Dirk-jan

Hacker at @OutsiderSec. Researches AD and Azure (AD) security. Likes to play around with Python and write tools that make work easier.

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Dirk-jan @_dirkjan]

@CptSC @olafhartong Not sure if it's recent or random, but heard it from multiple people over the past few days.

[Dirk-jan @_dirkjan]

And now have it confirmed from multiple people that the new tenant arrives in a broken-by-default state where MFA is required for your one admin user but MFA registration is blocked by CA, no workarounds 😬 cc @olafhartong

[Dirk-jan @_dirkjan]

Seems Microsoft is nuking all M365 developer program tenants, with no path to migrate to their "new" setup. Just create a new tenant, of course subject to the current eligibility requirements. There goes my research tenant I've been using for 7 years... 🙄 https://t.co/sQ7Fsz0Wg9

[Dirk-jan @_dirkjan]

@KarhulaSami I don't have whatever that is so don't know if it would make you qualify

[Dirk-jan @_dirkjan]

Seems Microsoft is nuking all M365 developer program tenants, with no path to migrate to their "new" setup. Just create a new tenant, of course subject to the current eligibility requirements. There goes my research tenant I've been using for 7 years... 🙄 https://t.co/sQ7Fsz0Wg9

[Olaf Hartong @olafhartong]

@_dirkjan @PyroTek3 This is a huge burden on so many people and a huge pain to migrate all these tenants. Very strange decision. I’m sure there has been some abuse but this is not the way to treat many paying researchers.

[Dirk-jan @_dirkjan]

@pl4nty Yeah I suppose I could get the custom domain moved to a new tenant with some additional effort.

[Dirk-jan @_dirkjan]

@Cyb3rMonk Think about all the time it saves them not having to make a migration path though!

[Dirk-jan @_dirkjan]

@Cyb3rMonk Good motivation 😅

[Dirk-jan @_dirkjan]

@cnotin I also have some paid licenses and Azure stuff in that tenant, wonder what they'll do with that.

[Dirk-jan @_dirkjan]

Last chance to sign up for my Entra ID class in The Hague, starting November 16th.

If that doesn't work out, I will also be back teaching at Insomni'hack next year in the first week of February.

More info: https://t.co/RowaIQlU5e and https://t.co/J7yYUnMHc3

[Dirk-jan @_dirkjan]

@al3x_n3ff For most tools it wouldn't make a huge difference but bloodhound python has quite some LDAP code that I'd prefer not to have to rewrite. Besides impacket LDAP is very minimal and I'm not sure it even supports the mechanisms I use for efficiency like generators.

[Dirk-jan @_dirkjan]

Last week me and GPT-6 wrote a wrapper library for ldap3 AD auth methods and ported several of my AD tools to use it. BloodHound-py, krbrelayx and adidnsdump now use it for their LDAP connections: signing/sealing over 389 by default (ntlm+kerberos) and channel binding for ldaps.

[Dirk-jan @_dirkjan]

@SkelSec Yes but then I'd need to rewrite a lot more and I'd need to annoy you every time it breaks 😅.

[Dirk-jan @_dirkjan]

Works on top of the stable ldap3 version, no forks needed, no GSSAPI library dependencies, impacket only. Thanks to the folks who submitted PRs to add support for signing, which was the base for much of the implementation.

[Dirk-jan @_dirkjan]

@gentilkiwi It mimics the best 😅

[Dirk-jan @_dirkjan]

Current research status

[Dirk-jan @_dirkjan]

Very cool technique to bypass SMB signing, appears to be patched on recent Windows versions.

[aas @aas_s3curity]

I wrote up a way to defeat enforced SMB signing for relay.

It abuses a documented SMB re-authentication behavior.

I'm surely missing nuance and prior art. Corrections welcome.

Writeup:
https://t.co/qzF9MUF9MJ

PoC:
https://t.co/O0UN4gdVfJ

[Dirk-jan @_dirkjan]

@DrAzureAD @Microsoft @JohnLaTwC @TimbMsft Is it bad that I'm excited about this? 😅

[Dirk-jan @_dirkjan]

@unsigned_sh0rt I would read it. I enjoy reading research so why would I offload that to an LLM.

[Dirk-jan @_dirkjan]

@ByteDxnce You are correct but I can't spoil too much 😄.

[Dirk-jan @_dirkjan]

I suppose using LoadLibraryA counts as a valid auth coercion technique 😄.