# Az - PTA - Pass-through Authentication

{{#include ../../../../banners/hacktricks-training.md}}

## Basic Information

[From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta) Azure Active Directory (Azure AD) Pass-through Authentication allows your users to **sign in to both on-premises and cloud-based applications using the same passwords**. This feature provides your users a better experience - one less password to remember, and reduces IT helpdesk costs because your users are less likely to forget how to sign in. When users sign in using Azure AD, this feature **validates users' passwords directly against your on-premises Active Directory**.

In PTA **identities** are **synchronized** but **passwords** **aren't** like in PHS.

The authentication is validated in the on-prem AD and the communication with cloud is done by an **authentication agent** running in an **on-prem server** (it does't need to be on the on-prem DC).

### Authentication flow

<figure><img src="../../../../images/image (92).png" alt=""><figcaption></figcaption></figure>

1. To **login** the user is redirected to **Azure AD**, where he sends the **username** and **password**
2. The **credentials** are **encrypted** and set in a **queue** in Azure AD
3. The **on-prem authentication agent** gathers the **credentials** from the queue and **decrypts** them. This agent is called **"Pass-through authentication agent"** or **PTA agent.**
4. The **agent** **validates** the creds against the **on-prem AD** and sends the **response** **back** to Azure AD which, if the response is positive, **completes the login** of the user.

> [!WARNING]
> If an attacker **compromises** the **PTA** he can **see** the all **credentials** from the queue (in **clear-text**).\
> He can also **validate any credentials** to the AzureAD (similar attack to Skeleton key).

### On-Prem -> cloud

If you have **admin** access to the **Azure AD Connect server** with the **PTA** **agent** running, you can use the **AADInternals** module to **insert a backdoor** that will **validate ALL the passwords** introduced (so all passwords will be valid for authentication):

```bash
Install-AADIntPTASpy
```

> [!NOTE]
> If the **installation fails**, this is probably due to missing [Microsoft Visual C++ 2015 Redistributables](https://download.microsoft.com/download/6/A/A/6AA4EDFF-645B-48C5-81CC-ED5963AEAD48/vc_redist.x64.exe).

It's also possible to **see the clear-text passwords sent to PTA agent** using the following cmdlet on the machine where the previous backdoor was installed:

```bash
Get-AADIntPTASpyLog -DecodePasswords
```

This backdoor will:

- Create a hidden folder `C:\PTASpy`
- Copy a `PTASpy.dll` to `C:\PTASpy`
- Injects `PTASpy.dll` to `AzureADConnectAuthenticationAgentService` process

> [!NOTE]
> When the AzureADConnectAuthenticationAgent service is restarted, PTASpy is “unloaded” and must be re-installed.

### Cloud -> On-Prem

> [!CAUTION]
> After getting **GA privileges** on the cloud, it's possible to **register a new PTA agent** by setting it on an **attacker controlled machine**. Once the agent is **setup**, we can **repeat** the **previous** steps to **authenticate using any password** and also, **get the passwords in clear-text.**

### Seamless SSO

It's possible to use Seamless SSO with PTA, which is vulnerable to other abuses. Check it in:

{{#ref}}
seamless-sso.md
{{#endref}}

## References

- [https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta)
- [https://aadinternals.com/post/on-prem_admin/#pass-through-authentication](https://aadinternals.com/post/on-prem_admin/#pass-through-authentication)

{{#include ../../../../banners/hacktricks-training.md}}



