WEBVTT 00:00:00.440 --> 00:00:03.360 The instructions for how to compile Certify are on the GhostPack 00:00:03.360 --> 00:00:05.020 GitHub where you went to download the tool. 00:00:05.240 --> 00:00:07.560 If you scroll past all the README and help files, 00:00:07.560 --> 00:00:10.630 you'll find instructions on how to load it into Visual 00:00:10.630 --> 00:00:13.130 Studio Community edition and compile it. 00:00:13.380 --> 00:00:15.260 It's literally just open and build. 00:00:15.440 --> 00:00:18.630 If you get a pop‑up that says to update it to the latest .NET version, 00:00:18.630 --> 00:00:21.440 just click OK and then go ahead and compile it. 00:00:21.440 --> 00:00:23.140 Once Certify is compiled, 00:00:23.140 --> 00:00:26.210 you just copy it over to the victim machine and you're ready to go. 00:00:26.210 --> 00:00:28.610 Once Certify is on the victim machine, 00:00:28.610 --> 00:00:31.730 you just open a command prompt and you call the program 00:00:31.730 --> 00:00:33.390 from the folder in which it's located. 00:00:33.390 --> 00:00:36.420 To get started, we'll have to enumerate the environment. 00:00:36.680 --> 00:00:38.990 We can do that with Certify's cas command. 00:00:39.040 --> 00:00:41.620 The cas command will enumerate the environment and return 00:00:41.620 --> 00:00:43.590 information about the root certificates, 00:00:43.700 --> 00:00:46.350 the certificates in the NTAuth certificates store, 00:00:46.940 --> 00:00:49.710 information about the certificate authorities themselves, 00:00:50.140 --> 00:00:52.690 as well as the templates that are enabled and 00:00:52.690 --> 00:00:54.910 available for us in the environment. 00:00:54.980 --> 00:00:58.250 This command may take a while to run while it enumerates your environment. 00:00:58.460 --> 00:01:00.080 I've sped it up here for the demo, 00:01:00.080 --> 00:01:02.800 but don't worry if it's taking longer than it did for me. 00:01:02.800 --> 00:01:05.830 What we won't find are details about these templates that help us 00:01:05.830 --> 00:01:07.560 find the ones that are vulnerable for attack. 00:01:07.560 --> 00:01:10.900 To do that, we can use Certify's find command. 00:01:11.240 --> 00:01:14.980 The find command will enumerate the certificate authorities and return detailed 00:01:14.980 --> 00:01:17.510 information about the certificate authorities themselves, 00:01:17.520 --> 00:01:19.760 as well as the templates enabled on each. 00:01:20.240 --> 00:01:22.460 This can be a lot of data to parse through in an op, 00:01:22.840 --> 00:01:25.900 so Certify gives us some switches that we can add to the find command 00:01:25.910 --> 00:01:28.690 that will allow us to whittle down our results. 00:01:29.640 --> 00:01:32.880 Since we're interested in certificates that facilitate client authentication, 00:01:32.880 --> 00:01:35.760 we can use the clientauth switch. 00:01:36.240 --> 00:01:38.700 The clientauth switch will return the certificate templates 00:01:38.700 --> 00:01:40.860 that facilitate client authentication, 00:01:41.340 --> 00:01:44.140 but simply facilitating client authentication isn't enough 00:01:44.140 --> 00:01:46.460 to help us actually perform this attack. 00:01:46.470 --> 00:01:49.530 One of our attacks is to supply an alternative name. 00:01:49.530 --> 00:01:50.340 For that, 00:01:50.340 --> 00:01:52.620 we would need the certificate template to have the 00:01:52.620 --> 00:01:54.750 enrolleeSuppliesSubject flag set, 00:01:54.760 --> 00:01:58.850 and we can look for that with the enrolleeSuppliesSubject switch. 00:01:59.540 --> 00:02:02.380 These results still don't help us easily find one 00:02:02.380 --> 00:02:05.790 that our user is able to enroll in, and that's important. 