Get-MSOLCredentials.ps1 ADSync Privilege Escalation Get the information from the DB to retrieve the encryption keys from the KeyManager. Get the config and encrypted password from the DB. Fetch the keys and decrypt the password. References: https://blog.xpnsec.com/azuread-connect-for-redteam/ https://0xdf.gitlab.io/2020/06/13/htb-monteverde.html