Abusing Azure AD pass-through authentication vulnerabilities at DefCamp 2022