Hacking on Medium
Qué es el Vishing: estafa a través de llamadas o mensajes de voz

https://cdn-images-1.medium.com/max/1532/0*OSI3xekwAtY_csUE
PUBLICADO EN 27 ENERO, 2022 POR EHACKING

Continue reading on Medium »

Book Request for Sailor
https://www.reddit.com/r/Pentesting/comments/se1evj/book_request_for_sailor/

<!-- SC_OFF -->Currently I am sailing around South America and have limited data I can use each month, I am currently taking a video course that occupies most of my data. On the slow days when there is no service or just whenever, is there a book on ethical hacking that is mostly just theory and not projects (that require data or a charged laptop)? I'm thinking a book that really covers the fundamentals with examples. Thanks! <!-- SC_ON --> submitted by /u/s-pi1313 (https://www.reddit.com/user/s-pi1313)
[link] (https://www.reddit.com/r/Pentesting/comments/se1evj/book_request_for_sailor/) [comments] (https://www.reddit.com/r/Pentesting/comments/se1evj/book_request_for_sailor/)

hacking: security in practice
Hacking on macOS

Hey guys, I’m pretty new to hacking I have a bit experience with Ubuntu and Kali Linux, but switched to macOS because it’s a more stable OS compared to Kali Linux and I’m currently studying computer science. Sadly we don’t talk that much about IT security. Long story short, I wanted to ask you guys whether you have some tips for someone using macOS as their main OS for hacking. I can’t use vmware, virtualbox etc. because I own a MacBook with 1,4GHz quadcore processor and 8gb ram. The battery life isn’t pretty long. It lasts about 5-6hrs and I don’t want to dualboot.

My plan is to switch to a MacBook Air M1 with 1TB or 512GB SSD and 16GB RAM and use a virtual machine. But until I switch to M1 macbooks, I want to use macOS compatible tools like metasploit, nmap, gobuster etc.

Do you have any tips for someone using macOS for hacking? Except something like (use a virtual machine , dualboot etc.)

I‘m using my terminal a lot and got average linux skill and basic bash scripting skills.

There a lot of pentesting tools on github mostly written to be executed on linux distros like kali or ubuntu. A lot of tools can be installed via brew, but pentesting tools for kali from gitbub cant be used on macOS out of the box. I tried to change the intall bash scripts but the still are not working.

Any tips how to get linux (kali linux) tools working on macOS.

Thanks in advance

submitted by /u/FigmaWallSt
[link] [comments]

hacking: security in practice
Ways someone could have used my IP-address

Hi everyone.

Can you guys provide me ways of how someone else could have used my IP-address to do shady things online?

Examples like:

- Have actual access to my network.

- Have a backdoor to my PC which is connected to my network.

etc.

​

Please help.

submitted by /u/Witty_Control6793
[link] [comments]

hacking: security in practice
Credit and debit card numbers

I recently started working in the finance department of an ATM provider and today I was working in a file with full credit and debit card numbers just under 10k

From the other info I could see there didnt seem to be any other numbers like expirey date etc. I reported this straight away to the finance manager and they looked the file path to only specific teams and personell.

My question is, is this really a fix for the issue? Also would a hacker be able to use just the numbers on their own for malicious use?

submitted by /u/keechy1231
[link] [comments]

Dark Reading: Attacks/Breaches
Log4j Proved Public Disclosure Still Helps Attackers

Disclosure also puts organizations in the awkward position of trying to mitigate a vulnerability without something like a vendor patch to do the job.

Dark Reading: Attacks/Breaches
With Cloud the Norm, Insiders Are Everywhere — and Pose Greater Risk

After companies accelerated their adoption of cloud infrastructure, remote workers are now insiders and pose significant risks, and costs, to companies.

Dark Reading: Attacks/Breaches
Censys Completes $35 Million Series B Funding Round Led by Intel Capital

Also names Brad Brooks as new CEO.

