosaaen
- 2. Introductions • Who amI? ‒Karl Fosaaen • What do I do? ‒Wear lots of hats ‒Pen Testing ‒Password Cracking ‒Social Engineering ‒Blog ‒DEF CON Swag Goon ‒Pinball Repair
- 3. Introductions • Hacker JeopardyChampion
- 4. Slides Overview • ADFSOverview • Attack Walkthroughs ‒ Identifying Federated Endpoints ‒ Setting Up Your Test Environment ‒ User Enumeration ‒ Email Validation and Social Engineering Recon ‒ Skype Message Phishing ‒ Dictionary Attacks Against Federated Accounts ‒ Enumeration of Other Federated Domain Users ‒ Pivoting to the Internal Network • Attack Mitigations • Conclusions/Questions
- 5.
- 6. ADFS Overview Active DirectoryFederation Services (AD FS) “is a standards-based service that allows the secure sharing of identity information between trusted business partners (known as a federation) across an extranet.” Source: https://msdn.microsoft.com/en-us/library/bb897402.aspx
- 7. ADFS Overview Some Terms: ‒IdP ‒ SAML ‒ WS-Federation ‒ WS-Trust ‒ ADAL
- 8. ADFS Overview Federation canmean many things ‒ Domain to Domain ‒ Domain to Microsoft ‒ Arbitrary meanings based off of forum posts
- 9. ADFS Overview Frequently FederatedServices • Office365 • Skype for Business • Exchange • Azure AD • SharePoint • Apps in General
- 10. Attack Walkthroughs • IdentifyingFederated Endpoints • Setting Up Your Test Environment • User Enumeration • Email Validation and Social Engineering Recon • Skype Message Phishing • Dictionary Attacks Against Federated Accounts • Enumeration of Other Federated Domain Users • Pivoting to the Internal Network
- 11.
- 12. Identifying Federated Endpoints SideNote: • Office365 had an Authentication Bypass issue ‒ Insecure SAML assertions ‒ Affected all federated Office365 domains ‒ They called out this method in their blog post Source: http://www.economyofmechanism.com/office365- authbypass.html
- 13. Identifying Federated Endpoints •Using Microsoft Online
- 14. Identifying Federated Endpoints •Example user check request
- 15. Identifying Federated Endpoints •Microsoft’s Responses ‒ Federated Domain ‒ Microsoft Managed Domain
- 16. ADFS Overview Diagram of(Managed) O365 federation
- 17. ADFS Overview Diagram of(Federated) O365 federation
- 18. Identifying Federated Endpoints •Let’s wrap it in a PowerShell script ‒ Federated Domain ‒ Microsoft Managed Domain https://blog.netspi.com/using-powershell-identify-federated-domains/ https://github.com/NetSPI/PowerShell/blob/master/Get-ADFSEndpoint.ps1
- 19. Identifying Federated Endpoints •Multiple domains at once https://blog.netspi.com/using-powershell-identify-federated-domains/ https://github.com/NetSPI/PowerShell/blob/master/Get-ADFSEndpoint.ps1
- 20. Identifying Federated Endpoints •Using DNS TXT records
- 21. Identifying Federated Endpoints •Using DNS TXT records • Look for the MS=* records
- 22. Identifying Federated Endpoints •What about the top 1 million Alexa sites? ‒ 47,455 (4.7%) of the top 1 Million have “ms=ms*” records • DNS can be a pain at a million records *Still better than a million HTTP requests to Microsoft • Other options ‒ ADFS.domain.com ‒ STS.domain.com
- 23. Setting Up YourTest Environment
- 24. Setting Up YourTest Environment • Basic Overview ‒ Buy/Have a domain ‒ Set up/Purchase Skype for Business* ‒ Install Skype for Business Client* ‒ Install Lync 2013 SDK* ‒ Get the NetSPI PowerShell Modules ‒ Install Azure AD PowerShell module *Note: This is only needed for testing federated Skype for Business
- 25. Setting Up YourTest Environment • Buy your domain
- 26. Setting Up YourTest Environment • Get hosted Office365 services ‒ Or set up your own server
- 27. Setting Up YourTest Environment • Add your domain to the Office365 portal
- 28. Setting Up YourTest Environment • Set up your user and enable federation
- 29. Setting Up YourTest Environment • Install Skype for Business and the Lync SDK ‒ Requires Visual Studio 2010 for the easiest install https://www.microsoft.com/en-us/download/details.aspx?id=36824
- 30. Setting Up YourTest Environment • Login to Skype for Business as your user
- 31. Setting Up YourTest Environment • Grab the PowerShell modules from NetSPI • https://github.com/NetSPI/PowerShell/blob/master/Power Skype.ps1 • https://github.com/NetSPI/PowerShell/blob/master/Get- ADFSEndpoint.ps1
- 32. Setting Up YourTest Environment • Install the Azure AD PowerShell Module • https://msdn.microsoft.com/en- us/library/azure/jj151815(v=azure.98).aspx
- 33.
