## 5 Experiment and Results
### The First Experiment: Exploit the Dynamic Groups Settings to Escalate Privileges
#### 5.2.3 Exploit the Dynamic Groups  
The purpose of this section is to describe the steps necessary to exploit the dynamic group setup error to perform a privilege escalation attack. The process begins by exploring the system with the PowerShell Azure AD Module, using the reader account. The \"Connect-AzureAD\" command is used for authentication. After that, the following command will provide a list of all dynamic groups. As shown in Figure 3, the display names of all dynamic groups are retrieved.  
The next step is to determine the permissions granted to this group. By using Az PowerShell, it is possible to determine this information using the following command:  
_Get-AzRoleAssignment | Where-Object {$_DisplayName -like 'DynamicVM'}._  
Figure 4 illustrates that the group has the role _\"Virtual Machine Administrator Login\"_ at the subscriber level. As a result of this role, all users in this group can log on to virtual machines with local administrative privileges.  
Figure 3: The dynamic group enumeration.  
The attacker can assume or predict the functionality of the group based on the name and description, but the conditions that must be met to join this group are unknown. One of the methods used to discover the conditions is to analyze the users in the group and try to find out what they all have in common. This command in AzureAD displays all users in a specified group:  
_Get-AzureADGroupMember -ObjectId [ Group ObjectID]_  
where the ID is replaced by the group number that was extracted using the previous command. As shown in Figure 5, the previous command's output provides critical information. The first information is that all users share an \"indep\" word in their e-mail. The second is that there is a guest user, which means that an external user can be invited to the system.  
After analyzing the previous information, the hacker will most likely attempt to add a user via the invite feature. Any e-mail from any service provider can be used, but the username must contain an \"indep\" word; the following e-mail will be used in the next step: \"[EMAIL_ADDRESS]\". It is possible to send invitations through Azure Portal or Azure AD Module by using the following command:  
_New-AzureADMSInvitation -InvitedUserEmailAddress [EMAIL_ADDRESS] -SendInvitationMessage_  
_$True -InviteRedirectIt \"[[http://myapps.microsoft.com](http://myapps.microsoft.com)]([http://myapps.microsoft.com](http://myapps.microsoft.com))\"_  
Upon successful completion of the process, an e-mail will be sent, containing an account activation link, which will be used to prepare the account and password. From the outputs of the following command, the user \"[EMAIL_ADDRESS]\" has been added to \"DynamicVM\", indicating that the escalation process was successful. The outputs of the command are shown in Figure 6.  
Figure 4: The dynamic group role.  
Figure 5: Enumeration of the users.  
Figure 6: Enumeration of the external user.  
The final step is to demonstrate [PERSON]'s ability to execute commands on virtual systems. It is possible to execute commands remotely on one of the virtual systems using the PowerZure framework. First, log in with the \"[EMAIL_ADDRESS]\" account, and then execute a command to list all existing virtual machines. Finally, execute commands on one of the VMs. This process is done using the following commands. The outputs of the previous steps are shown in Figure 7.