Gh-Dork - Github Dorking Tool
Supply a list of dorks and, optionally, one of the following: a user (-u) a file with a list of users (-uf) an organization (-org) a file with a list of organizations (-of) a repo (-r) You can also pass: an output directory to store results (-o) a filename to store valid items, if your users or org file may contain nonexistent users/orgs (-vif) All input files (dorks, users, or orgs) should be newline-separated. Usage Clone the repository, then run pip install -r requirements.txt The only required parameter is the dorks file (-d). See techguan's github-dorks.txt for ideas. If an output directory is specified, a file will be created for each dork in the dorks list, and results will be saved there as well as printed. Only use an empty/nonexistent directory or it will be cleared and its contents replaced. If your users or orgs files haven't already been filtered to remove non-existent users/orgs or those without any public code, it's highly recommended that you pass in a --valid-items-filename (-vif). This will filter out any invalid users/orgs when searching for the first dork, and avoid searching against them for subsequent dorks. The output file can also then be used as the input users/orgs file to speed up later script runs. Example usage: python gh-dork.py -d dorks.txt # Basic usagepython gh-dork.py -d dorks.txt -u molly # Search repos of a specific userpython gh-dork.py -d dorks.txt -uf users.txt # Search repos of all users in the listpython gh-dork.py -d dorks.txt -uf users.txt -vif valid_users.txt # Search repos of all users in the list, filtering out nonexistent userspython gh-dork.py -d dorks.txt -org github # Search repos of a specific organizationpython gh-dork.py -d dorks.txt -of orgs.txt # Search repos of all orgs in the listpython gh-dork.py -d dorks.txt -of orgs.txt -vif valid_orgs.txt # Search repos of all orgs in the list, filtering out nonexistent orgspyth on gh-dork.py -d dorks.txt -r molly/gh-dork # Search the specified repopython gh-dork.py -d dorks.txt -o results # Store results in files in the results/ directory, *overwriting any directory contents* Authentication Authentication is done with environment variables. You can authenticate with a Github private access token (GHTOKEN), or username and password (GHUSER and GHPASS). If you have two-factor authentication enabled, you will be prompted for a two-factor code. You can also pass a Github Enterprise base URL (GHURL) to search against that Github instance; if omitted, this will run against github.com. If no credentials are provided or if credentials are invalid, the script will still run, but will be limited by the much lower rate limits for unauthenticated users. Credits Loosely based on techgaun/github-dorks. Download Gh-Dork
Read more...
Supply a list of dorks and, optionally, one of the following: a user (-u) a file with a list of users (-uf) an organization (-org) a file with a list of organizations (-of) a repo (-r) You can also pass: an output directory to store results (-o) a filename to store valid items, if your users or org file may contain nonexistent users/orgs (-vif) All input files (dorks, users, or orgs) should be newline-separated. Usage Clone the repository, then run pip install -r requirements.txt The only required parameter is the dorks file (-d). See techguan's github-dorks.txt for ideas. If an output directory is specified, a file will be created for each dork in the dorks list, and results will be saved there as well as printed. Only use an empty/nonexistent directory or it will be cleared and its contents replaced. If your users or orgs files haven't already been filtered to remove non-existent users/orgs or those without any public code, it's highly recommended that you pass in a --valid-items-filename (-vif). This will filter out any invalid users/orgs when searching for the first dork, and avoid searching against them for subsequent dorks. The output file can also then be used as the input users/orgs file to speed up later script runs. Example usage: python gh-dork.py -d dorks.txt # Basic usagepython gh-dork.py -d dorks.txt -u molly # Search repos of a specific userpython gh-dork.py -d dorks.txt -uf users.txt # Search repos of all users in the listpython gh-dork.py -d dorks.txt -uf users.txt -vif valid_users.txt # Search repos of all users in the list, filtering out nonexistent userspython gh-dork.py -d dorks.txt -org github # Search repos of a specific organizationpython gh-dork.py -d dorks.txt -of orgs.txt # Search repos of all orgs in the listpython gh-dork.py -d dorks.txt -of orgs.txt -vif valid_orgs.txt # Search repos of all orgs in the list, filtering out nonexistent orgspyth on gh-dork.py -d dorks.txt -r molly/gh-dork # Search the specified repopython gh-dork.py -d dorks.txt -o results # Store results in files in the results/ directory, *overwriting any directory contents* Authentication Authentication is done with environment variables. You can authenticate with a Github private access token (GHTOKEN), or username and password (GHUSER and GHPASS). If you have two-factor authentication enabled, you will be prompted for a two-factor code. You can also pass a Github Enterprise base URL (GHURL) to search against that Github instance; if omitted, this will run against github.com. If no credentials are provided or if credentials are invalid, the script will still run, but will be limited by the much lower rate limits for unauthenticated users. Credits Loosely based on techgaun/github-dorks. Download Gh-Dork
