Golden SAML Attack

netwrix.com

18 points·mooreds··6 comments

> For a Golden SAML attack, an adversary must first compromise the AD FS service account on the AD FS server.

Then it was game-over from the beginning... Nothing surprising about this and it's not really a weakness of SAML either...

It's like saying a lock is insecure because if you manage to steal the key, you can open it...

It sounds like the initial compromise is easier than it should be, though (I can't believe that after 20 years of known issues of accepting a password hash as password equivalent in MS Windows, that MS is still making this mistake?!!

> The example below uses a few techniques: LDAP reconnaissance to discover AD FS, DCSync to export the service account’s hashes, and then Pass the Hash (PtH) to gain a session on the AD FS Server as the service account.

"It rather involved being on the other side of this airtight hatchway" - Raymond Chen

Yes, but also no. There's nothing inherently wrong with describe the types of keys that are stealable. Especially if it leads to mitigations.

To your point, complaining about reporting on golden tickets is like complaining when a locksmith talks about his new lockpicking methods. Of course if a locksmith ever gets to the lock it's already over, so why let them even speak?

If this warrants a name, then I'm claiming the Unobtainium SAML Attack now--target the keys used to sign the federation metadata. Use those keys to insert new trusted identity/service providers, and use those to issue whatever assertions you want.

Yes, if you get admin rights (left as an exercise to the reader), you get to do admin stuff. Which is anything you want.

Reply on news.ycombinator.com