Dark Reading: Attacks/Breaches
Barracuda Expands Email and Endpoint Protection Capabilities in MSP Security Offerings

Barracuda enhances SKOUT Managed XDR offering via new integration with Barracuda Email Protection and alliance with SentinelOne for endpoint protection.

Dark Reading: Attacks/Breaches
IFSEC Seeks Security Pros for New Survey on Physical Access Control

Take part in an IFSEC Global survey to better understand the state of access control in 2022.

Hacking Articles|Raj Chandel's Blog
Domain Persistence: Golden Certificate Attack

IntroductionSecurity analysts who have some knowledge about Active Directory and pentesting would know the concept of tickets. Kerberos, the default authentication mechanism in an AD, uses ticket-based authentication where a Key Distribution Center (KDC) grants a Ticket-Granting Ticket (TGT) to a user requesting access to a service or an account which can then be redeemed to generate a service ticket (ST) to access a particular service, like SQL account. Attacks such as Golden Ticket demonstrate how an attacker can persist its access to the domain admin by obtaining “krbtgt” account’s NTLM hash. Domain persistence is necessary for an analyst in the event the admin password gets changed. Persistence can also be achieved by using certificate based authentication deployed in Active Directory Certificate Service. One such method is the Golden Certificate Attack. This technique leverages the certificate-based authentication in AD enabled by default with the installation of ADCS (Active Directory Certificate Services) by forging a new certificate using the private key of the CA certificate. The technique was implemented by Benjamin Delpy in Mimikatz. Will Schroeder and Lee Christensen wrote a research paper on this technique which can be referred here.<o:p Table of Content<o:p· ADCS and Certificate Basics<o:p

· Installing ADCS in a local AD environment<o:p

· Extracting CA certificate<o:p

· Forging a new CA certificate<o:p

· Obtaining domain admin’s TGT<o:p

· Extracting admin NTLM hash<o:p

· Performing PtH (Pass the Hash) attack<o:p ADCS and Certificate Basics<o:pADCS provides authentication in a forest. It enhances the overall security identity of a member (user or service account) by binding it to a corresponding private key. A certificate is an X.509-formatted digitally signed document used for encryption, message signing, and/or authentication. It contains the following details:<o:p

· Subject- The owner of the certificate.<o:p

· Public Key- Associates the Subject with a private key stored separately.<o:p

· NotBefore and NotAfter dates- Define the duration that the certificate is valid.<o:p

· Serial Number- An identifier for the certificate assigned by the CA.<o:p

· Issuer- Identifies who issued the certificate (commonly a CA).<o:p

· SubjectAlternativeName- Defines one or more alternate names that the Subject may go by.<o:p

· Basic Constraints- Identifies if the certificate is a CA or an end entity, and if there are any constraints when using the certificate.<o:p

· Extended Key Usages (EKUs)- Object identifiers (OIDs) that describe how the certificate will be used. Also known as Enhanced Key Usage in Microsoft parlance<o:p

· Signature Algorithm - Specifies the algorithm used to sign the certificate. <o:p

· Signature- The signature of the certificates body made using the issuer’s (e.g., a CA’s) private key.<o:p

Certificate Authorities (CAs) are responsible for issuing certificates. Upon ADCS installation, CA first creates its own public-private key pair and signs its own root CA using its private key. Hosts add this root CA in heir systems to build a trust system. <o:p Certificate Enrollment - The process of a client obtaining a certificate from AD CS is called certificate enrolment in which the following steps happen:<o:p

· Client generates public/private key pair<o:p

· Client places public key in a Certificate Signing Request which includes details like subject of certificate and certificate template name.<o:p

· Clients sign CSR using private key and send CSR to enterprise CA server.<o:p

· CA[...]

server verifies the client’s requested certificate’s template<o:p

· CA generates the certificate and signs it using its own private key<o:p Types of extensions in certificates - Following extensions can be found throughout this article:<o:p

· *.p12 - The PKCS#12 is a binary format for storing the server certificate, any intermediate certificates, and the private key into a single encryptable file. Whenever you export a certificate using certsrv.mscit comes out in a p12 format.<o:p