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
7 Ways to Protect Your Crypto Wallet from Hackers.
https://cdn-images-1.medium.com/max/1000/1*D-no6c2TbJPEFPasz5BBtQ.jpeg
1. Enable two-factor authentication
Having two-factor authentication enabled is one of the best ways to protect your crypto wallet. It…
Continue reading on Medium »
7 Ways to Protect Your Crypto Wallet from Hackers.
https://cdn-images-1.medium.com/max/1000/1*D-no6c2TbJPEFPasz5BBtQ.jpeg
1. Enable two-factor authentication
Having two-factor authentication enabled is one of the best ways to protect your crypto wallet. It…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
CSRF attack for beginners
https://cdn-images-1.medium.com/max/711/1*5eFvD3up96eYBqy510apYw.png
CSRF is an abbreviation for Cross-Site Request Forgery where the attacker induces the user to perform malicious activities in the web…
Continue reading on Medium »
CSRF attack for beginners
https://cdn-images-1.medium.com/max/711/1*5eFvD3up96eYBqy510apYw.png
CSRF is an abbreviation for Cross-Site Request Forgery where the attacker induces the user to perform malicious activities in the web…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
“Previse — Hack_The_Box”
https://cdn-images-1.medium.com/max/1019/1*H3ruI3FLBAxhP3xfKHk6BQ.png
Hello everyone, In this blog post I am will be explaining how I was able to get root shell on this machine.
Continue reading on Medium »
“Previse — Hack_The_Box”
https://cdn-images-1.medium.com/max/1019/1*H3ruI3FLBAxhP3xfKHk6BQ.png
Hello everyone, In this blog post I am will be explaining how I was able to get root shell on this machine.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Extremely Easy Security — Learn Cyber Attack Types in Plain English (1.2 Part 1)
https://cdn-images-1.medium.com/max/749/1*Iqdcd4zSDFBRfMW8IlaIcw.png
Today we will be covering different types of cyberattacks and the indicators you can look for to find them, as well as the remediation…
Continue reading on Medium »
Extremely Easy Security — Learn Cyber Attack Types in Plain English (1.2 Part 1)
https://cdn-images-1.medium.com/max/749/1*Iqdcd4zSDFBRfMW8IlaIcw.png
Today we will be covering different types of cyberattacks and the indicators you can look for to find them, as well as the remediation…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Termux Instagram Infoga : Gather Instagram info with Termux
https://cdn-images-1.medium.com/max/600/0*UYN3PcHMDB_Eifzj
Hey Guys🙋♂️, , it takes Instagram is one of the most widely used more than an hour to figure out about someone’s most used tags and who…
Continue reading on Medium »
Termux Instagram Infoga : Gather Instagram info with Termux
https://cdn-images-1.medium.com/max/600/0*UYN3PcHMDB_Eifzj
Hey Guys🙋♂️, , it takes Instagram is one of the most widely used more than an hour to figure out about someone’s most used tags and who…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Piratas informáticos utilizan una nueva técnica evasiva para entregar el malware AsyncRAT
https://cdn-images-1.medium.com/max/1523/0*L99BDHKEsZQ4_5pA
PUBLICADO EN 27 ENERO, 2022POR EHACKING
Continue reading on Medium »
Piratas informáticos utilizan una nueva técnica evasiva para entregar el malware AsyncRAT
https://cdn-images-1.medium.com/max/1523/0*L99BDHKEsZQ4_5pA
PUBLICADO EN 27 ENERO, 2022POR EHACKING
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Domain Persistence: Golden Certificate Attack
