Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Active Directory Certificate Services (AD CS) attacks

Exploiting ADCS Misconfigurations

1. Enumerating ADCS Vulnerabilities

When BloodHound does not show a direct ACL-based path, ADCS (Active Directory Certificate Services) is a primary target. Misconfigured certificate templates can allow low-privileged users to impersonate high-privileged users.

1.1 Using Certipy

The standard tool for auditing ADCS is Certipy (called certipy-ad on Kali).

Command:

certipy-ad find -u '[email protected]' -p '3edc4rfv#EDC$RFV' -dc-ip 10.1.234.184 -text -enabled -hide-admins -vulnerable

  • -vulnerable: Filters the output to show only templates with potential exploit paths (e.g., ESC1, ESC2, ESC3, etc.).

Findings:

The scan identified the CertAdmin template as vulnerable to ESC1.

  • ESC1 Criteria: The template allows the requester to specify a Subject Alternative Name (SAN). If a user can enroll in this template, they can request a certificate as any user (including a Domain Admin).

  • As we can enrol a computer and give it permissions.

2. Exploiting ESC1

2.1 Prerequisite: Adding a Computer Account

Logoaddcomputer.py | The Hacker Toolstools.thehacker.recipes

The CertAdmin template ACL revealed that only Domain Computers have enrollment rights. Since Brandon Boyd is a Domain User, we must first add a machine account we control.

Check if we can add a computer

Command (using Impacket):

Note: This works if the MachineAccountQuota is greater than 0 (default is 10).

Also get the SID of target user

2.2 Requesting the Admin Certificate

Using the new computer account, we request a certificate impersonating the Domain Admin (AnnaMolly).

Command:

2.3 Authenticating via PFX

Once the .pfx file is received, authenticate to the KDC to retrieve the NTLM hash of the admin user.

Command:

Result: Returns the NTLM hash for the user AnnaMolly.

Let us try evil-winrm, which failed.

wmiexec also fails

3. Evasion & Final Access

The target is running Windows Defender, which may block standard tools like psexec or wmiexec.

3.1 Bypassing Defender with wmiexec2

Standard Impacket wmiexec is often flagged. The tool wmiexec2 uses obfuscation to evade detection.

LogoGitHub - ice-wzl/wmiexec2: wmiexec2.0 is the same wmiexec that everyone knows and loves (debatable). This 2.0 version is obfuscated to avoid well known signatures from various AV engines. It also has a handful of additional built in modules to help automate some common tasks on Red team engagements.GitHub

Setup & Execution:

PreviousGroup Policy Abuse
NextPivoting

Last updated