Hello, and welcome to the Pluralsight Red Team course,
Privilege Escalation with Certify.
My name is Kat Seymour,
and I'm here to teach you how to use the C# tool Certify to
enumerate and abuse misconfigured Active Directory
Certificate Services environments.
Certify was created by Will Schroeder and Lee Christensen,
otherwise known as @harmj0y and @tifkin,
to enumerate and abuse misconfigured Active Directory
Certificate Services environments.
While looking into how Active Directory certificates could
be used as a method of authentication,
Will and Lee discovered that many misconfigurations in
these environments could be leveraged to gain elevated
privileges and domain persistence.
The techniques that Will and Lee discuss in their blog
posts and accompanying whitepaper, Certified Pre‑Owned,
are leveraging built‑in Windows commands and
environment tools to accomplish these goals,
allowing us to live off the land and making detection very difficult.
Certify is an open source C# tool that Will and Lee created to
help facilitate the attacks in their whitepaper.
It is available for download at the GhostPack GitHub where you'll also find
other useful tools such as Rubius, which we'll also be using in this course.
A quick google search and some of the keywords and configurations that we'll
be using in this course can show you just how widespread and powerful this
attack surface can be.
You'll find everything from installation documents to support forums,
telling you to configure even the most dangerous of these configurations. In
the cyber kill chain, Certify comes in post‑exploitation, allowing us to
generate certificates that will provide us persistence and elevate our
privileges within the domain. Certificates are used within an environment to
establish trust, and Certify allows us to generate certificates that will
essentially modify the domain trust relationship between Active Directory
objects.
We can use these certificates to establish persistence and elevate our
privileges within the domain, and we'll also look at how to use these
certificates to generate Kerberos tickets and perform a Kerberoasting attack
without having to dump LSASS. To better understand Certify and how to leverage
it to achieve your goals, it's helpful to understand how the certificate
enrollment process in Active Directory works. To obtain a certificate in an
Active Directory Certificate Services environment, a client must first locate a
certificate authority.
It then generates a public and private key pair that is used to
generate and sign a certificate signing request.
This signing request is then sent to the certificate authority, which
validates it against the settings in the template,
including whether or not the requester has
permission to request the certificate.
If the request is validated,
the certificate authority will generate a certificate and sign it with
its own private key and then send the certificate to the client to be
used for what the certificate is valid for.
It is this stage of the process that we are going to inject into.
We are going to leverage misconfigurations in the certificate
templates to allow us to request certificates on behalf of other
users or to add them to our certificate requests,
which will grant us authentication rights as that user. Certificates are
digitally signed documents that are used in encryption,
message signing, and authentication.
They contain various fields that help define who,
when, and how they can be used.
The fields that we'll be interested in for the purposes of this course are the
subject, or the certificate owner, the subject alternative name, and this
would be a secondary owner or owners of the certificate, something commonly
used in, say, a web server pool. We'll also be interested in the basic
constraints while using the certificate,
the not before and not after dates, which define when the certificate
is valid for, and finally, the extended key usages, or EKUs. These
define how the certificate can be used, whether it's for code signing,
encryption or client authentication. In the resources section, you'll find
instructions on how to build the lab that we'll be using for this course. To
give you an overview of how it is set up, I created an Active Directory
environment that contains a client system,
an Active Directory domain controller, and an Active
Directory certificate server that is separate from the
Active Directory domain controller.
I also created some users, a basic user and a domain admin, so we can
demonstrate privilege escalation, but then I configured some other users
with different privileges and groups so that I could fully explore the
potential of this attack surface.
I highly recommend that when you set this up at home you do so as well.
Finally, I had to configure some templates so we
could interact with the environment.
For this course, we created one that will allow us to specify a
subject alternative name and add this other user to our
certificate, as well as a misconfigured enrollment agent that has
its access control set incorrectly,
allowing us to use it to enroll in other certificates as a basic
user. It becomes a very short step from basic user to domain admin,
as you will see. Now that we've gone over all of that, why don't we
fire up Certify and let's go play.