IntroductionSecurity analysts who have some knowledge about Active Directory and pentesting would know the concept of tickets. Kerberos, the default authentication mechanism in an AD, uses ticket-based authentication where a Key Distribution Center (KDC) grants a Ticket-Granting Ticket (TGT) to a user requesting access to a service or an account which can then be redeemed to generate a service ticket (ST) to access a particular service, like SQL account. Attacks such as Golden Ticket demonstrate how an attacker can persist its access to the domain admin by obtaining the “krbtgt” account’s NTLM hash. Domain persistence is necessary for an analyst in the event the admin password gets changed. Persistence can also be achieved by using certificate-based authentication deployed in Active Directory Certificate Service. One such method is the Golden Certificate Attack. This technique leverages the certificate-based authentication in AD enabled by default with the installation of ADCS (Active Directory Certificate Services) by forging a new certificate using the private key of the CA certificate. The technique was implemented by Benjamin Delpy in Mimikatz. Will Schroeder and Lee Christensen wrote a research paper on this technique which can be referred to here. Table of Content* ADCS and Certificate Basics
* Installing ADCS in a local AD environment
* Extracting CA certificate
* Forging a new CA certificate
* Obtaining domain admin’s TGT
* Extracting admin NTLM hash
* Performing PtH (Pass the Hash) attack ADCS and Certificate BasicsADCS provides authentication in a forest. It enhances the overall security identity of a member (user or service account) by binding it to a corresponding private key. A certificate is an X.509-formatted digitally signed document used for encryption, message signing, and/or authentication. It contains the following details:
* Subject – The owner of the certificate.
* Public Key – Associates the Subject with a private key stored separately.
* NotBefore and NotAfter dates – Define the duration that the certificate is valid.
* Serial Number – An identifier for the certificate assigned by the CA.
* Issuer – Identifies who issued the certificate (commonly a CA).
* SubjectAlternativeName – Defines one or more alternate names that the Subject may go by.
* Basic Constraints – Identifies if the certificate is a CA or an end entity and if there are any constraints when using the certificate.
* Extended Key Usages (EKUs) – Object identifiers (OIDs) that describe how the certificate will be used. Also known as Enhanced Key Usage in Microsoft parlance
* Signature Algorithm – Specifies the algorithm used to sign the certificate.
* Signature – The signature of the certificates body is made using the issuer’s (e.g., a CA’s) private key.
Certificate Authorities (CAs) are responsible for issuing certificates. Upon ADCS installation, CA first creates its own public-private key pair and signs its own root CA using its private key. Hosts add this root CA in their systems to build a trust system.
Certificate Enrollment – The process of a client obtaining a certificate from AD CS is called certificate enrolment in which the following steps happen:
* Client generates public/private key pair
* Client places a public key in a Certificate Signing Request which includes details like the subject of certificate and certificate template name.
* Clients sign CSR using the private key and send CSR to the enterprise CA server.
* CA server verifies the client’s requested certificate’s template
* CA generates the certificate and signs it using its own private key
Types of extensions in certificates – Following extensions can be found throughout this article:
* *.p12 – The PKCS#12 is a binary format for storing the[...]