· *.pfx - It is the same as *.p12. *.pfx files are also PKCS#12 format binary certificates. The only difference is that *.pfx was developed by Microsoft and *.p12 by Netscape. So, for compatibility reasons you’ll see us converting *.p12 into *.pfx format.<o:p

· *.pem - Contains Base64 encoded certificate+private key pair in this context. Otherwise, a pem file can have any thing depending on the developer.<o:p Installing ADCS in a local AD environment<o:pTo configure ADCS in our test environment, we followed the following steps.<o:p

Step 1: Go to server manager and choose “add roles and features”<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjA-dYzVjhP9cXj8nWebXYNJwssCUXEi5pH_Lf_KSQHhjaJ5pSSqWoBsikkoG0duyzYGMnnJ5W1a7Bp6n2x3QIwAz9rEFOceWqSwzSmNGmUwSDIS8_MKRaXlr8SyVV1oOO4uwyqXEcvwIPhQOVYsT8DMjvwQd3zZw5qmRmSmjoATQ4URsGvBxP_KF05sA=s16000 <v:shapetype<v:stroke<v:formulas<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:path<o:lock<v:shape<v:imagedata<o:p

Step 2: You could read about pre-requisites that windows recommends and click next<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgViusZHka1lGGAcHHE79rJ-MaM6smuPSccaDmwPhSnRPzx_kyGazpEQHN94hXxTB3VjtsEfthxobdvD-IbnyhMIk30ZYixVurz7PFn7vFHGQNwifVm7ZjG6OupBXHYt00XVTAT3vfqmar9vEdks0r03DThqEiUy9KVwhxTq3szAcxD1Zhcpl59SThq0A=s16000 <v:shape<v:imagedata<o:p

Step 3: Choose the server from the server pool. Your environment could have multiple pools, we’ll choose DC1.ignite.local<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg8hE3apCM6G0JQv11DgHXRtMg-NEDcBmMQdS_dmC245nvaIRZJFgWaRQsz_nzKSMLekKIQrkdXsElSdg2wL-P0eci_9f2NZBLp_PO6u80B8y_6snMSNhVNvp9GWiYTmvKXgkVhzw9U3Yb8dscC9Ybzd3y9kDwssNPrk3bN_2PlNxEXg0BDtSOwmXjVLg=s16000 <v:shape<v:imagedata<o:p

Step 4: Under server roles, choose Active Directory Certificate Services and click next<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjz4tQ2-k550CcP3gAAGjsEq1dqakfzZ6S3qAa3V4O8uZ-1tSvWtACc2b3DUrqWkTTaZleVo_bGgsWbMATJLtGZ-lWcADBj1SN6cSLAZrZtomFIzRRPLXPpFNsVOAWYtOT-PA0i7kCiedNCjoCpqtFDSeOGPnS8T-Vt6ORgPva6yDqpI8ywaYwzzdmx7A=s16000 <v:shape<v:imagedata<o:p

Step 5: You can click next on this step or add some features. For this demo we don’t need anything extra so click next.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjvAUgCEuvxuF6Z2nd604xyletQPhzcEuc-Csk8UhIC6bAGdP-g02iBvYbjyD0qYp5aKFxMIB9eUOBeA6bvskQCtQ6L-Odo5GnI3E20zkAPwGYUT8jxV-7wt8yk4KwKMNkimgkYAA1qJ---A_jtiLY8zHLWF9E5QXsWRpgHDIFKQCGcr1y1mR5XxkPQ_w=s16000 <v:shape<v:imagedata<o:p

Step 6: Choose your role as the Certificate Authority. A CA is the primary signer of user certificates and allows them access to resources under certificate-based authentication schema.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEh-vJOxCSRmlPOB4f2WdrGInD8SZ9RViF6BgiGGysgKddtR9fsbiKevKlmzdrmvc00N-MUuaWwmRwG9XghC0JYUa0b6i2B48_SE2JzYet_RBRnX9-Q0RYxZjHviFJIKPkSU8WOhKUNYLZW_zouEJpqdCMgN3oP634vE0DZS6IxpE89WxZ-VmGZT1kuXaA=s16000 <v:shape<v:imagedata<o:p