- 34. User Enumeration • Wehave: ‒ Some Targets/Endpoints ‒ A testing environment • We need: ‒ Some users to attack • Enumerate some users for the organization off of LinkedIn • Use one of the many recon frameworks • Check out the User enumeration work that nyxgeek spoke about on Friday
- 35.
- 36. Email Validation andSE Recon • Using our federated Skype, we can find information about other federated Skype users • Just open a chat with them
- 37. Email Validation andSE Recon • Or we can just chat with these CEOs
- 38. Email Validation andSE Recon • Let’s just wrap it with PowerShell instead Get-SkypeStatus -inputFile test_emails.txt | ft -AutoSize
- 39. Email Validation andSE Recon
- 40. Email Validation andSE Recon Demo • Get-SkypeStatus -inputFile "C:TempLiveAdmins.txt" | ft -AutoSize • It helps if we run it a couple of times…
- 41. Email Validation andSE Recon
- 42. Email Validation andSE Recon • What about the top 1 million Alexa sites • Of those 47,455 “ms=ms*” records ‒ 45 have “Administrator” accounts that have federated Skype for Business accounts ‒ None of those were actively online during testing… ‒ From nyxgeek: • 38,658 (3.8%) have hostname http://lyncdiscover.domain.com • 486 of 995 unique (Fortune 1000 - 2015) domain names • Note: ‒ Skype doesn’t like opening 2,000+ conversations at a time
- 43.
- 44. Skype Message Phishing Send-SkypeMessage -email[email protected] -message "What's your password?" Get-SkypeStatus -inputFile 'C:Emails.txt' | Select Email,Status | where Status -Match "Available" | select Email | Send-SkypeMessage …
- 45. Email Validation andSE Recon Demo • Get-SkypeStatus -email [email protected] • Invoke-SendSkypeMessage -email [email protected] -message "Hello from Derbycon" • for ($i = 0; $i -lt 10; $i++){Invoke- SendSkypeMessage -email [email protected] -message "Hello $i"}
- 46. Email Validation andSE Recon
- 47. Email Validation andSE Recon
- 48. Email Validation andSE Recon Demo • Invoke-SendSkypeMessage -email [email protected] - message "192.168.1.123test” • Invoke-SendSkypeMessage -email [email protected] - message “www.microsoftsupport.online" • SMB capture/relay running on internal network • UNC works on internal, HRefs work for external • Send this message out to a group, get or relay hashes
- 49. Skype Message Phishing •Further Work ‒ Grab a domains worth of phone numbers • Got this working while making these slides… • Should work if you already have creds ‒ Brute-Forcing Skype Creds • Not easy with the Lync SDK • Nyxgeek has some great methods that will be added to PowerSkype
- 50.
