ADFSDump
- Thiru T
- Nov 8, 2024
- 1 min read
A C# tool to dump all sorts of goodies from AD FS.
Created by Doug Bienstock @doughsec while at Mandiant FireEye.
This tool is designed to be run in conjunction with ADFSpoof. ADFSdump will output all of the information needed in order to generate security tokens using ADFSpoof.
Requirements:
ADFSDump must be run under the user context of the AD FS service account. You can get this information by running a process listing on the AD FS server or from the output of the Get-ADFSProperties cmdlet. Only the AD FS service account has the permissions needed to access the configuration database. Not even a DA can access this.
ADFSDump assumes that the service is configured to use the Windows Internal Database (WID). Although it would be trivial to support an external SQL server, this feature does not exist right now.
ADFSDump must be run locally on an AD FS server, NOT an AD FS web application proxy. The WID can only be accessed locally via a named pipe.
Install: (Compile)
ADFSDump was built against .NET 4.5 with Visual Studio 2017 Community Edition. Simply open up the project .sln, choose "Release", and build.
Usage: (Flags)
# The Active Directory domain to target. Defaults to the current domain.
/domain:
# The Domain Controller to target. Defaults to the current DC.
/server:
# Switch. Toggle to disable outputting the DKM key.
/nokey
# (optional) SQL connection string if ADFS is using remote MS SQL rather than WID.
/database
Comments