未经授权：通过 Microsoft 应用程序将权限提升至全局管理员.pdf

1、#SECTORCA SecTorCAUnOAuthorizedEric WoodruffSenior Security Researcher,Semperis#SECTORCA SecTorCAEric WoodruffSenior Security Researcherericonidentityinfosec.exchange/in/ericonidentity#SECTORCA SecTorCAUnauthorized+OAuth 2.0#SECTORCA SecTorCAUnauthorized1+OAuth 2.0#SECTORCA SecTorCAUnOAuthorized11h/

2、t to myself,AI did not help with this name#SECTORCA SecTorCABackgroundBackground#SECTORCA SecTorCA#SECTORCA SecTorCADOMAIN ADMINGLOBAL ADMINOWNING THE CLOUD#SECTORCA SecTorCASetting the stageSetting the stage#SECTORCA SecTorCAApplication Administrator roleGlobal AdministratorEntra IDApplication AApp

3、lication AdministratorCloud Application AdministratorApplication BApplication C#BHUSA BlackHatEvents#SECTORCA SecTorCAActiveX Installer(AxInstSV)Provides U.ManualLocal SystemAgent Activation Runtime_.Runtime forManualLocal SystemAllJoyn Router ServiceRoute AllJoManual(TriggLocal ServiceApp Readiness

4、Gets apps reManualLocal SystemApplication IdentityDetermines RunningManual(TriggLocal ServiceApplication InformationFacilitates thRunningManual(TriggLocal SystemApplication Layer GatewaProvides supManualLocal ServiceApplication ManagementProcesses inManualLocal SystemAppX Deployment ServiceProvides

5、infRunningManual(TriggLocal SystemAssignedAccessManagerAssignedAcManual(TriggLocal SystemAuto Time Zone UpdaterAutomaticalManual(TriggLocal ServiceAVCTP serviceThis is AudiRunningManual(TriggLocal ServiceBackground Intelligent TraTransfers fileRunningAutomatic(DLocal SystemBackground Tasks InfrasWin

6、dows infRunningAutomaticLocal SystemBase Filtering EngineThe Base FiRunningAutomaticLocal ServiceBitLocker Drive EncryptionBDESVC hoRunningManual(TriggLocal SystemBlock Level Backup EnginThe BENGIManualLocal SystemBluetooth Audio GatewayService suppRunningManual(TriggLocal ServiceBluetooth Support S