ADCS Exploitation Part 3: Living Off The Land

Source: Medium

Author: Giulio Pierantoni

URL: https://medium.com/@offsecdeer/adcs-exploitation-part-3-living-off-the-land-9c6494d6a84e

ONE SENTENCE SUMMARY: The article outlines techniques for exploiting Active Directory Certificate Services (ADCS) using native Windows tools certutil and certreq.

MAIN POINTS:

  1. ADCS exploitation can be performed using built-in Windows tools certutil and certreq.
  2. Enumeration of enterprise CAs involves commands like certutil -TCAInfo and certutil -dump.
  3. Validation of CA certificates and trust hierarchy is critical before exploitation.
  4. Certificate templates can be analyzed using certutil -dsTemplate and certutil -Template.
  5. ESC1 exploits involve generating a CSR with user-supplied SAN through policy files.
  6. ESC2 and ESC3 exploits require Enrollment Agent certificates and EOBO (Enroll-On-Behalf-Of) CSRs.
  7. ESC15 vulnerabilities allow injection of custom EKU OIDs into certificates.
  8. Golden Certificate creation involves backing up CA private keys using certutil -backupkey.
  9. ESC4 exploits involve modifying template attributes temporarily to enable enrollment.
  10. Certificates obtained can be leveraged for authentication via CredMarshalCredential and PSSession.

TAKEAWAYS:

  1. Native Windows tools offer stealthier methods for ADCS exploitation compared to external tools.
  2. Proper enumeration and validation steps are essential for successful exploitation.
  3. Understanding template attributes and DACLs helps identify exploitable vulnerabilities.
  4. Certificate-based authentication provides powerful lateral movement capabilities in Windows domains.
  5. Monitoring and restricting usage of certutil and certreq by regular users improves security posture.