The Business Risk of Hybrid Compromise: From On-Prem to the Cloud

Introduction

In a recent engagement, we were tasked with conducting an Objective-Based Penetration Test (OBPT) targeting a hybrid on-premises and Microsoft Azure environment. The assessment aimed to emulate a determined adversary who begins with an internal foothold without valid credentials.

This engagement demonstrated how a single overlooked weakness could cascade into full compromise of both on-prem and cloud environments, exposing critical data, operations, and compliance posture to significant risk.

NOTE: This blog emulates a real-world, objective-based penetration test conducted for a client in the educational sector. To protect client confidentiality, all scenarios have been recreated in our lab environment. Screenshots and images may be blurred or modified for privacy.

Objective

This engagement assessed the potential business impact of an internal compromise within the client’s on-premises and Microsoft Azure environment. Starting from a single foothold without credentials, the objective was to determine how an attacker could escalate privileges, access sensitive data, and disrupt operations, ultimately providing leadership with a clear picture of risks to business continuity, regulatory compliance, and organizational resilience.

Over the course of the engagement, we escalated from a single internal foothold to achieving full control of both the on-premises domain and the Azure tenant, even pivoting into additional AD domains. This demonstrated how a real-world attacker could compromise the organization’s most critical systems, highlighting urgent risks and clear areas for defense improvement.

Initial Foothold: LLMNR Poisoning in Action

We began with standard network reconnaissance and quickly identified that LLMNR (Link-Local Multicast Name Resolution) was enabled across the environment, a common but dangerous misconfiguration. This created an opening for LLMNR poisoning, showing how outdated protocols can provide attackers with an easy entry point.

Using Responder, we poisoned LLMNR requests and captured an NTLM hash from a privileged internal account. Once cracked offline, these credentials gave us valid access to begin moving deeper into the network.

Expanding Access: Credential Dumping and Lateral Movement

With initial access established, we turned our attention to expanding control. Attacks like credential dumping illustrate how quickly a single set of credentials can cascade into broader compromise.

By extracting credentials from LSASS memory, we obtained service account credentials with local admin rights across most devices. This gave us the ability to move laterally across the environment with ease, a reminder that weak credential hygiene significantly increases the blast radius of any compromise.

Despite having CrowdStrike Falcon EDR fully deployed and showing a healthy status, we were able to operate undetected. This included stealing credentials, moving across systems, and escalating access, highlighting that even modern security tools can miss determined threat actors.

CrowdStrike EDR Bypass : Falcon sensor active and connected

The Breakthrough: Domain Admin via Session Hijacking

Privilege escalation represents the turning point of most intrusions, and this engagement was no exception. Once attackers gain Domain Admin access, they gain near-total control of the on-premises environment.

During enumeration, we discovered a domain administrator session on a compromised server. By hijacking this session, we created a new domain admin account and achieved complete control of the on-prem Active Directory environment.

Pivot to the Cloud: Abusing Azure AD Connect

Hybrid environments blur the line between on-premises and cloud environments, making identity synchronization a critical risk. In this case, the presence of Azure AD Connect created a seamless bridge for our escalation.

With Domain Admin access, we created a new on-prem user account, forced a synchronization, and within minutes had an active Azure AD (Entra ID) account. Security defaults were enabled in the Azure environment; however, because this was a newly created account, we were prompted to register MFA during the first login – effectively giving us the ability to enroll and control the MFA method ourselves, resulting in an immediate foothold in the cloud.

After gaining Domain Admin on-prem, we create a ‘synced’ user for our pivot to the cloud
Our new on-prem user synchronizes to Azure AD, giving us an immediate foothold in the cloud

Escalating to Global Administrator

Within the cloud tenant, our focus shifted to enumerating Azure roles. Global Administrator compromise represents the highest level of risk, giving attackers control over subscriptions, VMs, data, and security configurations.

Once inside the Entra ID tenant, our first focus was on enumerating users and roles, with special attention to Global Administrators. Correlating this list with our on-prem data, we noticed none of the Global Admins were actively logged into any reachable workstation.

