Az - Dynamic Groups Privesc
- If you want to see your company advertised in HackTricks or if you want access to the latest version of the PEASS or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
Dynamic groups are groups that has a set of rules configured and all the users or devices that match the rules are added to the group. Every time a user or device attribute is changed, dynamic rules are rechecked. And when a new rule is created all devices and users are checked.
Dynamic groups can have Azure RBAC roles assigned to them, but it's not possible to add AzureAD roles to dynamic groups.
This feature requires Azure AD premium P1 license.
Note that by default any user can invite guests in Azure AD, so, If a dynamic group rule gives permissions to users based on attributes that can be set in a new guest, it's possible to create a guest with this attributes and escalate privileges. It's also possible for a guest to manage his own profile and change these attributes.
Get groups that allow Dynamic membership:
Get-AzureADMSGroup | ?{$_.GroupTypes -eq 'DynamicMembership'}- Rule example:
(user.otherMails -any (_ -contains "tester")) -and (user.userType -eq "guest") - Rule description: Any Guest user whose secondary email contains the string 'tester' will be added to the group
- 1.Go to Azure Active Directory -> Users and click on
Want to switch back to the legacy users list experience? Click here to leave the preview - 2.Click on
New guest userand invite an email - 3.The user's profile will be added to the Azure AD as soon as the invite is sent. Open the user's profile and click on (manage) under Invitation accepted.
-
- 4.Change
Resend invite?to Yes and you will get an invitation URL:-
- 5.Copy the URL and open it, login as the invited user and accept the invitation
- 6.Login in the cli as the user and set the secondary email# Login$password = ConvertTo-SecureString 'password' - AsPlainText -Force$creds = New-ObjectSystem.Management.Automation.PSCredential('[email protected]', $Password)Connect-AzureAD -Credential $creds -TenantId <tenant_id_of_attacked_domain># Chnage OtherMails settingSet-AzureADUser -ObjectId <OBJECT-ID> -OtherMails <Username>@<TENANT_NAME>.onmicrosoft.com -Verbose
- If you want to see your company advertised in HackTricks or if you want access to the latest version of the PEASS or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
Last modified 6mo ago