Step 7:Click install<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhda5FuIvGXHKWTL1TWZyQvA8rYhtd2OTmmGl3pK3jH481JuM1MqN9Y5j0XmHJ4AzofbZAtBMhfmXdoS7C0D03kWat6Ztj2EDQ5vTriKDw-A-g0kvHC8PkZ1Mp98KWnMOmMAL31tkI5ckmKqPWiSwUsRE2xLcqLJt_IMLNU2WN-MbRe-mtuDafdP8Vbag=s16000 <v:shape<v:imagedata<o:p

Step 8: Under the flags [...]

(notification) click configure Active Directory Certificate Services on the server<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhnz5KvCkEx8Q1bnMu70IzLBh6VQY6vLdNvfkkNmkWDCalBrG5M6f0eDJhNWSbBzXKpLfbMZY69XLVBSt8DMG6WVpmNXVgkOxtjvQdkHyneFFb5ctRVOtj1i_pM9PoQFr_uan4F85LizrfvBbwQ9HXZJBNIAQTIsdNxLzsx482HD_MFEnXQTOKFH-XusQ=s16000 <v:shape<v:imagedata<o:p

Step 9: Here, you can specify the Admin account you want to serve as your CA<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgXQGzs25Bf4u7_ngtqjwe4-EDapuH5CeALwOx23it8xt-YT82UBayVjzYIvNcbmDiEnFVCgMtpkH7HFNL0fAxqqRkgmeP6cAJWlx9jo_e03uSDxn-jTLPzAFIfjvN4bMmuD2OGtL5DB7meQT1OPdZc5VpWarkfjUvLMTfO0-HUS4TsKWQJ5SW-IuxEBQ=s16000 <v:shape<v:imagedata<o:p

Step 10: Choose CA (redundant step but click anyway)<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjFZUTdPwb6VUNel-FYWYAVWSQJUeqSy7YzmNIzSOZH8xemOqhHycXLO8ymfY1a_mL9rGpZPjRB4faz8jD0vmfHCGwHAU_woUvyQwx2k6-rbjuoFyDPXhNgg6iMTBPeIPolsIRgvK9sfs6Z_q00jkANeUTMljLST48vnlFJDzX5F8nhfWDCqu545nePYA=s16000 <v:shape<v:imagedata<o:p

Step 11: Choose enterprise CA<o:p https://blogger.googleusercontent.com/img/a/AVvXsEig8zG16NBCtNI09hv37JiOxYRarSK5_bGQDVKuFy6oiwgQKHB9YABlVk9Zyyq6Cq8qQaixqUMNjzekDAiZ4ZxTZq-xLsTzuIQDdEdcRDWOwrKNvigZtO3BN98aeG4l_7aaRrkugXGLOZjwAo4JY9KVWcaYX2r3L7LKxk81Pyat1KATvcHpXSGJKSD6Dg=s16000 <v:shape<v:imagedata<o:p

Step 12: Choose Root CA as domain admin is the one that is on the top of PKI structure<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg5fZPZoUYgpyjDSo4EC-rR3s-YKPYdN69BTjzxVFzyT21ZmnWdr_fDIXDlQE4UJ3tAmBk-4058N5_EcQxir_djIufrCGxKBYjcOBAVCqSD1P3L5DKqeFTREgHVux7sWvz35EQEPLecy-_SsnsFbLulZvbVrbHvnsO0xrW2Dy8sAZYKinFwZVM92Gov3Q=s16000 <v:shape<v:imagedata<o:p

