search

Pass the Certificate

hashtag
AD CS NTLM Relay Attack (ESC8)

Attackers can use Impacket’s ntlmrelayxarrow-up-right to listen for inbound connections and relay them to the web enrollment service using the following command:

Note: The value passed to --template may be different in other environments. This is simply the certificate template which is used by Domain Controllers for authentication. This can be enumerated with tools like certipyarrow-up-right.

Attackers can either wait for victims to attempt authentication against their machine randomly, or they can actively coerce them into doing so. One way to force machine accounts to authenticate against arbitrary hosts is by exploiting the printer bugarrow-up-right. This attack requires the targeted machine account to have the Printer Spooler service running. The command below forces 10.129.234.109 (DC01) to attempt authentication against 10.10.16.12 (attacker host):

Referring back to ntlmrelayx, we can see from the output that the authentication request was successfully relayed to the web enrollment application, and a certificate was issued for DC01$:

We can now perform a Pass-the-Certificate attack to obtain a TGT as DC01$. One way to do this is by using gettgtpkinit.pyarrow-up-right. First, let's clone the repository and install the dependencies:

Then, we can begin the attack.

Note: If you encounter error stating "Error detecting the version of libcrypto", it can be fixed by installing the oscryptoarrow-up-right library.

Once we successfully obtain a TGT, we're back in familiar Pass-the-Ticket (PtT) territory. As the domain controller's machine account, we can perform a DCSync attack to, for example, retrieve the NTLM hash of the domain administrator account:

hashtag
Shadow Credentials (msDS-KeyCredentialLink)

Shadow Credentialsarrow-up-right refers to an Active Directory attack that abuses the msDS-KeyCredentialLinkarrow-up-right attribute of a victim user. This attribute stores public keys that can be used for authentication via PKINIT. In BloodHound, the AddKeyCredentialLink edge indicates that one user has write permissions over another user's msDS-KeyCredentialLink attribute, allowing them to take control of that user.

Diagram showing a connection between two users, wwhite@inlanefreight.locall and jpinkman@inlanefreight.locall, labeled "AddKeyCredentialLink."

We can use pywhiskerarrow-up-right to perform this attack from a Linux system. The command below generates an X.509 certificate and writes the public key to the victim user's msDS-KeyCredentialLink attribute:

In the output above, we can see that a PFX (PKCS12) file was created (eFUVVTPf.pfx), and the password is shown. We will use this file with gettgtpkinit.py to acquire a TGT as the victim:

With the TGT obtained, we may once again pass the ticket:

In this case, we discovered that the victim user is a member of the Remote Management Users group, which permits them to connect to the machine via WinRM. As demonstrated in the previous section, we can use Evil-WinRM to connect using Kerberos (note: ensure that krb5.conf is properly configured):

hashtag
Lab - Questions

  • PTCDC01: 10.129.234.174

  • PTCCA01: 10.129.234.172

  • user "wwhite" & password "package5shores_topher1"

Fristly, set the relay in the ip provided the ca -->

After, we need do a printer bug attack with the DC ip and us local ip. We also need to install the tool:

Once we have the file .pfx, try to obtain a TGT make a pass the certficate attack. Is necessary install the tool gettgtpkinit -->

Set the IP of DC and the directorie of .pfx file

Once we successfully obtain a TGT, we're back in familiar Pass-the-Ticket (PtT) territory. As the domain controller's machine account, we can perform a DCSync attack to, for example, retrieve the NTLM hash of the domain administrator account:

Note: Set the DC into /etc/hosts

10.129.234.174 DC01.INLANEFREIGHT.LOCAL DC01

Now, we can connect by being Administrator and read the flag...

  • What are the contents of flag.txt on Administrator's desktop?

Make Shadow Credentials (msDS-KeyCredentialLink)

Fristly, git clone the pywhisker tool to after execute it-->

We can see that a PFX (PKCS12) file was created (eFUVVTPf.pfx), and the password is shown.

We will use this file with gettgtpkinit.py to acquire a TGT as the victim:

Note: we need install the after module "oscrypto" and make it attack since a .venv

Once we have the ticket, we can do the PTT -->

We are now the user jpinkman, try to connect as jpinkman user via winrm -->

Note: Fristly we need configurate the krb5.conf file -->

PreviousPass the Ticket (PtT) from LinuxNextSkills Assessment - Password Attacks

Last updated