Added features to abuse ManageCA and ManageCertificates permissions (ESC7) #12
Conversation
Two new commands have been added: - coerceauth: It will abuse the CDP extension to coerce the CA server to perform an authentication attempt to a remote server. - writefile: It will abuse the CDP extension to write an arbitrary file to a local or remote path. The CA server must have write permission over the remote share. The most useful use case for this functionality is to obtain a web shell, but it could also been used to perform arbitrary file overwrite/others-.
|
Hi @Kudaes ! First of all, awesome work on this and thanks for the PR! One question: does this work without the RSAT tools being installed (specifically the Active Directory Certificate Services Tools)? One of our goals was for this to run from a base Win10 OS which typically does not have the RSAT tools installed. |
Now It is possible to get the current CDP list without performing any change in the CA's configuration. Useful to retrieve remote writable shares before uploading a shell.
|
Hi @leechristensen, thanks for the kind words ! First of all, just let you know that we have added two new commands to abuse ManageCA permission:
Answering your question, all of this features require some DCOM methods that are not installed by default, therefore ADCS RSAT tools are mandatory. We understand what you say about the tool main goals, but we didn't find any other way of developing these features. Thus, we understand that this could be enough reason to reject the PR ^^. Let me know if there is any other information that I can provide you with. |
|
@Kudaes Which part of the code references the RSAT library? |
|
@CaledoniaProject Mostly the functions added in the file ModifyConfigEntry.cs. Anywhere you see the use of the interface ICertAdmin2 means that we are using the DCOM functionality contained in the library certadm.dll. You could try to register manually this dll using regsvr32, but the only way that I've gotten it to work is by installing RSAT. |
|
Hi @leechristensen, any updates regarding this PR? |
|
Hey @Kudaes , sorry for the delayed response on this. For now, we're not going to include this due to the dependency on the RSAT tools. If you can think of a way to support Certify running while not having them installed on the machine, we'd be happy to include it. Awesome research nonetheless and thanks for taking the time to make these contributions! |
3 participants
Two new commands have been added in order to replicate PSPKI functionalities to perform the ESC7 attack:
setconfig: It allows to abuse ManageCA permission to both enable EDITF_ATTRIBUTESUBJECTALTNAME2 and to disable REQDISP_PENDINGFIRST. This command has an optional flag "/restart" to remotely restart the service CertSvc in order to apply the setting changes.
issue: It allows to abuse ManageCertificates to issue an approval pending certificate.