- 51. Dictionary Attacks AgainstADFS • Get-ADFSEndpoint gives us the appropriate command to run for the domain ‒ Federated Domain
- 52. Dictionary Attacks AgainstADFS • Invoke-ADFSSecurityTokenRequest* Invoke-ADFSSecurityTokenRequest -ClientCredentialType UserName -ADFSBaseUri https://adfs.example.com/ -AppliesTo https://adfs.example.com/adfs/services/trust/13/usernamemixed -UserName 'karl.fosaaen‘ -Password 'Winter2016‘ -Domain ‘example.com‘ -OutputType Token -SAMLVersion 2 -IgnoreCertificateErrors https://blogs.msdn.microsoft.com/besidethepoint/2012/10/17/request-adfs-security- token-with-powershell/
- 53. Dictionary Attacks AgainstADFS • Get-ADFSEndpoint gives us the appropriate command to run for the domain ‒ Microsoft Managed Domain
- 54. Dictionary Attacks AgainstADFS • Connect-msolservice – AzureAD PS Module
- 55. Enumeration of Other FederatedDomain Users
- 56. Enumeration of OtherDomain Users • Not totally necessary, but it can be handy 1. $msolcred = get-credential 2. connect-msolservice -credential $msolcred 3. Get-MsolUser -All | ft –AutoSize • This also works for apps using AzureAD for account management
- 57. Enumeration of OtherDomain Users • Using the Graph API
- 58. Enumeration of OtherDomain Users • Using the Graph API $token = Get-GraphAPIToken -TenantName DOMAIN_GOES_HERE Get-GraphData -Token $token -Tenant DOMAIN_GOES_HERE -Resource users ‒ This works for federated and managed domains • Github – https://github.com/NetSPI/PowerShell/blob/master/Get- GraphAPIToken.ps1
- 59. Enumeration of OtherDomain Users Demo • $token = Get-GraphAPIToken -TenantName microsoftsupport.online • Get-GraphData -Token $token -Tenant microsoftsupport.online -Resource users
- 60. Enumeration of OtherDomain Users
- 61. Enumeration of OtherDomain Users • Use Exchange online for non-MS managed domains • If the domain uses Office365, you can connect to it with PowerShell
- 62. Enumeration of OtherDomain Users • Use Exchange online for non-MS managed domains (1/2) $PWord = ConvertTo-SecureString -String 'Summer2016' -AsPlainText –Force $credentials = New-Object -TypeName "System.Management.Automation.PSCredential " -ArgumentList "[email protected]", $PWord
- 63. Enumeration of OtherDomain Users • Use Exchange online for non-MS managed domains that have OWA tied to O365 (2/2) Invoke-Command -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $Credentials -Authentication Basic -AllowRedirection -ScriptBlock {Get-Recipient -ResultSize unlimited} | Export-CSV c:tempemail_users.csv -NoTypeInformation
- 64. Enumeration of OtherDomain Users
- 65. Pivoting to theInternal Network
- 66. Pivoting to theInternal Network • Single Factor VPN Example ‒ Enumerated user emails on LinkedIn ‒ Guessed passwords against MSOnline with PowerShell ‒ Enumerated VPN interfaces ‒ Logged in with guessed credentials ‒ GPP -> Local admin on DA system ‒ DCSync • “Store passwords using reversible encryption”
- 67. Pivoting to theInternal Network • Other Routes ‒ Single Factor Services • Management Protocols • RDP • SSH • Sharepoint • Terminal Services – Web Based • Citrix • VDI • Etc.
- 68. Pivoting to theInternal Network • Malicious OneDrive Documents ‒ Can’t use macros in the online version of excel
- 69. Pivoting to theInternal Network • Malicious SharePoint Documents ‒ Same concept as OneDrive, just a different platform ‒ Backdoor a document ‒ Edit pages
- 70. Pivoting to theInternal Network • Send messages from OWA or Skype for Business ‒ Autodiscover is handy ‒ People will trust their co-workers • “Can you look over this word doc for me?”
- 71. Pivoting to theInternal Network • Attacking Email Accounts ‒ If Autodiscover is enabled, adding an account can be done from anywhere ‒ Email is interesting, but I’d like a shell ‒ This can not be done programmatically with PowerShell (*Easily) ‒ “Malicious Outlook Rules” • Nick Landers – Silent Break Security ‒ “MAPI over HTTP and Mailrule Pwnage” • Etienne - sensepost
- 72.
- 73. Attack Mitigations • EnableDual factor authentication for external endpoints* *On all channels
- 74. Attack Mitigations • Limitfederation to trusted domains • Limit exposed services surface area • Monitor your Federated and Azure endpoints • Enforce strong password requirements
- 75. Thanks! • My NetSPICo-workers ‒ QA/Ideas/Suggestions • My NetSPI Management Team ‒ For giving me time to work on this • Jared Bird - @jaredbird ‒ For asking me about federation years ago
- 76.