Step 13: Create a new private key. As explained above, a private key is required to sign any user certificate including the root CA. This key can be used to forge golden certificate as will be explained later.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhUbB-fgr3qkpNxwIFjVzxiL7fjmuUfqwzM2iaxNrzhRigj3yFbRS9oqjxG1vTMlQW8emjOrQ5DDzKiHmikq2nO13zh_rdnDDMChGwi9uo28_N8wj4Bg29rDSmBzI3U8vnAZmXvRTEhTf5qtxj7Oka6OqR8g20fVwnW9lShqVxU1Zn2GHULpEuu5azSZQ=s16000 <v:shape<v:imagedata<o:p

Step 14: You can modify as per your wish. We are leaving everything to the default settings.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhjLCfMkET8rcFMzTb12TzNX2-hP40F7TY3Xlsu34JIPf8VXGqEUijqmZd5TngEbAIILHxKnKq0_EaXRKg-hgBu4RVTjvS-IxeK5lHErMuT5HWaw0xhHA_JEvAQ4WRX8xcArQtV5q_0DN3rsZHghOjf790ghSPsL1Tl48TAF7SRwkkNVCnWR_pGw5r2ZQ=s16000 <v:shape<v:imagedata<o:p

Step 15: Here, you can add the common name for this CA certificate you installed<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg-zgiZj7TaKCwChdcR0EbeHiTiRKzAt59VbwBhNSykOF22mLMhb3EfOt6YfdIbyp45PQs0A9cRhw2v8EI6uXkI3JKMVLm4L7GV-xfkLmSMMIJikcusPK0zJynqN4PNDAmC-yKmE25OyrEqnNSLDMzfApdXl2uE0NH0V1JBr08CZqcdKha_-bpsjaJ_MA=s16000 <v:shape<v:imagedata<o:p

Step 16: Specify the validity of the certificate. For demo purposes leaving them to the default<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjRx-uTi1lQxFPwU5nf-vMHulUTxzzcbDgu-82N3jwxVjIiJIjAJpjilLFlktG58JMi--78xqRiR0yK5YmQrZ2vqk9X9Gaf2GdWnsPgknw5cA4Syge1vVxUNOoICFR1hIxP3erJhY0XIHqoR3oQscZc1vPUe-ZVGGmTkGf5FWaQLt07MDViOLBsEV9ZSQ=s16000 <v:shape<v:imagedata<o:p

Step 17: Customise the locations for the cert and click next.<o:p

<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgd3mfgFSCIrVVE-Zrx5ZnWoscXTGGjcFAWTq32V1fp4uE1-yXa6t_pddeAhRA90vk-hafNqqWHLsLdrir6BBWNA0dlOCtzrB3iQH_hTflCVZkxOBPmLBpUqQlVPNLGMkgjS3G6xpCsIWFbVG5yZYoOhtbLEeM_Lx_HECp7ceiZTuu05X0BQ3cJ8Nf95A=s16000 Step 18: Click on configure<o:p https://blogger.googleusercontent.com/img/a/AVvXsEh87CnXfdjJpq0ATlHqfZsLX3ojzOOlIWGHKGHgS_qotm6OkS6KJvUjp0tJqDKPBGVgjrsLsl6Ulr7Ms2YmfnERaYzFfL-6Gk8oDjIlFvCEy2rNz0LZ-D-_Hp0mk-maYEg1D9H[...]

RxvRXDu9x2WYjdv6c-I5WRKAxDZik-cYvo6ywHzpllzzxlYfHaZ8RNg=s16000 <v:shape<v:imagedata<o:p

Step 19: As you can see, the certificate is now configured successfully<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhX-hCzhkmieiSSD6I86onZzSR6fvLlL1JV3Bdw2ePD-vSkcsWDK5UBEaujTVifof2pgmVmYr3Fo7hteR9TIyTtkgH94INKagKcpzv0izEFrgs0tgi88h8MQg2mXqZ9UEUS_DKapHAZyGwck61vdorMNTcCB0-XPR2EUw6lsBdAkjXRMWqE7vOkUIV2HA=s16000 <v:shape<v:imagedata<o:p

Now that we have set up ADCS and certificate based authentication, we are good to go.<o:p

