Try with ADCS relay attacks generated certs

GoSecure / pyrdp

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

https://www.gosecure.net/blog/2020/10/20/announcing-pyrdp-1/

GNU General Public License v3.0

1.54k stars 249 forks source link

Try with ADCS relay attacks generated certs #325

Open obilodeau opened 3 years ago

obilodeau commented 3 years ago

Read this: https://www.exandroid.dev/2021/06/23/ad-cs-relay-attack-practical-guide/

Can we use ADCS relay attacks to grab certificates that would be valid for RDP? This would enable greater reach in NLA-enabled environments.

lubiedo commented 2 years ago

Took a look at the article and code they implemented. If I got the idea right: it is to relay the auth to an ADCS via PyRDP as they are doing here? It will still need more elements for the whole attack to be successful (in the how-to they are using dementor to abuse the printer spool bug)