https://appl3b0y.com/tags/azure-ad-connect/ Recent content in Azure-Ad-Connect on appl3b0y Hugo en-us Mon, 22 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/monteverde/ Mon, 22 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/monteverde/ <h2 id="introduction">Introduction</h2> <p><strong>Monteverde</strong> is a medium Windows machine that tells a very modern story: a company running <strong>Azure AD Connect</strong> to sync their on-prem Active Directory to the cloud, and the on-prem account that does the syncing ends up being the thing that gets them owned.</p> <p>The chain is clean. A null RPC session leaks the full user list. Because the domain has <strong>no account lockout</strong>, we can safely spray, and one account uses its own name as its password. That foothold can read an SMB share where an admin left an <code>azure.xml</code> credential file in cleartext, which gives us a WinRM shell as <code>mhope</code>. From there the privesc is the whole point of the box: <code>mhope</code> belongs to the <strong>Azure Admins</strong> group, so it can reach the local <strong>Azure AD Connect (ADSync)</strong> database, and that database stores the sync account&rsquo;s password encrypted with keys we are allowed to read. Decrypt it and it hands back the <strong>Domain Administrator</strong> password.</p>