WEBVTT 00:00:00.940 --> 00:00:03.920 Hello, and welcome to the Pluralsight Red Team course, 00:00:03.920 --> 00:00:05.560 Privilege Escalation with Certify. 00:00:06.240 --> 00:00:07.740 My name is Kat Seymour, 00:00:07.820 --> 00:00:11.110 and I'm here to teach you how to use the C# tool Certify to 00:00:11.110 --> 00:00:13.520 enumerate and abuse misconfigured Active Directory 00:00:13.520 --> 00:00:15.210 Certificate Services environments. 00:00:16.239 --> 00:00:19.130 Certify was created by Will Schroeder and Lee Christensen, 00:00:19.140 --> 00:00:20.960 otherwise known as @harmj0y and @tifkin, 00:00:20.960 --> 00:00:23.710 to enumerate and abuse misconfigured Active Directory 00:00:23.710 --> 00:00:25.450 Certificate Services environments. 00:00:26.040 --> 00:00:28.760 While looking into how Active Directory certificates could 00:00:28.760 --> 00:00:30.700 be used as a method of authentication, 00:00:30.710 --> 00:00:33.460 Will and Lee discovered that many misconfigurations in 00:00:33.460 --> 00:00:35.860 these environments could be leveraged to gain elevated 00:00:35.860 --> 00:00:37.770 privileges and domain persistence. 00:00:37.940 --> 00:00:40.270 The techniques that Will and Lee discuss in their blog 00:00:40.270 --> 00:00:42.660 posts and accompanying whitepaper, Certified Pre‑Owned, 00:00:42.670 --> 00:00:45.520 are leveraging built‑in Windows commands and 00:00:45.530 --> 00:00:48.180 environment tools to accomplish these goals, 00:00:48.190 --> 00:00:51.860 allowing us to live off the land and making detection very difficult. 00:00:52.720 --> 00:00:56.220 Certify is an open source C# tool that Will and Lee created to 00:00:56.220 --> 00:00:58.490 help facilitate the attacks in their whitepaper. 00:00:58.660 --> 00:01:02.090 It is available for download at the GhostPack GitHub where you'll also find 00:01:02.100 --> 00:01:06.480 other useful tools such as Rubius, which we'll also be using in this course. 00:01:06.480 --> 00:01:10.130 A quick google search and some of the keywords and configurations that we'll 00:01:10.130 --> 00:01:13.740 be using in this course can show you just how widespread and powerful this 00:01:13.740 --> 00:01:14.860 attack surface can be. 00:01:15.440 --> 00:01:18.510 You'll find everything from installation documents to support forums, 00:01:18.510 --> 00:01:24.240 telling you to configure even the most dangerous of these configurations. In 00:01:24.240 --> 00:01:28.330 the cyber kill chain, Certify comes in post‑exploitation, allowing us to 00:01:28.330 --> 00:01:31.820 generate certificates that will provide us persistence and elevate our 00:01:31.820 --> 00:01:36.930 privileges within the domain. Certificates are used within an environment to 00:01:36.930 --> 00:01:41.090 establish trust, and Certify allows us to generate certificates that will 00:01:41.090 --> 00:01:44.930 essentially modify the domain trust relationship between Active Directory 00:01:44.930 --> 00:01:45.710 objects. 00:01:46.540 --> 00:01:50.330 We can use these certificates to establish persistence and elevate our 00:01:50.330 --> 00:01:54.050 privileges within the domain, and we'll also look at how to use these 00:01:54.050 --> 00:01:57.680 certificates to generate Kerberos tickets and perform a Kerberoasting attack 00:01:57.680 --> 00:02:03.080 without having to dump LSASS. To better understand Certify and how to leverage 00:02:03.080 --> 00:02:06.800 it to achieve your goals, it's helpful to understand how the certificate 00:02:06.800 --> 00:02:11.110 enrollment process in Active Directory works. To obtain a certificate in an 00:02:11.110 --> 00:02:15.020 Active Directory Certificate Services environment, a client must first locate a 00:02:15.020 --> 00:02:16.230 certificate authority. 00:02:16.490 --> 00:02:20.810 It then generates a public and private key pair that is used to 00:02:20.810 --> 00:02:23.750 generate and sign a certificate signing request. 