Here, we have the following architecture for testing:<o:p

Domain Controller- DC1@ignite.local - Admin<o:p

User (Client) - harshit@ignite.local - Windows 10 client connected<o:p

Attacker Machine - Kali Linux standalone<o:p Extracting CA certificate<o:pThis article demonstrates domain persistence. Hence, we are assuming that the attacker has already compromised a user machine in the domain and escalated its privileges to domain admin. Now, the attacker wants his connection to persist for a long period of time. That’s where golden certificate comes into play. To forge a golden certificate, we will extract the CA certificate+private key combo first, using that file (private key), we will forge a new certificate for a particular user (here, DC) and then use that certificate to ask for tickets, dump hashes etc.<o:p

First step is to extract the CA. We can user certsrv.mscrun command on the compromised domain admin system.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgXLdNBBFjv-8TTc6NgOgeEOHJsiSE0sQZTt5KKjPUCsPh1WH6IPlYM_35cU6jF52pVzPiNv0M8zDIlSN262YIoU0oMe2_jFQOxf6IJR5uibvtXzwruk2LbWzEWvpAySn3-Vi_In7nRzC6_R76Dw0rHNEKMGk2GxLz7NCAETMFLpBA6VwBgUrH7RLFb-w=s16000 <v:shape<v:imagedata<o:p

It will open up a window listing all the CAs in server pool. We choose back up CA<o:p https://blogger.googleusercontent.com/img/a/AVvXsEj9nJaiAkLVGXZGr3U5_bZWeO5Yv7fLyM8xEBJd2RJLlseqk_vs8D08SUyOc-A6DKabBfYkLhcZ-Q5ts9-_BAzYK6Lmr7bhiaSJ76b7RWAnHN9HA9oE0znKw4Gu_m7eaFkrgAjKeMKwYT8VrDdNQQb9muOcibB5F7JZ3kFWezKGQcyIqamRKueM9jRKhw=s16000 <v:shape<v:imagedata<o:p

Press next<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg3cQxgbdvzgPescT-6ELULy9iI2d2oNwpOmoGlyWjbkLHTKrNDqJULPRFdw_nqs_vJoD6jeZ5DgggxeLD6dZmGUBLWJv2PiFtSeKE5Hit2U1zf_XEjUW_TITzJSqpDoewZQ45rZQToaNtrrqOCdBAWQ12lPesFIaZunULXcluD_VixtMjTkltKUIwoxw=s16000 <v:shape<v:imagedata<o:p

Here, click on Private Key and CA certificate and give the location of the directory where you want to back this certificate up. Our location is C:\cert<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjQBUJiAqwutC0joNtUfPCDTic-KDyLov3TB3OEm28PJTLGIEXSHf0PUHkmt4SdkdF-v3RUDvaGzsSPoFlmyn6ERHhTRgHgzK3HamCtsenHz9AhxkIaNfKorYcwezznyhmZ34TAMWWuNlMQgEo82hB_GMUNK_6oE8RFobFHUfiqUgTsm4iV_qLw-WMKYg=s16000 <v:shape<v:imagedata<o:p

You can input the password to protect this backup file. This is optional but we can keep a simple password like 12345<o:p https://blogger.googleusercontent.com/img/a/AVvXsEj9JguUj1wGyDxv5eSVuD0p7JCE27-AKUvKbCwzSRtXAJShG9vAOpZw1VmXgaaKQROKoq25CDSe1lvnxWaCUlGvZ35geVvQVSRTjkIG7rJFDsIYheMQgH9nXc3kim5xjSTX5VmA73ngTMrHYarKusATkOfGfHKQRMIweLkUMwZkcWybOf3jA87KBURckQ=s16000 <v:shape<v:imagedata<o:p

Now, the certificate has been extracted successfully. There are other methods to extract the CA certificate too. You can do this using mimikatz as well.<o:p Forging a new CA certificate<o:pAs you would observe that the extracted certificate has a p12 format. This is equivalent to pfx format and theoretically a simple extension change should have converted p12 into pfx but due to some errors, we used openssl to properly convert p12 into pfx using a 2-step process.<o:p

