Pass the Certificate
PKINIT, short for Public Key Cryptography for Initial Authentication, is an extension of the Kerberos protocol that enables the use of public key cryptography during the initial authentication exchange. It is typically used to support user logons via smart cards, which store the private keys. Pass-the-Certificate refers to the technique of using X.509 certificates to successfully obtain Ticket Granting Tickets (TGTs). This method is used primarily alongside attacks against Active Directory Certificate Services (AD CS), as well as in Shadow Credential attacks.
AD CS NTLM Relay Attack (ESC8)
Note: Attacks against Active Directory Certificate Services are covered in great depth in the ADCS Attacks module.
ESC8—as described in the Certified Pre-Owned paper—is an NTLM relay attack targeting an ADCS HTTP endpoint. ADCS supports multiple enrollment methods, including web enrollment, which by default occurs over HTTP. A certificate authority configured to allow web enrollment typically hosts the following application at /CertSrv:
Attackers can use Impacket’s ntlmrelayx to listen for inbound connections and relay them to the web enrollment service using the following command:
Note: The value passed to --template may be different in other environments. This is simply the certificate template which is used by Domain Controllers for authentication. This can be enumerated with tools like certipy.
Attackers can either wait for victims to attempt authentication against their machine randomly, or they can actively coerce them into doing so. One way to force machine accounts to authenticate against arbitrary hosts is by exploiting the printer bug. This attack requires the targeted machine account to have the Printer Spooler service running. The command below forces 10.129.234.109 (DC01) to attempt authentication against 10.10.16.12 (attacker host):
Referring back to ntlmrelayx, we can see from the output that the authentication request was successfully relayed to the web enrollment application, and a certificate was issued for DC01$:
We can now perform a Pass-the-Certificate attack to obtain a TGT as DC01$. One way to do this is by using gettgtpkinit.py. First, let's clone the repository and install the dependencies:
Then, we can begin the attack.
Note: If you encounter error stating "Error detecting the version of libcrypto", it can be fixed by installing the oscrypto library.
Once we successfully obtain a TGT, we're back in familiar Pass-the-Ticket (PtT) territory. As the domain controller's machine account, we can perform a DCSync attack to, for example, retrieve the NTLM hash of the domain administrator account:
Shadow Credentials (msDS-KeyCredentialLink)
Shadow Credentials refers to an Active Directory attack that abuses the msDS-KeyCredentialLink attribute of a victim user. This attribute stores public keys that can be used for authentication via PKINIT. In BloodHound, the AddKeyCredentialLink edge indicates that one user has write permissions over another user's msDS-KeyCredentialLink attribute, allowing them to take control of that user.
We can use pywhisker to perform this attack from a Linux system. The command below generates an X.509 certificate and writes the public key to the victim user's msDS-KeyCredentialLink attribute:
In the output above, we can see that a PFX (PKCS12) file was created (eFUVVTPf.pfx), and the password is shown. We will use this file with gettgtpkinit.py to acquire a TGT as the victim:
With the TGT obtained, we may once again pass the ticket:
In this case, we discovered that the victim user is a member of the Remote Management Users group, which permits them to connect to the machine via WinRM. As demonstrated in the previous section, we can use Evil-WinRM to connect using Kerberos (note: ensure that krb5.conf is properly configured):
No PKINIT?
In certain environments, an attacker may be able to obtain a certificate but be unable to use it for pre-authentication as specific victims (e.g., a domain controller machine account) due to the KDC not supporting the appropriate EKU. The tool PassTheCert was created for such situations. It can be used to authenticate against LDAPS using a certificate and perform various attacks (e.g., changing passwords or granting DCSync rights). This attack is outside the scope of this module but is worth reading about here.
Onwards
Now that we've seen how to perform various lateral movement techniques from Windows and Linux hosts, we'll pivot to a new focus: password management. Note that we recommend practicing all these lateral movement techniques until they become second nature. You never know what you will run into during an assessment, so having an extensive toolset to fall back on is critical.
Authenticate to:
10.129.27.0 (ACADEMY-PWATTCK-PTCDC01)
10.129.27.1 (ACADEMY-PWATTCK-PTCCA01)
With user "wwhite" and password "package5shores_topher1"
What are the contents of flag.txt on jpinkman's desktop?
Use pywhisker to add a TGT on jpinkman's account:
In the output above, we can see that a PFX (PKCS12) file was created (rb82JWWk.pfx), and the password is shown. We will use this file with gettgtpkinit.py to acquire a TGT as the victim:
Install kinit:
Modify /etc/krb5.conf:
With the TGT obtained, we may once again pass the ticket:
Add dc01.inlanefreight.local on /etc/hosts:
Connect with evil-winrm to our target:
Get the flag:
What are the contents of flag.txt on Administrator's desktop?
Use ntlmrelayx to get the certificate:
Launch printerbug:
Get the new certificate:
List to be sure we have it:
Use it with gettgtpkinit to get a .ccache file:
Use our .ccache file to connect with a DCSync:
Now, connct with evil-Winrm and the Administrator's hash and get the flag:
Last updated