HackTricks Cloud
HackTricks Cloud
Ask or search…
K
Links
Comment on page

Az - Dynamic Groups Privesc

Support HackTricks and get benefits!

Basic Information

Dynamic groups are groups that has a set of rules configured and all the users or devices that match the rules are added to the group. Every time a user or device attribute is changed, dynamic rules are rechecked. And when a new rule is created all devices and users are checked.
Dynamic groups can have Azure RBAC roles assigned to them, but it's not possible to add AzureAD roles to dynamic groups.
This feature requires Azure AD premium P1 license.

Privesc

Note that by default any user can invite guests in Azure AD, so, If a dynamic group rule gives permissions to users based on attributes that can be set in a new guest, it's possible to create a guest with this attributes and escalate privileges. It's also possible for a guest to manage his own profile and change these attributes.
Get groups that allow Dynamic membership: Get-AzureADMSGroup | ?{$_.GroupTypes -eq 'DynamicMembership'}

Example

  • Rule example: (user.otherMails -any (_ -contains "tester")) -and (user.userType -eq "guest")
  • Rule description: Any Guest user whose secondary email contains the string 'tester' will be added to the group
  1. 1.
    Go to Azure Active Directory -> Users and click on Want to switch back to the legacy users list experience? Click here to leave the preview
  2. 2.
    Click on New guest user and invite an email
  3. 3.
    The user's profile will be added to the Azure AD as soon as the invite is sent. Open the user's profile and click on (manage) under Invitation accepted.
  4. 4.
    Change Resend invite? to Yes and you will get an invitation URL:
  5. 5.
    Copy the URL and open it, login as the invited user and accept the invitation
  6. 6.
    Login in the cli as the user and set the secondary email
    # Login
    $password = ConvertTo-SecureString 'password' - AsPlainText -Force
    $creds = New-Object
    System.Management.Automation.PSCredential('[email protected]', $Password)
    Connect-AzureAD -Credential $creds -TenantId <tenant_id_of_attacked_domain>
    # Chnage OtherMails setting
    Set-AzureADUser -ObjectId <OBJECT-ID> -OtherMails <Username>@<TENANT_NAME>.onmicrosoft.com -Verbose
Support HackTricks and get benefits!