This is a simple tool which can be used to inject a DLL into third-party AD connectors to harvest credentials.

This tool has been tested with:

• AzureAD Connect
• OKTA AD Connector
• OneLogin AD Connector

The API call hooked is LogonUserW which seems to be used by each AD Connector.

More information can be found in the blog post https://blog.xpnsec.com/identity-providers-redteamers/.

To build, we can use Visual Studio, or use Mingw32 with:

x86_64-w64-mingw32-g++ Hooker/hooker.cpp -o Hooker/hooker.dll -static -shared
x86_64-w64-mingw32-g++ Injector/injector.cpp -o Injector/injector.dll -static

To use this tool, simply save hooker.dll to a location which is readable by the AD Connector service. For example, C:\Tools\hooker.dll and then run:

Injector.exe [PID] [FULL DLL PATH]

For example:

Injector.exe 6100 C:\Tools\hooker.dll