HomeGitHubPortfolioTwitter/XMediumCont@ct

21 - LO2️1️

Learning Object 21

Tasks

1 - Check if AD CS is used by the target forest and find any vulnerable/abusable templates

2 - Abuse any such template(s) to escalate to Domain Admin and Enterprise Admin

Flag 33 [dcorp-dc] - Name of the AD CS template that has ENROLLEE_SUPPLIES_SUBJECT 🚩

Flag 34 [dcorp-dc] - Name of the AD CS template that has EKU of Certificate Request Agent and grants enrollment rights to Domain Users 🚩

Flag 35 [dcorp-dc] - Name of the CA attribute that allows requestor to provide Subject Alternative Names 🚩

Flag 36 [dcorp-dc] - Name of the group that has enrollment rights on the CA-Integration template 🚩

Solutions

1 - Check if AD CS is used by the target forest and find any vulnerable/abusable templates

We can use the Certify tool to check for AD CS in moneycorp.

C:\AD\Tools\Certify.exe cas

We can list all the templates using the following command. Going through the output we can find some interesting templates:

Privilege Escalation to DA and EA using ESC1

The template HTTPSCertificates looks interesting. Let's get some more information about it as it allows requestor to supply subject name:

The HTTPSCertificates template grants enrollment rights to RDPUsers group and allows requestor to supply Subject Name. Recall that student867 is a member of RDPUsers group. This means that we can request certificate for any user as student867.

Let's request a certificate for Domain Admin - Administrator:

Copy all the text between -----BEGIN RSA PRIVATE KEY----- and -----END CERTIFICATE----- and save it to esc1.pem.

We need to convert it to PFX to use it. Use openssl binary on the student VM to do that. I will use SecretPass@123 as the export password.

Use the PFX created above with Rubeus to request a TGT for DA - Administrator, using moneycorp.local domain:

Check if we actually have DA privileges now:

Awesome! We can use similar method to escalate to Enterprise Admin privileges. Request a certificate for Enterprise Administrator - Administrator

Save the certificate to esc1-EA.pem and convert it to PFX. I will use SecretPass@123 as the export password:

Use Rubeus to request TGT for Enterprise Administrator - Administrator

Finally, access mcorp-dc!

We have EA privileges!

2 - Abuse any such template(s) to escalate to Domain Admin and Enterprise Admin

If we list vulnerable templates in moneycorp, we get the following result:

The "SmartCardEnrollment-Agent" template has EKU for Certificate Request Agent and grants enrollment rights to Domain users. If we can find another template that has an EKU that allows for domain authentication and has application policy requirement of certificate request agent, we can request certificate on behalf of any user.

Now, request an Enrollment Agent Certificate from the template "SmartCardEnrollment-Agent":

Like earlier, save the certificate text to esc3.pem and convert to pfx. Let's keep using SecretPass@123 as the export password:

Now we can use the Enrollment Agent Certificate to request a certificate for DA from the template SmartCardEnrollment-Users:

Once again, save the certificate text to esc3-DA.pem and convert the pem to pfx. Still using SecretPass@123 as the export password:

Use the esc3-DA created above with Rubeus to request a TGT for DA

Check if we actually have DA privileges now:

To escalate to Enterprise Admin, we just need to make changes to request to the SmartCardEnrollmentUsers template and Rubeus.

Please note that we are using '/onbehalfof: mcorp\administrator' here:

Convert the pem to esc3-DA.pfx using openssl and use the pfx with Rubeus:

Finally, access mcorp-dc!

Flag 33 [dcorp-dc] - Name of the AD CS template that has ENROLLEE_SUPPLIES_SUBJECT 🚩

Using C:\AD\Tools\Certify.exe find /enrolleeSuppliesSubject command we can see the Name of the AD CS template that has ENROLLEE_SUPPLIES_SUBJECT is: HTTPSCertificates

Flag 34 [dcorp-dc] - Name of the AD CS template that has EKU of Certificate Request Agent and grants enrollment rights to Domain Users 🚩

The name of the AD CS template that has EKU of Certificate Request Agent and grants enrollment rights to Domain Users is: SmartCardEnrollment-Agent

Flag 35 [dcorp-dc] - Name of the CA attribute that allows requestor to provide Subject Alternative Names 🚩

The name of the CA attribute that allows requestor to provide Subject Alternative Names is: EDITF_ATTRIBUTESUBJECTALTNAME2

Flag 36 [dcorp-dc] - Name of the group that has enrollment rights on the CA-Integration template 🚩

Using Certify.exe find command we can see the group that has enrollment rights on the CA-Integration template

Previous20 - LO2️0️Next22 - LO 2️2️

Last updated