埃里克·伍德拉夫_未经授权的一种权限提升到全球管理员的技术.pdf

1、#BHUSA BlackHatEventsUnOAuthorizedUnOAuthorizedEric WoodruffSenior Security Researcher,Semperis#BHUSA BlackHatEventsEric WoodruffSenior Security Researcherericonidentityinfosec.exchange/in/ericonidentity#BHUSA BlackHatEventsUnauthorized+OAuth 2.0#BHUSA BlackHatEventsUnauthorized1+OAuth 2.0#BHUSA Bla

2、ckHatEventsUnOAuthorized11h/t to myself,AI did not help with this name#BHUSA BlackHatEventsBackgroundBackground#BHUSA BlackHatEventsBackgroundPlenty of research on Entra ID app permissions and roles1GitHub-secureworks/family-of-client-ids-research:Research into Undocumented Behavior of Azure AD Refr

3、esh TokensAzure Redirect URI Takeover Vulnerability|SecureworksEverything about Service Principals,Applications,and API Permissions|Microsoft 365 Security()Automating application permission grant while avoiding AppRoleAssignment.ReadWrite.All|by Sahil Malik|WStealthy Persistence with“Directory Synch

4、ronization Accounts”Role in Entra ID|by Clment Notin Tenable|Tenable TechBlog|Jun,2024|MediumThe Intersection of Graph and Entra ID:Application Permissions and Roles-Eric on IdentityAzure AD privilege escalation-Taking over default application permissions as Application Admin-dirkjanm.ioThe Most Dan

5、gerous Entra Role Youve(Probably)Never Heard Of|by Andy Robbins|Posts By SpecterOpsTeam MembersHow to Backdoor Azure Applications and Abuse Service Principals()1A very small,non-exhaustive list#BHUSA BlackHatEvents#BHUSA BlackHatEventsOWNING THE CLOUDDOMAIN ADMINGLOBAL ADMIN#BHUSA BlackHatEventsSett

6、ing the stageSetting the stage#BHUSA BlackHatEventsApplication Administrator RoleEntra ID#BHUSA BlackHatEventsApplication Administrator RoleEntra IDApplication AdministratorCloud Application Administrator#BHUSA BlackHatEventsApplication Administrator RoleEntra IDApplication AdministratorCloud Applic