00:02:05.800 --> 00:02:09.190 The user has to be able to enroll in the template for this attack to work. 00:02:09.310 --> 00:02:13.990 We can use Certify's find command with the vulnerable switch. 00:02:14.270 --> 00:02:16.980 The vulnerable switch, when used by itself with the find command, 00:02:16.990 --> 00:02:20.370 will search for vulnerable templates that are able to be 00:02:20.370 --> 00:02:23.290 enrolled in by default low‑privileged groups. 00:02:23.840 --> 00:02:25.660 We're going to cover enrollment agents next, 00:02:25.660 --> 00:02:29.200 so let's go ahead and request this GloboWorkstation certificate. 00:02:29.200 --> 00:02:30.030 To do that, 00:02:30.030 --> 00:02:32.570 we're going to use Certify's request command and we'll 00:02:32.570 --> 00:02:34.440 specify the certificate authority. 00:02:34.450 --> 00:02:37.200 We can copy that from up here so we don't have any typos. 00:02:37.200 --> 00:02:40.170 Then we're going to need to specify the template name. 00:02:40.190 --> 00:02:41.750 It's important that when you do this, 00:02:41.750 --> 00:02:44.860 you get the capitalization correct or this will not work. 00:02:45.140 --> 00:02:48.420 We're also going to want to specify an alternative name, 00:02:48.420 --> 00:02:51.710 somebody else that we want to add the subject alternative name. 00:02:51.710 --> 00:02:52.140 For this, 00:02:52.140 --> 00:02:54.750 we're going to just use administrator and try and leverage a 00:02:54.750 --> 00:02:56.750 local administrator account left active. 00:02:57.300 --> 00:02:58.890 This request here failed. 00:02:58.900 --> 00:03:01.050 It says it was denied by policy module. 00:03:01.440 --> 00:03:03.550 That's because the default low‑privileged group that has 00:03:03.550 --> 00:03:07.210 permission to enroll in the certificate is Domain Computers and 00:03:07.210 --> 00:03:09.150 the request was made on the user's behalf. 00:03:09.640 --> 00:03:13.310 Certify has a machine switch that you can add to the command 00:03:13.620 --> 00:03:17.560 that will attempt to get system and then make the request on 00:03:17.560 --> 00:03:19.310 behalf of the machine account. 00:03:19.540 --> 00:03:23.380 This request here failed as well because we aren't elevated users on the system, 00:03:23.380 --> 00:03:24.760 so get system failed. 00:03:25.140 --> 00:03:29.280 Well, then how do we find vulnerable templates for our user? 00:03:29.490 --> 00:03:33.430 Certify has a currentuser switch that you can add to the 00:03:33.430 --> 00:03:36.360 vulnerable switch that you can add to the find command. 00:03:36.470 --> 00:03:40.380 So, if we do certify find /vulnerable /currentuser, 00:03:40.540 --> 00:03:43.390 it will search for templates that are vulnerable and enrollable 00:03:43.390 --> 00:03:47.180 by our current user context. And now we still have two templates, 00:03:47.180 --> 00:03:49.150 but this one here, this one's new. 00:03:49.940 --> 00:03:53.820 That must mean that our user page is a member of one of these user groups. 00:03:54.240 --> 00:03:56.570 A quick net command can show you that yes she is. 00:03:56.580 --> 00:03:58.160 Looks like she's a web admin. 00:03:58.170 --> 00:03:58.850 All right, 00:03:58.860 --> 00:04:02.700 so let's go ahead and request this GloboWebServer template, and 00:04:02.700 --> 00:04:05.210 we're going to go ahead and specify the certificate authority 00:04:05.210 --> 00:04:08.660 again and the template name, and go ahead and with an 00:04:08.660 --> 00:04:10.350 alternative name of administrator. 00:04:10.840 --> 00:04:13.280 And now, ah‑ha, all right. 00:04:13.290 --> 00:04:14.500 So now we have a certificate. 