search

ly4k / Certipy

Tool for Active Directory Certificate Services enumeration and abuse
MIT License
2.34k stars 318 forks source link

ESC7 - Error when attempting to add an officer #33

Closed jsdhasfedssad closed 2 years ago

jsdhasfedssad commented 2 years ago

When attemting to exploit ESC7 and the account I use for authentication does not have the right Manage Certificates, I must add that account as a new officer in order to grant the account that right. This fails for me using Certipy 2.0.6. esc7_dc1

Once this works, can I delete/remove the officer and possibly other remaining changes after the attack?

ly4k commented 2 years ago

Yes, you can remove the CA officer afterwards with -remove-officer. The request fails because you're trying to connect to the DC. You should connect to the CA

jsdhasfedssad commented 2 years ago

I actually tried connecting to the ADCS server when I tested this but that failed as well :) esc7_server2

ly4k commented 2 years ago

The second image makes more sense to me. It's a mistake in my implementation. I accidentally assumed the CA and the DC was on the same server, which results in Certipy trying to connect to LDAP on the CA, or connecting to the CA DCOM on the DC. Thanks for reporting this. I'll look into a fix soon

ly4k commented 2 years ago

Should be fixed in 2.0.8. Can you please verify?

jsdhasfedssad commented 2 years ago

Using 2.0.8 I can now add the officer. Good! esc7_3

The next step in my case is to enable the certificate template SubCA but that fails for me. esc7_2

ly4k commented 2 years ago

Should be fixed in 2.0.9. The new LDAP DNS resolution was not applied for the -enable-template. Can you verify that it is working now? I really appreciate that you report these issues. Thanks!

jsdhasfedssad commented 2 years ago

Great! This works now. I actually managed to execute the complete ESC7 attack this time. Don't worry about asking me to verify fixes, I will have so much fun owning my client's infrastructure using your tool :D No more hassle having to own a domain-joined machine, bypass AV, AMSI, Applocker, execution policies, language constrained mode and what not then having to upload and import powershell scripts! All I need now is essentially Responder, Hashcat, Bloodhound, BloodyAD, Impacket and Certipy :D

ly4k commented 2 years ago

Great. Haha yes, Active Directory itself is full of attack vectors