First, you need to download Openssl from here. Once installed you can go to the C:\cert (folder where certificate was backed up) and run the following com[...]

mand to convert this p12 certificate into a pem file.<o:p "C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in ignite-DC1-CA.p12 -out newfile.pemHere, you need to enter the import password 12345. You can set a new password for this pem file. We kept it as 12345 only for simplicity. As you can see “newfile.pem” has been created.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEi0j0-m4qhz0F6FZLgnow5Hg-JJgNX7nPd3J-UXEggYpCKei73GwtP_0f_-zoPruvzIkihTngGZ5Jy7R4J87_aHTiF5uKyEqWg4HFU2vK6eYETEqT2fQZ6X09X8YP55NNi8IccycdxFcNbnEoPp9-RZMIAvgXptOUlnOncAo2iFZOxC-yR0M9Q4fSC3Ug=s16000 <v:shape<v:imagedata<o:p

Now, you need to run another openssl command to convert this pem into pfx.<o:p "C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in newfile.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx<o:pNote, we have added two additional parameters here.<o:p

-keyex: Specifies that the private key is to be used for key exchange or just signing.<o:p

-CSP: Stands for cryptographic service provider. This command specifies that the output file is in a standard format for Microsoft CSP. You can read more about it here.<o:p

You can see that cer.pfx has been exported to this directory now.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjE8DN1v06jnc16BQCNNW38Kssz-7hkJuk-1JfRbyTAK04nHd292lVtgHactdrXVG_oHux7OIcYLdOyQq_RJ7wZbuVoPxxNcADK1etoCXr_RneUjWr0FMQHBrJHLZS3oMJ-ecB3QPmKpRaPLDyMEGuZ99MrWdx5v6xryy2fCuenJJSkRDYBm4VChhtjMg=s16000 <v:shape<v:imagedata<o:p

Using the private key available in this cert.pfx (combo of CA and private key) we will forge a certificate. The tool that we will be using is ForgeCert. This program can be compiled in Visual Studio 2022 just by importing the *.sln file and building the exe. Note that along with the exe, we would need BouncyCastle.dll and some config files. These files will be output in Project folder/bin/debug. Copy these files as it is in the C:\cert folder.<o:p

Now, we will forge our new certificate with the following command:<o:p ForgeCert.exe --CaCertPath cert.pfx --CaCertPassword 12345 --Subject CN=User --SubjectAltName DC1@ignite.local --NewCertPath admincert.pfx --NewCertPassword ignite@123<o:pYou can keep a complex password here but we are keeping a simple ignite@123<o:p

Now, the golden certificate with a validity of 1 year has been saved! This means I have access to the domain for at least a year now!<o:p

<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiKQwZ0jo3_ZGdeD4cONugDpYfEjRMWk2Bf6jRwRbKQspMN0taoXtd0Yoh1vgi571lJiNmanPbYVSFBh9alRqaL5BKox2LgyhVP8A8Aep758oKzlg-1fOBN4mR3tVEHm-LHLA9TZqPsDmE41hZql9z2v0XF-RhDyGBAX0zqQwQe6YfLOUjKX4BS4_gdgQ=s16000 Obtaining domain admin’s TGT<o:pNow that I have forged my golden certificate, I can perform a number of attacks. We are simulating a scenario where the admin password has changed now. Attacker no longer can access domain admin yet still has a user system with him (windows 10 client here). Also, the attacker still has a golden certificate with him! He can use Rubeus to ask for admin’s TGT like so:<o:p Rubeus.exe asktgt /user:DC1 /certificate:admincert.pfx /password:ignite@123<o:pIt gives a *.kirbi ticket which is a base64 encoded format of a TGT.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhpGMQlU745xFsdlrPANs61xRgi7FPzK73CGKqJv4NIbJMknMjxnHVy2KL3nM__kum4-Gbee8YWQbsfF8z_35HSyvCN4XLIgWujY6U9g61LSxa6JH9zwbDfWG1yTXen37QfOZne13zsPa_AyKoSkFoS1iwQkZ_JuXm6iFPT0LdvPkbrLoRxVlmgzaQkwg=s16000 <v:shape<v:imagedata<o:p