00:04:14.500 --> 00:04:15.270 So what do we do? 00:04:15.340 --> 00:04:18.890 Well, thank you Will and Lee for telling us right here that 00:04:18.890 --> 00:04:21.519 we need to use OpenSSL to transform this. 00:04:21.529 --> 00:04:22.010 All right, 00:04:22.019 --> 00:04:25.630 so I have OpenSSL installed on this system, and I am going 00:04:25.630 --> 00:04:29.560 to copy this out of my command window, open up Notepad, 00:04:29.740 --> 00:04:33.560 paste it into Notepad, and then we're going to go to Save As, 00:04:33.570 --> 00:04:36.750 we're going to select All Files because I can't tell you how many 00:04:36.750 --> 00:04:38.820 times I accidentally save it as a text, 00:04:38.830 --> 00:04:43.470 we're going to name it admin.pem, and Save. 00:04:43.480 --> 00:04:48.400 Now we'll just go over to our command window and we're going to use this 00:04:48.400 --> 00:04:51.150 handy dandy command that Will and Lee have given us. 00:04:51.740 --> 00:04:53.710 And we'll go ahead and type this. 00:04:53.720 --> 00:04:56.590 Now I'm going to copy it to save myself some time. 00:04:56.600 --> 00:04:57.220 All right, 00:04:57.220 --> 00:05:00.660 we're going to name it admin.pfx and we'll specify a blank 00:05:00.660 --> 00:05:05.800 password and Enter. Okay, now we have a certificate. 00:05:05.810 --> 00:05:08.990 Now is when I get to show you something really cool and wow you. 00:05:08.990 --> 00:05:11.740 But in order to make sure that you're sufficiently wowed, I have 00:05:11.740 --> 00:05:14.370 to show you first that I do not have access to the domain 00:05:14.370 --> 00:05:16.060 controller. See, Access is denied. 00:05:16.240 --> 00:05:19.730 All right, now we're going to take the certificate that we just created and 00:05:19.730 --> 00:05:24.490 we're going to use Rubius to generate a Ticket Granting Ticket as a local 00:05:24.490 --> 00:05:28.150 administrator on the domain controller, and we're going to pass the ticket 00:05:28.150 --> 00:05:30.060 so that we have access when we're done. 00:05:30.940 --> 00:05:37.980 And then I'm going to go abracadabra, voila. Ta‑da! Aren't you impressed? 00:05:38.210 --> 00:05:40.910 I know, that was so cool. That was a lot of fun. 00:05:41.030 --> 00:05:43.530 And now that we've covered that, I'm going to go ahead and clean up this 00:05:43.530 --> 00:05:46.850 environment so that we can go try an enrollment certificate. 00:05:46.860 --> 00:05:48.010 But before we do that, 00:05:48.020 --> 00:05:51.630 I want to discuss a setting that if you find it set on a certificate 00:05:51.630 --> 00:05:55.780 authority would allow you to perform this attack with any certificate 00:05:55.780 --> 00:05:58.880 that the user is allowed to enroll in, meaning if the user has 00:05:58.880 --> 00:06:00.750 permission to enroll in the certificate, 00:06:00.940 --> 00:06:03.370 you can specify a subject alternative name. 00:06:03.450 --> 00:06:07.150 It's a very dangerous setting to have set globally on a certificate authority. 00:06:07.290 --> 00:06:08.520 This is what it looks like. 00:06:08.530 --> 00:06:12.090 It's edit attributes, you know, that's what it is. 00:06:12.120 --> 00:06:16.160 If you run Certify and you find that this is set on a certificate authority, 00:06:16.210 --> 00:06:19.260 rejoice or cry depending on which side of the op you're on. 00:06:19.340 --> 00:06:22.400 If you are an administrator and this is set on your servers, 00:06:22.400 --> 00:06:25.790 ask yourself why and if you can turn it off. It can actually open 00:06:25.790 --> 00:06:29.090 up giant holes into your environment, and I highly recommend you 00:06:29.090 --> 00:06:32.640 turn it off. Now that we've covered that, let's go ahead and go 00:06:32.640 --> 00:06:34.060 play with our enrollment agent.