Domain Persistence: Golden Certificate Attack
IntroductionSecurity analysts who have some knowledge about Active Directory and pentesting would know the concept of tickets. Kerberos, the default authentication mechanism in an AD, uses ticket-based authentication where a Key Distribution Center (KDC) grants a Ticket-Granting Ticket (TGT) to a user requesting access to a service or an account which can then be redeemed to generate a service ticket (ST) to access a particular service, like SQL account. Attacks such as Golden Ticket demonstrate how an attacker can persist its access to the domain admin by obtaining the “krbtgt” account’s NTLM hash. Domain persistence is necessary for an analyst in the event the admin password gets changed. Persistence can also be achieved by using certificate-based authentication deployed in Active Directory Certificate Service. One such method is the Golden Certificate Attack. This technique leverages the certificate-based authentication in AD enabled by default with the installation of ADCS (Active Directory Certificate Services) by forging a new certificate using the private key of the CA certificate. The technique was implemented by Benjamin Delpy in Mimikatz. Will Schroeder and Lee Christensen wrote a research paper on this technique which can be referred to here. Table of Content* ADCS and Certificate Basics
* Installing ADCS in a local AD environment
* Extracting CA certificate
* Forging a new CA certificate
* Obtaining domain admin’s TGT
* Extracting admin NTLM hash
* Performing PtH (Pass the Hash) attack ADCS and Certificate BasicsADCS provides authentication in a forest. It enhances the overall security identity of a member (user or service account) by binding it to a corresponding private key. A certificate is an X.509-formatted digitally signed document used for encryption, message signing, and/or authentication. It contains the following details:
* Subject – The owner of the certificate.
* Public Key – Associates the Subject with a private key stored separately.
* NotBefore and NotAfter dates – Define the duration that the certificate is valid.
* Serial Number – An identifier for the certificate assigned by the CA.
* Issuer – Identifies who issued the certificate (commonly a CA).
* SubjectAlternativeName – Defines one or more alternate names that the Subject may go by.
* Basic Constraints – Identifies if the certificate is a CA or an end entity and if there are any constraints when using the certificate.
* Extended Key Usages (EKUs) – Object identifiers (OIDs) that describe how the certificate will be used. Also known as Enhanced Key Usage in Microsoft parlance
* Signature Algorithm – Specifies the algorithm used to sign the certificate.
* Signature – The signature of the certificates body is made using the issuer’s (e.g., a CA’s) private key.
Certificate Authorities (CAs) are responsible for issuing certificates. Upon ADCS installation, CA first creates its own public-private key pair and signs its own root CA using its private key. Hosts add this root CA in their systems to build a trust system.
Certificate Enrollment – The process of a client obtaining a certificate from AD CS is called certificate enrolment in which the following steps happen:
* Client generates public/private key pair
* Client places a public key in a Certificate Signing Request which includes details like the subject of certificate and certificate template name.
* Clients sign CSR using the private key and send CSR to the enterprise CA server.
* CA server verifies the client’s requested certificate’s template
* CA generates the certificate and signs it using its own private key
Types of extensions in certificates – Following extensions can be found throughout this article:
* *.p12 – The PKCS#12 is a binary format for storing the[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Domain Persistence: Golden Certificate Attack IntroductionSecurity analysts who have some knowledge about Active Directory and pentesting would know the concept of tickets. Kerberos, the default authentication mechanism in an AD, uses ticket…
server certificate, any intermediate certificates, and the private key into a single encryptable file. Whenever you export a certificate using msc it comes out in a p12 format.
* *.pfx – It is the same as *.p12. *.pfx files are also PKCS#12 format binary certificates. The only difference is that *.pfx was developed by Microsoft and *.p12 by Netscape. So, for compatibility reasons you’ll see us converting *.p12 into *.pfx format.
* *.pem – Contains Base64 encoded certificate+private key pair in this context. Otherwise, a pem file can have anything depending on the developer. Installing ADCS in a local AD environmentTo configure ADCS in our test environment, we followed the following steps.
