Pentest Shows Duo Auth Proxy Traffic Can Expose Cleartext AD Credentials
Summary
A penetration test found that the Duo Auth Proxy forwarded live AD authentication requests; using a recovered RADIUS shared secret, the tester decrypted captured exchanges and exposed cleartext credentials. Group analysis identified a developer account with broad, but未
Key points
- Proxy logs showed live Active Directory authentication requests being forwarded through the Duo Auth Proxy to an AD server.
- The tester captured traffic on the relevant interface and used a previously recovered RADIUS shared secret to decrypt authentication exchanges.
- The decrypted exchanges exposed cleartext credentials for requests sent through the proxy.
- The assessment found that this authentication path could be abused for password theft rather than providing protection against it.
- Group membership analysis identified a developer account in several development-related AD groups; access to tooling or privileged services was suggested, not established.
Article Details
- Topic
- Duo Auth Proxy-mediated Active Directory authentication traffic was intercepted and decrypted, exposing cleartext credentials; group-membership analysis also identified a developer account with multiple development-related memberships.
MITRE ATT&CK
T1040 · Network SniffingA packet capture was performed on the relevant interface, and the captured authentication traffic was analyzed to recover credentials.T1069.002 · Domain GroupsUser group memberships were mapped to identify potential privilege or lateral-movement paths.T1557 · Adversary-in-the-MiddleAuthentication requests were proxied through the Duo Auth Proxy, and the exchanges were intercepted and decrypted to expose credentials in transit.
Products
Duo Auth ProxyThe Duo Auth Proxy was shown to be forwarding live Active Directory authentication requests, and packet capture plus a recovered RADIUS shared secret allowed the authentication exchanges to be decrypted.Microsoft Active DirectoryThe Duo Auth Proxy was shown to be forwarding live Active Directory authentication requests, and packet capture plus a recovered RADIUS shared secret allowed the authentication exchanges to be decrypted.