So, we can comvert this TGT into a base64 decoded format using kali command:<o:p echo "<ticket" | base64 --decode > ticket.kirbi<o:p<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjKwI3tdnIKbXsrrCzDWk4UYYFFfasMyF-gpSIKKUjXUWW5_ZjUKGK7sIKDG9OFedZtXihJJ1-m_TrsKL6aLsGd1BZ[...]

X-HdGkuxHQbgVp_BTjNLnK35UM8F7EViMuppBwI1vb3f8q3ba3AahsuYslkhfcKFUO2zAHFDiY-bsAGfhyU5egpStXLeGjtOAPw=s16000 Extracting admin NTLM hash<o:pWith this ticket.kirbi, we can do pass the ticket attacks, extract NTLM hashes among other things. Since, we don’t know admin’s new password now, let us try to extract his credentials.<o:p

For that we will run mimikatz on user (windows 10 compromised non admin system on the AD), import the ticket.kirbi using Kerberos::ptt mmodule and then perform a DCSync attack. Since, the ticket is the domain admin’s ticket, we can perform functions that require elevated privileges.<o:p kerberos::ptt ticket.kirbi<o:plsadump::dcsync /domain:ignite.local /user:administrator<o:pThis gives us a fresh set of admin’s NTLM hash<o:p

<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjVfxxGlYn0_Z3LrOcWyI33tfm1AGEeiUxI0ZuUCi8GOHw-wO3HHxKA3-bin5WG1ZY5nxUuCUTgnGdH7rGG8bXlS8aBOOnw2O55fsUYc3kH1bJ7NQesLJF9XYS1Dli-E0tsiHNQEKLK9CH5GYgMUOMm64G-i6_DtV559CIVZxla3exxaHcpkhMP3Gn86A=s16000 Performing PtH (Pass the Hash) attack<o:pWe can further perform Pass the hash attack using these credentials, or crack them using john/hashcat. We head over to our Kali terminal and use pth-winexe binary, which is a part of the pass the hash toolkit by byt3bl33d3r. This comes built-in in new kali os.<o:p pth-winexe -U Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.188 cmd.exe<o:pAs you can see that we have added 32 bits of 0s before the hash we dumped. As from the release of Windows 10,Microsoft made a change that LM hashes are not used anymore. But the tools that we are going to use in the practical are being used since the old NT and LM times. So, in those tools, we will be using a string of 32 zeros instead of the LM hash.<o:p

Also, to be noted, when we say NTLM in modern times, we mean NTHash. NTLM is a common name that stuck around.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgZRtq1O93tTfC3pIC42mERPeAxmKA1MrGSPqhu81UF2OPaELM_JBkC8KgoZfRIz0_bgWLII9oARCnDxIVtYCo9dbsEv0VfahS9IMvAWd9wrHkK0EfyhtlRmsH5oZ3PrTsmBVwm6ZNATy7CzB7B3HdyyqZHRhvZFXV6pEl98EOqVIuhM_1pye5fqR-p9Q=s16000 <v:shape<v:imagedata<o:p

So, as you can see using the golden certificate, we were able to extract admin tickets, dump hashes and perform Pass the hash or pass the ticket attacks.<o:p Conclusion<o:p95% of the Fortune 500 companies are using Active Directory in one way or the other. Attackers or analysts often conduct pentest on the corporate AD. Golden certificate attack is a domain persistence attack that could allow an attacker upto an year of persistence on a compromised machine even if the admin password gets changed or new admins are added. It is a useful technique with a potential to have various other sub attacks in the future on ADCS. Hope you enjoyed the article. Thanks for reading.<o:p

Gh-Dork - Github Dorking Tool
http://www.kitploit.com/2022/01/gh-dork-github-dorking-tool.html