Search Results

This attack is not complex as it only consists in "guessing" a user's password but there are still some precautions we want to take: Slow spraying to avoid account lockouts Rotating IPs via proxies and / or VPNs to avoid IP blacklisting and to bypass location...

OAUth is a protocol that allows third-party applications to access services with access tokens, avoiding the disclosure of the user's credentials. What we can do as an attacker is create a malicious OAuth app to coerce users into granting the application acces...

Device Code Authentication allows to compromise a AAD / M365 account just like OAuth Abuse but it's generally harder to detect / set up and doesn't require any input from the victim. The downside to this technique is that the device codes are valid for only a ...

In this section we'll tackle an attack scenario that sees us compromising a Cloud Administrator account and wanting to get access to an application we don't have access to. This application has a Contributor RBAC role to the subscription so we'll end up assign...

Just like for the Cloud Administrator section, we'll walk though a small attack scenario which starts with us compromising a User Administrator account. Let's say there is a credential vault in a subscription we are not part of and we want to get to that: what...

For this technique to work we need a certificate template with the following requirements: ENROLLEE_SUPPLIES_SUBJECT attribute enabled: this allows the user that initialized the CSR (certificate request) to specify any SAN (subjectAltName) allowing us to req...

This privilege escalation technique requires the following: Any Purpose EKU which allows the attacker to get a certificate that can be used for all purposes (Client Authentication, Code Signing, ...) ENROLLEE_SUPPLIES_SUBJECT attribute enabled a user with en...

Unlike ESC1 and ESC2, this method requires two certificate templates with the following requirements First Template Certificate Request Agent EKU Second Template Client Authentication EKU Application Policy Issuance Requirement with Authorized Signatures ...

Check if ADCS installed Windows Presence of module ADCS: Get-WindowsFeature -Name ADCS-Cert-Authority -ErrorAction SilentlyContinue Presence of built-in Cert Publishers group which authorizes Certificate Authorities to publish certificates: net localgroup "...

You can create misconfigurations even in templates that are not initially vulnerable. For example, enabling the mspki-certificate-name-flag for a template allowing domain authentication could result in a situation similar to ESC1. This might allow less privile...

Vulnerable PKI Object Access Control where the objects have the following requirements: The AD computer object of the CA server, which may be compromised through mechanisms like S4U2Self or S4U2Proxy. The RPC/DCOM server of the CA server. Any descendant ...

Note: ESC6 got patch on May of 2022. ESC6 permits the inclusion of user-defined values in subject alternative name for any request. On Windows we can verify the permission : PS /home/bobbuilder> certutil -config "CA_HOST\CA_NAME" -getreg "policy\EditFlags" Wi...

Vulnerable Certificate Authority Access Control where 2 sets of permissions poses security risks: ManageCA (or ManageCertificates) ManageCertificates (or Certificate Manager) Enumerate using certsrv.msc PS /home/bobbuilder> Get-CertificationAuthority -Comput...

Authentication coercion from a machine account where we relay the NTLM hash to AD CS to obtain a certificate that allows us to authenticate. Requirements A vulnerable web enrollment endpoint. At least one certificate template published that allows for domain ...

To exploit ESC9, ensure the StrongCertificateBindingEnforcement key is not set to 2 or includes the UPN flag, the template has CT_FLAG_NO_SECURITY_EXTENSION, specifies client authentication, and the attacker has GenericWrite privilege on account A to compromis...

Case 1 Reviewing registry keys as Administrator bob$ python3 reg.py minions.com/'Administrator':'<pass>'@<IP_address> query -keyName 'HKLM\SYSTEM\CurrentControlSet\Services\Kdc' If we get StrongCertificateBindingEnforcement REG_DWORD 0x0 we can proceed. Retri...

The vulnerability identified as ESC11 involves exploiting the modification of the IF_ENFORCEENCRYPTICERTREQUEST flag in the MS-ICPR RPC interface of ADCS, potentially allowing an NTLM relay attack to request certificates from authorized certificate templates v...

If a principal (user or computer) has enrollment rights on a certificate template configured with an issuance policy that has an OID group link, then this principal can enroll a certificate that allows obtaining access to the environment as a member of the gro...

If we are able to enroll certificates as someone else (user or computer), we can compromise a target principal using explicit certificate mapping. Requirements There is 4 scenarios: ESC14 Scenario A: Write altSecurityIdentities on Target The attacker has writ...