Now I've cleaned up my environment,
I made sure to delete all the certificates and log out and clear our tickets,
we're starting off fresh,
and we're going to work with this enrollment agent that we have here.
If you remember,
the enrollment agent came up when we used Certify's find
command with the vulnerable switch,
meaning it was vulnerable to a default low privileged group.
That would be authenticated users.
By having authenticated users checked in the access
control for this enrollment agent,
it will allow low privileged users to actually request and
leverage this enrollment certificate.
Enrollment agent certificates are used when you want to have somebody
else request a certificate on behalf of another user.
This would be used when, say,
you want the systems administrator to request a certificate for a smartcard for
a user or some other configuration in which you would want to have somebody else
request a certificate on behalf of another user.
So the first thing we need to do is request the
certificate enrollment agent certificate.
This is just a basic request with Certify,
nothing fancy, just request the certificate.
Once we have the certificate,
we're going to have to transform it again with our OpenSSL.
So we'll just go ahead and take our information out of the command window,
put it into Notepad, Save As, we'll call it enroll.pem,
and then we're going to transform it with OpenSSL,
and that's going to be OpenSSL. All right, then we'll name it enroll.pfx.
So now we're going to use this enrollment certificate to request
another certificate on behalf of another user.
We're going to need two things.
We're going to need the other user that we're going to request it on
behalf of, and we're going to want that to be a domain admin if possible,
and we're also going to need to find a certificate template that the
enrollment agent is allowed to enroll in.
We'll first start with that last one.
We can go back to our Certify's find command, and since
we're looking for client authentication,
we'll go ahead and use the clientauth switch. And what we're
looking for are templates that have the Application Policies
set to Certificate Request Agent.
Fortunately for us,
this last one here has that set so we don't have to go scrolling through it all.
I wonder how that happened.
Anyway, we're going to request this GloboUser
template on behalf of our domain admin.
But how do we find that domain admin?
Well, if I run an op, I would use the CAdmin person because they
have write permissions to a lot of these templates, which means
they're likely an elevated user.
That would give me the quickest and quietest way to determine that.
But thankfully for us, Certify has a pkiobjects /findAdmins command that can
actually help you, yeah, find admins. And look at that, CAdmin is a good
choice, so we're going to go ahead and use the CAdmin character and we're
going to now request this certificate of GloboUser and we're going to specify
our certificate authority and our template name, and we're going to request
it on behalf of Globomantics CAdmin, and then we're going to specify our
enrollment template and the password that we left blank because we're super
secure here at Globomantics. Now we have another certificate, what do we do?
Well, you guessed it. We've got to transform it with OpenSSL and work our magic.
So, let's go ahead and do that.
Here we go.
We'll copy it out, we'll copy it in, we'll go ahead All Files,
Save As, OpenSSL, and then we're going to copy this, paste, and
we're going to save it as cadmin.pfx.
All right, so one last step.
But again, to make sure that I totally wow you,
I have to show you I don't have access to the domain controller.
But let's also show you that I don't have access to the
certificate authority because this is a domain admin, so we
want access to all the things.
All right, now we're going to go ahead and work our Rubius
magic and pass the ticket. Abracadabra, voila, and now I
have access to not one, but two.
And if there were three or four, I think this means we
can move laterally, and that's a win.
What's even better about these methods of establishing domain elevation
with these certificates is that these certificates create a persistence
that is machine and password independent.
They are granting you authentication.
You can use the certificate for as long as the certificate is valid,
even if they rebuild the system or the user changes their password.
This can be a truly powerful and devastating attack surface if left open,
and I hope that you really enjoyed learning about it.