Step 1: Go to server manager and choose “add roles and features”
https://blogger.googleusercontent.com/img/a/AVvXsEjA-dYzVjhP9cXj8nWebXYNJwssCUXEi5pH_Lf_KSQHhjaJ5pSSqWoBsikkoG0duyzYGMnnJ5W1a7Bp6n2x3QIwAz9rEFOceWqSwzSmNGmUwSDIS8_MKRaXlr8SyVV1oOO4uwyqXEcvwIPhQOVYsT8DMjvwQd3zZw5qmRmSmjoATQ4URsGvBxP_KF05sA=s16000
Step 2: You could read about pre-requisites that windows recommend and click next
https://blogger.googleusercontent.com/img/a/AVvXsEgViusZHka1lGGAcHHE79rJ-MaM6smuPSccaDmwPhSnRPzx_kyGazpEQHN94hXxTB3VjtsEfthxobdvD-IbnyhMIk30ZYixVurz7PFn7vFHGQNwifVm7ZjG6OupBXHYt00XVTAT3vfqmar9vEdks0r03DThqEiUy9KVwhxTq3szAcxD1Zhcpl59SThq0A=s16000
Step 3: Choose the server from the server pool. Your environment could have multiple pools, we’ll choose DC1.ignite.local
https://blogger.googleusercontent.com/img/a/AVvXsEg8hE3apCM6G0JQv11DgHXRtMg-NEDcBmMQdS_dmC245nvaIRZJFgWaRQsz_nzKSMLekKIQrkdXsElSdg2wL-P0eci_9f2NZBLp_PO6u80B8y_6snMSNhVNvp9GWiYTmvKXgkVhzw9U3Yb8dscC9Ybzd3y9kDwssNPrk3bN_2PlNxEXg0BDtSOwmXjVLg=s16000
Step 4: Under server roles, choose Active Directory Certificate Services and click next
https://blogger.googleusercontent.com/img/a/AVvXsEjz4tQ2-k550CcP3gAAGjsEq1dqakfzZ6S3qAa3V4O8uZ-1tSvWtACc2b3DUrqWkTTaZleVo_bGgsWbMATJLtGZ-lWcADBj1SN6cSLAZrZtomFIzRRPLXPpFNsVOAWYtOT-PA0i7kCiedNCjoCpqtFDSeOGPnS8T-Vt6ORgPva6yDqpI8ywaYwzzdmx7A=s16000
Step 5: You can click next on this step or add some features. For this demo we don’t need anything extra so click next.
https://blogger.googleusercontent.com/img/a/AVvXsEjvAUgCEuvxuF6Z2nd604xyletQPhzcEuc-Csk8UhIC6bAGdP-g02iBvYbjyD0qYp5aKFxMIB9eUOBeA6bvskQCtQ6L-Odo5GnI3E20zkAPwGYUT8jxV-7wt8yk4KwKMNkimgkYAA1qJ---A_jtiLY8zHLWF9E5QXsWRpgHDIFKQCGcr1y1mR5XxkPQ_w=s16000
Step 6: Choose your role as the Certificate Authority. A CA is the primary signer of user certificates and allows them access to resources under certificate-based authentication schema.
https://blogger.googleusercontent.com/img/a/AVvXsEh-vJOxCSRmlPOB4f2WdrGInD8SZ9RViF6BgiGGysgKddtR9fsbiKevKlmzdrmvc00N-MUuaWwmRwG9XghC0JYUa0b6i2B48_SE2JzYet_RBRnX9-Q0RYxZjHviFJIKPkSU8WOhKUNYLZW_zouEJpqdCMgN3oP634vE0DZS6IxpE89WxZ-VmGZT1kuXaA=s16000
Step 7:Click install
https://blogger.googleusercontent.com/img/a/AVvXsEhda5FuIvGXHKWTL1TWZyQvA8rYhtd2OTmmGl3pK3jH481JuM1MqN9Y5j0XmHJ4AzofbZAtBMhfmXdoS7C0D03kWat6Ztj2EDQ5vTriKDw-A-g0kvHC8PkZ1Mp98KWnMOmMAL31tkI5ckmKqPWiSwUsRE2xLcqLJt_IMLNU2WN-MbRe-mtuDafdP8Vbag=s16000
Step 8: Under the flags (notification) click configure Active Directory Certificate Services on the server
https://blogger.googleusercontent.com/img/a/AVvXsEhnz5KvCkEx8Q1bnMu70IzLBh6VQY6vLdNvfkkNmkWDCalBrG5M6f0eDJhNWSbBzXKpLfbMZY69XLVBSt8DMG6WVpmNXVgkOxtjvQdkHyneFFb5ctRVOtj1i_pM9PoQFr_uan4F85LizrfvBbwQ9HXZJBNIAQTIsdNxLzsx482HD_MFEnXQTOKFH-XusQ=s16000
Step 9: Here, you can specify the Admin account you want to serve as your CA
https://blogger.googleusercontent.com/img/a/AVvXsEgXQGzs25Bf4u7_ngtqjwe4-EDapuH5CeALwOx23it8xt-YT82UBayVjzYIvNcbmDiEnFVCgMtpkH7HFNL0fAxqqRkgmeP6cAJWlx9jo_e03uSDxn-jTLPzAFIfjvN4bMmuD2OGtL5DB7meQT1OPdZc5VpWarkfjUvLMTfO0-HUS4TsKWQJ5SW-IuxEBQ=s16000
Step 10: Choose CA (redundant step but click anyway)
https://blogger.googleusercontent.com/img/a/AVvXsEjFZUTdPwb6VUNel-FYWYAVWSQJUe[...]
