iiinova — where your digital self keeps evolving

Clément Notin @cnotin.bsky.social · 02/06/2025

🤔 We have answers to your questions on #BadSuccessor, the latest AD vulnerability www.tenable.com/blog/frequen... 🕵️ Tenable Identity Exposure customers can check their exposure with our recently released Indicator of Exposure (IoE): www.tenable.com/indicators/i...

tenable.com

Frequently Asked Questions About BadSuccessor

Frequently asked questions about “BadSuccessor,” a zero-day privilege escalation vulnerability in Active Directory domains with at least one Windows Server 2025 domain controller.

000

Clément Notin @cnotin.bsky.social · 24/04/2025

Here's (finally!) what I've found about this 😉 bsky.app/profile/cnot...

132

Clément Notin @cnotin.bsky.social · 24/04/2025

To summarize, these hardenings are great (and the new app will likely allow to support some security features), but it doesn't prevent everything or even introduces new cracks to monitor. There's no magic to keep this feature working anyway 😉

010

Clément Notin @cnotin.bsky.social · 24/04/2025

And what about the new "Microsoft Entra AD Synchronization Service" application? 🤔 It exposes a new permission: ADSynchronization.ReadWrite.All, which also allows to call the sync API when granted to a service principal ➡️ same impact

100

Clément Notin @cnotin.bsky.social · 24/04/2025

The Directory Synchronization Accounts role has lost most of its Entra permissions... but it retains implicit permissions to call the undocumented synchronization API 😯 ➡️ reset hybrid users' passwords And so does the new "On Premises Directory Sync Account" Entra role 👀

100

Clément Notin @cnotin.bsky.social · 24/04/2025

Microsoft hardened the Entra ID synchronization feature last year: - restricted permissions on Directory Synchronization Accounts role - new dedicated sync app Let’s find out how sync still works 🔍 Some old tricks persist—and new ones have emerged 💥 tenable.com/blog/despite... 🧵

tenable.com

Despite Recent Security Hardening, Entra ID Synchronization Feature Remains Open for Abuse

Microsoft synchronization capabilities for managing identities in hybrid environments are not without their risks. In this blog, Tenable Research explores how potential weaknesses in these synchroniza...

101

Clément Notin @cnotin.bsky.social · 24/03/2025

🎥 Here's the recording of last week's webinar where I shared how to protect Entra ID from real-world attacks 🏴‍☠️, beginning with federation backdoors/privesc, using Tenable Identity Exposure

010

Clément Notin @cnotin.bsky.social · 23/12/2024

⚠️ this is likely unsupported by Microsoft even though this method is advised to clean broken trust objects support.microsoft.com/en-us/topic/... And as described in the doc, this operation is not global: it's only effective in the same LDAP connection. It's why using ldp or LDIFDE helps

support.microsoft.com

KB5040758: Deleting a stale, corrupt, or orphaned Trust object in Active Directory - Microsoft SupportYour Privacy Choices Opt-Out Icon

010

Clément Notin @cnotin.bsky.social · 23/12/2024

Log-in as Domain or Schema admin - Use ldp.exe and set the "schemaUpgradeInProgress" operation to 1 using Browse -> Modify - Now you can clear this protected attribute - Or set any value Then stop it by setting "schemaUpgradeInProgress" to 0

120

Clément Notin @cnotin.bsky.social · 23/12/2024

You know how some system AD attributes cannot be edited even when Domain Admin? "Error 0x20B1 The attribute cannot be modified because it is owned by the system." This can be bypassed using the schemaUpgradeInProgress modify operation learn.microsoft.com/en-us/opensp... 😉⬇️