Enumerating roles in Azure, we quickly identify a Global Administrator user, ‘Tony Stark’, as our target
A search for Azure AD devices yields no results for tstark, forcing us to pivot back to the on-prem environment

Shifting again to the on-prem environment, we began our enumeration to check all the OUs, computers, and their descriptions. In one OU, we stumbled upon IT computer accounts. Their descriptions revealed which user each system belonged to – and there it was: a Global Admin from the Entra ID tenant tied to a workstation.

Back on-prem, we found ‘WKSTN-0’ as the workstation assigned to our target
Used Domain Controller’s Active Directory Users and Computers to verify
A successful ping to wkstn-0 confirms the target machine is online and reachable

Since we already had domain admin access, we leveraged the user’s hash to RDP via pass-the-hash. With access to the workstation, we impersonated the active session in the Chrome browser by logging into the Azure portal and escalating further by adding our synced cloud account to the Global Admins group. This gave us full control over the Cloud environment, i.e., Azure subscriptions, VMs, storage, and everything else.

The Domain Admin credentials grant us administrative access to the target workstation
‘tstark’ has an active session on the machine
We perform a DCSync attack to dump the NTLM hash for the ‘tstark’ account
Using the stolen hash, we RDP into the workstation and successfully hijack the Global Administrator’s active Azure session
Discover that the compromised user is also the Owner of the ‘Azure for Pentest 1’ subscription
We elevate our own attacker-controlled ‘synced’ user to the Global Administrator role
We now have full control, confirmed by logging in as our ‘synced’ user and seeing our newly assigned Owner role on the subscription

Expanding the Scope: Additional Domain Compromise

One compromise often leads to another, and poor credential reuse across domains enabled this. After a password-spraying campaign, we gained control of a separate AD domain, again escalating to Domain Admin.

This demonstrated how password reuse and weak cross-domain controls can allow attackers to extend a single foothold into multiple, unrelated environments.

Password spraying with hashes against domain controllers.
Successful authentication leading to compromise multiple domain controllers across different domain(Pwn3d!).

Data Exfiltration: Sensitive Business Information

We accessed sensitive financial, HR, Payroll, and intellectual property data without being detected. If exposed, this information could lead to fraud, regulatory penalties, operational disruption, and loss of competitive advantage. This shows how quickly a single compromise can escalate into a major business breach with lasting impact.

Key Takeaways for Defense

This engagement highlighted how quickly a single foothold can escalate into full hybrid cloud compromise. The most impactful business lessons include:

Reduce the Attack Surface

  • Disable LLMNR/NetBIOS to prevent credential capture.
  • Enforce credential hygiene and protect LSASS from dumping.
  • Limit where Domain Admins can log in.

Secure Hybrid Identity

  • Restrict access to Azure AD Connect servers.
  • Enforce MFA and Conditional Access for all privileged accounts.
  • Monitor for unusual account creation and role assignment in Azure.

Prevent Lateral Impact – (Cross-Domain Security)

  • Audit for password reuse across domains.
  • Enforce strong password and lockout policies.
  • Monitor authentication attempts between domains.

In just a few days, we demonstrated how a single overlooked weakness could escalate into a complete compromise of both on-premises and cloud environments. What began as capturing a single NTLM hash ultimately led to control over multiple domains, Global Admin access in Azure, and unrestricted visibility of critical business systems and data.

For leadership, the lesson is clear: a hybrid environment is only as strong as its weakest link. Identity synchronization, credential hygiene, and administrative sprawl can turn a small gap into a full-scale breach.

By proactively addressing these misconfigurations, organizations can significantly reduce the likelihood of a similar compromise, strengthen resilience against ransomware and insider threats, and demonstrate compliance with regulatory and client expectations.

Ultimately, the goal is not just to stop attackers, it’s to ensure business continuity, protect customer trust, and safeguard the organization’s reputation.

Share the Post:

Table of Contents

Subscribe To Our Blog

Light