WEBVTT 00:00:00.440 --> 00:00:01.860 Now I've cleaned up my environment, 00:00:01.870 --> 00:00:05.470 I made sure to delete all the certificates and log out and clear our tickets, 00:00:05.470 --> 00:00:07.070 we're starting off fresh, 00:00:07.080 --> 00:00:12.160 and we're going to work with this enrollment agent that we have here. 00:00:13.540 --> 00:00:14.500 If you remember, 00:00:14.510 --> 00:00:16.810 the enrollment agent came up when we used Certify's find 00:00:16.810 --> 00:00:18.190 command with the vulnerable switch, 00:00:18.200 --> 00:00:21.630 meaning it was vulnerable to a default low privileged group. 00:00:21.630 --> 00:00:23.850 That would be authenticated users. 00:00:23.850 --> 00:00:26.680 By having authenticated users checked in the access 00:00:26.680 --> 00:00:28.390 control for this enrollment agent, 00:00:28.390 --> 00:00:31.100 it will allow low privileged users to actually request and 00:00:31.100 --> 00:00:32.980 leverage this enrollment certificate. 00:00:32.980 --> 00:00:37.360 Enrollment agent certificates are used when you want to have somebody 00:00:37.360 --> 00:00:40.350 else request a certificate on behalf of another user. 00:00:40.740 --> 00:00:41.950 This would be used when, say, 00:00:41.950 --> 00:00:45.630 you want the systems administrator to request a certificate for a smartcard for 00:00:45.630 --> 00:00:50.030 a user or some other configuration in which you would want to have somebody else 00:00:50.030 --> 00:00:52.160 request a certificate on behalf of another user. 00:00:52.290 --> 00:00:54.810 So the first thing we need to do is request the 00:00:54.810 --> 00:00:56.710 certificate enrollment agent certificate. 00:00:56.900 --> 00:00:58.970 This is just a basic request with Certify, 00:00:58.980 --> 00:01:01.260 nothing fancy, just request the certificate. 00:01:01.540 --> 00:01:02.850 Once we have the certificate, 00:01:02.850 --> 00:01:06.540 we're going to have to transform it again with our OpenSSL. 00:01:06.560 --> 00:01:10.250 So we'll just go ahead and take our information out of the command window, 00:01:10.250 --> 00:01:15.610 put it into Notepad, Save As, we'll call it enroll.pem, 00:01:15.620 --> 00:01:20.160 and then we're going to transform it with OpenSSL, 00:01:20.240 --> 00:01:26.660 and that's going to be OpenSSL. All right, then we'll name it enroll.pfx. 00:01:27.340 --> 00:01:29.980 So now we're going to use this enrollment certificate to request 00:01:29.980 --> 00:01:32.460 another certificate on behalf of another user. 00:01:32.840 --> 00:01:34.250 We're going to need two things. 00:01:34.250 --> 00:01:36.580 We're going to need the other user that we're going to request it on 00:01:36.580 --> 00:01:40.350 behalf of, and we're going to want that to be a domain admin if possible, 00:01:40.350 --> 00:01:44.000 and we're also going to need to find a certificate template that the 00:01:44.000 --> 00:01:46.070 enrollment agent is allowed to enroll in. 00:01:46.160 --> 00:01:48.630 We'll first start with that last one. 00:01:48.740 --> 00:01:52.300 We can go back to our Certify's find command, and since 00:01:52.300 --> 00:01:53.830 we're looking for client authentication, 00:01:53.830 --> 00:01:56.780 we'll go ahead and use the clientauth switch. And what we're 00:01:56.780 --> 00:02:00.390 looking for are templates that have the Application Policies 00:02:00.390 --> 00:02:02.710 set to Certificate Request Agent. 00:02:02.800 --> 00:02:03.920 Fortunately for us, 00:02:03.920 --> 00:02:07.980 this last one here has that set so we don't have to go scrolling through it all. 00:02:07.990 --> 00:02:09.419 I wonder how that happened. 00:02:09.440 --> 00:02:12.020 Anyway, we're going to request this GloboUser 00:02:12.020 --> 00:02:15.060 template on behalf of our domain admin. 00:02:15.240 --> 00:02:16.860 But how do we find that domain admin? 00:02:17.240 --> 00:02:21.270 Well, if I run an op, I would use the CAdmin person because they 00:02:21.270 --> 00:02:24.190 have write permissions to a lot of these templates, which means 00:02:24.190 --> 00:02:26.060 they're likely an elevated user. 00:02:26.170 --> 00:02:29.230 That would give me the quickest and quietest way to determine that. 00:02:29.240 --> 00:02:35.220 But thankfully for us, Certify has a pkiobjects /findAdmins command that can 00:02:35.220 --> 00:02:40.040 actually help you, yeah, find admins. And look at that, CAdmin is a good 00:02:40.040 --> 00:02:44.520 choice, so we're going to go ahead and use the CAdmin character and we're 00:02:44.520 --> 00:02:50.890 going to now request this certificate of GloboUser and we're going to specify 00:02:50.890 --> 00:02:54.790 our certificate authority and our template name, and we're going to request 00:02:54.790 --> 00:02:59.300 it on behalf of Globomantics CAdmin, and then we're going to specify our 00:02:59.300 --> 00:03:03.560 enrollment template and the password that we left blank because we're super 00:03:03.560 --> 00:03:07.600 secure here at Globomantics. Now we have another certificate, what do we do? 00:03:07.710 --> 00:03:13.250 Well, you guessed it. We've got to transform it with OpenSSL and work our magic. 00:03:13.250 --> 00:03:14.800 So, let's go ahead and do that. 00:03:14.810 --> 00:03:15.770 Here we go. 00:03:15.780 --> 00:03:20.010 We'll copy it out, we'll copy it in, we'll go ahead All Files, 00:03:20.020 --> 00:03:26.810 Save As, OpenSSL, and then we're going to copy this, paste, and 00:03:26.810 --> 00:03:30.990 we're going to save it as cadmin.pfx. 00:03:31.000 --> 00:03:34.750 All right, so one last step. 00:03:34.760 --> 00:03:38.420 But again, to make sure that I totally wow you, 00:03:38.430 --> 00:03:42.900 I have to show you I don't have access to the domain controller. 00:03:42.910 --> 00:03:46.020 But let's also show you that I don't have access to the 00:03:46.020 --> 00:03:48.910 certificate authority because this is a domain admin, so we 00:03:48.910 --> 00:03:50.260 want access to all the things. 00:03:50.270 --> 00:03:53.640 All right, now we're going to go ahead and work our Rubius 00:03:53.640 --> 00:03:59.950 magic and pass the ticket. Abracadabra, voila, and now I 00:03:59.950 --> 00:04:03.700 have access to not one, but two. 00:04:03.710 --> 00:04:06.870 And if there were three or four, I think this means we 00:04:06.870 --> 00:04:09.160 can move laterally, and that's a win. 00:04:10.440 --> 00:04:15.330 What's even better about these methods of establishing domain elevation 00:04:15.340 --> 00:04:20.540 with these certificates is that these certificates create a persistence 00:04:20.670 --> 00:04:23.890 that is machine and password independent. 00:04:23.970 --> 00:04:26.780 They are granting you authentication. 00:04:26.880 --> 00:04:30.450 You can use the certificate for as long as the certificate is valid, 00:04:30.740 --> 00:04:35.240 even if they rebuild the system or the user changes their password. 00:04:35.420 --> 00:04:42.400 This can be a truly powerful and devastating attack surface if left open, 00:04:42.410 --> 00:04:46.060 and I hope that you really enjoyed learning about it.