00:02:24.440 --> 00:02:28.830 This signing request is then sent to the certificate authority, which 00:02:28.830 --> 00:02:31.210 validates it against the settings in the template, 00:02:31.430 --> 00:02:33.640 including whether or not the requester has 00:02:33.640 --> 00:02:35.390 permission to request the certificate. 00:02:36.340 --> 00:02:37.870 If the request is validated, 00:02:37.880 --> 00:02:41.210 the certificate authority will generate a certificate and sign it with 00:02:41.210 --> 00:02:45.090 its own private key and then send the certificate to the client to be 00:02:45.090 --> 00:02:47.160 used for what the certificate is valid for. 00:02:47.640 --> 00:02:50.770 It is this stage of the process that we are going to inject into. 00:02:50.780 --> 00:02:53.690 We are going to leverage misconfigurations in the certificate 00:02:53.690 --> 00:02:57.230 templates to allow us to request certificates on behalf of other 00:02:57.230 --> 00:02:59.910 users or to add them to our certificate requests, 00:02:59.920 --> 00:03:05.270 which will grant us authentication rights as that user. Certificates are 00:03:05.270 --> 00:03:08.060 digitally signed documents that are used in encryption, 00:03:08.110 --> 00:03:09.960 message signing, and authentication. 00:03:09.970 --> 00:03:12.670 They contain various fields that help define who, 00:03:12.680 --> 00:03:14.760 when, and how they can be used. 00:03:15.600 --> 00:03:18.660 The fields that we'll be interested in for the purposes of this course are the 00:03:18.660 --> 00:03:23.170 subject, or the certificate owner, the subject alternative name, and this 00:03:23.170 --> 00:03:27.200 would be a secondary owner or owners of the certificate, something commonly 00:03:27.200 --> 00:03:31.740 used in, say, a web server pool. We'll also be interested in the basic 00:03:31.740 --> 00:03:33.660 constraints while using the certificate, 00:03:34.140 --> 00:03:37.250 the not before and not after dates, which define when the certificate 00:03:37.250 --> 00:03:42.530 is valid for, and finally, the extended key usages, or EKUs. These 00:03:42.530 --> 00:03:46.250 define how the certificate can be used, whether it's for code signing, 00:03:46.280 --> 00:03:51.820 encryption or client authentication. In the resources section, you'll find 00:03:51.820 --> 00:03:55.130 instructions on how to build the lab that we'll be using for this course. To 00:03:55.130 --> 00:03:59.040 give you an overview of how it is set up, I created an Active Directory 00:03:59.040 --> 00:04:01.120 environment that contains a client system, 00:04:01.300 --> 00:04:04.390 an Active Directory domain controller, and an Active 00:04:04.390 --> 00:04:07.440 Directory certificate server that is separate from the 00:04:07.440 --> 00:04:09.130 Active Directory domain controller. 00:04:09.940 --> 00:04:14.150 I also created some users, a basic user and a domain admin, so we can 00:04:14.150 --> 00:04:17.600 demonstrate privilege escalation, but then I configured some other users 00:04:17.600 --> 00:04:20.440 with different privileges and groups so that I could fully explore the 00:04:20.440 --> 00:04:22.170 potential of this attack surface. 00:04:22.330 --> 00:04:25.860 I highly recommend that when you set this up at home you do so as well. 00:04:27.340 --> 00:04:29.860 Finally, I had to configure some templates so we 00:04:29.860 --> 00:04:31.260 could interact with the environment. 00:04:31.940 --> 00:04:35.040 For this course, we created one that will allow us to specify a 00:04:35.040 --> 00:04:38.480 subject alternative name and add this other user to our 00:04:38.480 --> 00:04:42.110 certificate, as well as a misconfigured enrollment agent that has 00:04:42.110 --> 00:04:44.300 its access control set incorrectly, 00:04:44.310 --> 00:04:47.750 allowing us to use it to enroll in other certificates as a basic 00:04:47.750 --> 00:04:51.730 user. It becomes a very short step from basic user to domain admin, 00:04:51.730 --> 00:04:55.270 as you will see. Now that we've gone over all of that, why don't we 00:04:55.270 --> 00:04:57.760 fire up Certify and let's go play.