README.md

Get-MSOLCredentials.ps1

ADSync Privilege Escalation

• Get the information from the DB to retrieve the encryption keys from the KeyManager.
• Get the config and encrypted password from the DB.
• Fetch the keys and decrypt the password.

References:

• https://blog.xpnsec.com/azuread-connect-for-redteam/
• https://0xdf.gitlab.io/2020/06/13/htb-monteverde.html