The instructions for how to compile Certify are on the GhostPack
GitHub where you went to download the tool.
If you scroll past all the README and help files,
you'll find instructions on how to load it into Visual
Studio Community edition and compile it.
It's literally just open and build.
If you get a pop‑up that says to update it to the latest .NET version,
just click OK and then go ahead and compile it.
Once Certify is compiled,
you just copy it over to the victim machine and you're ready to go.
Once Certify is on the victim machine,
you just open a command prompt and you call the program
from the folder in which it's located.
To get started, we'll have to enumerate the environment.
We can do that with Certify's cas command.
The cas command will enumerate the environment and return
information about the root certificates,
the certificates in the NTAuth certificates store,
information about the certificate authorities themselves,
as well as the templates that are enabled and
available for us in the environment.
This command may take a while to run while it enumerates your environment.
I've sped it up here for the demo,
but don't worry if it's taking longer than it did for me.
What we won't find are details about these templates that help us
find the ones that are vulnerable for attack.
To do that, we can use Certify's find command.
The find command will enumerate the certificate authorities and return detailed
information about the certificate authorities themselves,
as well as the templates enabled on each.
This can be a lot of data to parse through in an op,
so Certify gives us some switches that we can add to the find command
that will allow us to whittle down our results.
Since we're interested in certificates that facilitate client authentication,
we can use the clientauth switch.
The clientauth switch will return the certificate templates
that facilitate client authentication,
but simply facilitating client authentication isn't enough
to help us actually perform this attack.
One of our attacks is to supply an alternative name.
For that,
we would need the certificate template to have the
enrolleeSuppliesSubject flag set,
and we can look for that with the enrolleeSuppliesSubject switch.
These results still don't help us easily find one
that our user is able to enroll in, and that's important.
The user has to be able to enroll in the template for this attack to work.
We can use Certify's find command with the vulnerable switch.
The vulnerable switch, when used by itself with the find command,
will search for vulnerable templates that are able to be
enrolled in by default low‑privileged groups.
We're going to cover enrollment agents next,
so let's go ahead and request this GloboWorkstation certificate.
To do that,
we're going to use Certify's request command and we'll
specify the certificate authority.
We can copy that from up here so we don't have any typos.
Then we're going to need to specify the template name.
It's important that when you do this,
you get the capitalization correct or this will not work.
We're also going to want to specify an alternative name,
somebody else that we want to add the subject alternative name.
For this,
we're going to just use administrator and try and leverage a
local administrator account left active.
This request here failed.
It says it was denied by policy module.
That's because the default low‑privileged group that has
permission to enroll in the certificate is Domain Computers and
the request was made on the user's behalf.
Certify has a machine switch that you can add to the command
that will attempt to get system and then make the request on
behalf of the machine account.
This request here failed as well because we aren't elevated users on the system,
so get system failed.
Well, then how do we find vulnerable templates for our user?
Certify has a currentuser switch that you can add to the
vulnerable switch that you can add to the find command.
So, if we do certify find /vulnerable /currentuser,
it will search for templates that are vulnerable and enrollable
by our current user context. And now we still have two templates,
but this one here, this one's new.
That must mean that our user page is a member of one of these user groups.
A quick net command can show you that yes she is.
Looks like she's a web admin.
All right,
so let's go ahead and request this GloboWebServer template, and
we're going to go ahead and specify the certificate authority
again and the template name, and go ahead and with an
alternative name of administrator.
And now, ah‑ha, all right.
So now we have a certificate.
So what do we do?
Well, thank you Will and Lee for telling us right here that
we need to use OpenSSL to transform this.
All right,
so I have OpenSSL installed on this system, and I am going
to copy this out of my command window, open up Notepad,
paste it into Notepad, and then we're going to go to Save As,
we're going to select All Files because I can't tell you how many
times I accidentally save it as a text,
we're going to name it admin.pem, and Save.
Now we'll just go over to our command window and we're going to use this
handy dandy command that Will and Lee have given us.
And we'll go ahead and type this.
Now I'm going to copy it to save myself some time.
All right,
we're going to name it admin.pfx and we'll specify a blank
password and Enter. Okay, now we have a certificate.
Now is when I get to show you something really cool and wow you.
But in order to make sure that you're sufficiently wowed, I have
to show you first that I do not have access to the domain
controller. See, Access is denied.
All right, now we're going to take the certificate that we just created and
we're going to use Rubius to generate a Ticket Granting Ticket as a local
administrator on the domain controller, and we're going to pass the ticket
so that we have access when we're done.
And then I'm going to go abracadabra, voila. Ta‑da! Aren't you impressed?
I know, that was so cool. That was a lot of fun.
And now that we've covered that, I'm going to go ahead and clean up this
environment so that we can go try an enrollment certificate.
But before we do that,
I want to discuss a setting that if you find it set on a certificate
authority would allow you to perform this attack with any certificate
that the user is allowed to enroll in, meaning if the user has
permission to enroll in the certificate,
you can specify a subject alternative name.
It's a very dangerous setting to have set globally on a certificate authority.
This is what it looks like.
It's edit attributes, you know, that's what it is.
If you run Certify and you find that this is set on a certificate authority,
rejoice or cry depending on which side of the op you're on.
If you are an administrator and this is set on your servers,
ask yourself why and if you can turn it off. It can actually open
up giant holes into your environment, and I highly recommend you
turn it off. Now that we've covered that, let's go ahead and go
play with our enrollment agent.