* *.pfx – It is the same as *.p12. *.pfx files are also PKCS#12 format binary certificates. The only difference is that *.pfx was developed by Microsoft and *.p12 by Netscape. So, for compatibility reasons you’ll see us converting *.p12 into *.pfx format.
* *.pem – Contains Base64 encoded certificate+private key pair in this context. Otherwise, a pem file can have anything depending on the developer. Installing ADCS in a local AD environmentTo configure ADCS in our test environment, we followed the following steps.
Step 1: Go to server manager and choose “add roles and features”
https://blogger.googleusercontent.com/img/a/AVvXsEjA-dYzVjhP9cXj8nWebXYNJwssCUXEi5pH_Lf_KSQHhjaJ5pSSqWoBsikkoG0duyzYGMnnJ5W1a7Bp6n2x3QIwAz9rEFOceWqSwzSmNGmUwSDIS8_MKRaXlr8SyVV1oOO4uwyqXEcvwIPhQOVYsT8DMjvwQd3zZw5qmRmSmjoATQ4URsGvBxP_KF05sA=s16000
Step 2: You could read about pre-requisites that windows recommend and click next
https://blogger.googleusercontent.com/img/a/AVvXsEgViusZHka1lGGAcHHE79rJ-MaM6smuPSccaDmwPhSnRPzx_kyGazpEQHN94hXxTB3VjtsEfthxobdvD-IbnyhMIk30ZYixVurz7PFn7vFHGQNwifVm7ZjG6OupBXHYt00XVTAT3vfqmar9vEdks0r03DThqEiUy9KVwhxTq3szAcxD1Zhcpl59SThq0A=s16000
Step 3: Choose the server from the server pool. Your environment could have multiple pools, we’ll choose DC1.ignite.local
https://blogger.googleusercontent.com/img/a/AVvXsEg8hE3apCM6G0JQv11DgHXRtMg-NEDcBmMQdS_dmC245nvaIRZJFgWaRQsz_nzKSMLekKIQrkdXsElSdg2wL-P0eci_9f2NZBLp_PO6u80B8y_6snMSNhVNvp9GWiYTmvKXgkVhzw9U3Yb8dscC9Ybzd3y9kDwssNPrk3bN_2PlNxEXg0BDtSOwmXjVLg=s16000
Step 4: Under server roles, choose Active Directory Certificate Services and click next
https://blogger.googleusercontent.com/img/a/AVvXsEjz4tQ2-k550CcP3gAAGjsEq1dqakfzZ6S3qAa3V4O8uZ-1tSvWtACc2b3DUrqWkTTaZleVo_bGgsWbMATJLtGZ-lWcADBj1SN6cSLAZrZtomFIzRRPLXPpFNsVOAWYtOT-PA0i7kCiedNCjoCpqtFDSeOGPnS8T-Vt6ORgPva6yDqpI8ywaYwzzdmx7A=s16000
Step 5: You can click next on this step or add some features. For this demo we don’t need anything extra so click next.
https://blogger.googleusercontent.com/img/a/AVvXsEjvAUgCEuvxuF6Z2nd604xyletQPhzcEuc-Csk8UhIC6bAGdP-g02iBvYbjyD0qYp5aKFxMIB9eUOBeA6bvskQCtQ6L-Odo5GnI3E20zkAPwGYUT8jxV-7wt8yk4KwKMNkimgkYAA1qJ---A_jtiLY8zHLWF9E5QXsWRpgHDIFKQCGcr1y1mR5XxkPQ_w=s16000
Step 6: Choose your role as the Certificate Authority. A CA is the primary signer of user certificates and allows them access to resources under certificate-based authentication schema.
