Hybrid identity infrastructures connect legacy on-premises Active Directory Domain Services (AD DS) with cloud tenants via Entra ID Connect (formerly Azure AD Connect). During red team engagements, identity synchronization boundaries frequently introduce non-obvious lateral movement paths between on-prem domain controllers and cloud Global Administrator roles.

**Attack Surface Scope** A compromise of an on-premises machine hosting the Microsoft Entra Connect sync agent or certificate enrollment endpoints (AD CS) allows adversaries to escalate privileges across the entire corporate identity plane.

1. AD CS Template Misconfiguration (ESC1 & ESC8)

Active Directory Certificate Services provides Public Key Infrastructure (PKI) for authentication. Misconfigured certificate templates that grant CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (ESC1) permit any low-privileged domain user to request a client authentication certificate on behalf of privileged service accounts or Domain Admins.

BASHCOMMAND / CODE
# 1. Request X.509 certificate specifying target Domain Admin as SAN
certipy req -u lowpriv_user@corp.local -p 'Password123' \
  -ca 'CORP-CA' -template 'VulnerableUserTemplate' \
  -upn 'administrator@corp.local' -out admin.pfx

# 2. Authenticate via PKINIT to obtain TGT & NT Hash
certipy auth -pfx admin.pfx -dc-ip 10.10.10.5

2. Shadow Credentials via msDS-KeyCredentialLink

When an attacker obtains write access over the msDS-KeyCredentialLink attribute of a target computer or user object (such as through delegated OU permissions or Access Control List inheritance flaws), they can inject a self-generated asymmetric public key into the object. By initiating a Kerberos PKINIT authentication flow against the Domain Controller, they receive a valid Ticket Granting Ticket (TGT) without altering the user's existing password.

3. Cloud Sync Account Hijacking

The Entra ID Connect Synchronization Service Account (MSOL_* / Sync_*) possesses directory replication privileges (DS-Replication-Get-Changes-All) in on-premises Active Directory. Extracting the local encrypted database credentials (via DPAPI / LocalDB access) yields credentials capable of performing DCSync attacks against the root forest domain.

4. Hardening Strategies

  • Tier-0 Architecture: Treat the Entra Connect server and AD CS Certificate Authorities as Tier-0 assets with identical security controls to Domain Controllers.
  • Audit Certificate Templates: Prohibit ENROLLEE_SUPPLIES_SUBJECT alongside Client Authentication EKUs unless explicitly required and gated by manager approval.
  • Monitor Shadow Credential Modifications: Set alerts on event ID 5136 for modifications made to msDS-KeyCredentialLink.