https://blogger.googleusercontent.com/img/a/AVvXsEh-vJOxCSRmlPOB4f2WdrGInD8SZ9RViF6BgiGGysgKddtR9fsbiKevKlmzdrmvc00N-MUuaWwmRwG9XghC0JYUa0b6i2B48_SE2JzYet_RBRnX9-Q0RYxZjHviFJIKPkSU8WOhKUNYLZW_zouEJpqdCMgN3oP634vE0DZS6IxpE89WxZ-VmGZT1kuXaA=s16000
Step 7:Click install
https://blogger.googleusercontent.com/img/a/AVvXsEhda5FuIvGXHKWTL1TWZyQvA8rYhtd2OTmmGl3pK3jH481JuM1MqN9Y5j0XmHJ4AzofbZAtBMhfmXdoS7C0D03kWat6Ztj2EDQ5vTriKDw-A-g0kvHC8PkZ1Mp98KWnMOmMAL31tkI5ckmKqPWiSwUsRE2xLcqLJt_IMLNU2WN-MbRe-mtuDafdP8Vbag=s16000
Step 8: Under the flags (notification) click configure Active Directory Certificate Services on the server
https://blogger.googleusercontent.com/img/a/AVvXsEhnz5KvCkEx8Q1bnMu70IzLBh6VQY6vLdNvfkkNmkWDCalBrG5M6f0eDJhNWSbBzXKpLfbMZY69XLVBSt8DMG6WVpmNXVgkOxtjvQdkHyneFFb5ctRVOtj1i_pM9PoQFr_uan4F85LizrfvBbwQ9HXZJBNIAQTIsdNxLzsx482HD_MFEnXQTOKFH-XusQ=s16000
Step 9: Here, you can specify the Admin account you want to serve as your CA
https://blogger.googleusercontent.com/img/a/AVvXsEgXQGzs25Bf4u7_ngtqjwe4-EDapuH5CeALwOx23it8xt-YT82UBayVjzYIvNcbmDiEnFVCgMtpkH7HFNL0fAxqqRkgmeP6cAJWlx9jo_e03uSDxn-jTLPzAFIfjvN4bMmuD2OGtL5DB7meQT1OPdZc5VpWarkfjUvLMTfO0-HUS4TsKWQJ5SW-IuxEBQ=s16000
Step 10: Choose CA (redundant step but click anyway)
https://blogger.googleusercontent.com/img/a/AVvXsEjFZUTdPwb6VUNel-FYWYAVWSQJUe[...]
Hacking Articles Tips Tricks Videos Tutorials
server certificate, any intermediate certificates, and the private key into a single encryptable file. Whenever you export a certificate using msc it comes out in a p12 format. * *.pfx – It is the same as *.p12. *.pfx files are also PKCS#12 format binary certificates.…
qSy7YzmNIzSOZH8xemOqhHycXLO8ymfY1a_mL9rGpZPjRB4faz8jD0vmfHCGwHAU_woUvyQwx2k6-rbjuoFyDPXhNgg6iMTBPeIPolsIRgvK9sfs6Z_q00jkANeUTMljLST48vnlFJDzX5F8nhfWDCqu545nePYA=s16000
Step 11: Choose enterprise CA
https://blogger.googleusercontent.com/img/a/AVvXsEig8zG16NBCtNI09hv37JiOxYRarSK5_bGQDVKuFy6oiwgQKHB9YABlVk9Zyyq6Cq8qQaixqUMNjzekDAiZ4ZxTZq-xLsTzuIQDdEdcRDWOwrKNvigZtO3BN98aeG4l_7aaRrkugXGLOZjwAo4JY9KVWcaYX2r3L7LKxk81Pyat1KATvcHpXSGJKSD6Dg=s16000
Step 12: Choose Root CA as domain admin is the one that is on the top of PKI structure
https://blogger.googleusercontent.com/img/a/AVvXsEg5fZPZoUYgpyjDSo4EC-rR3s-YKPYdN69BTjzxVFzyT21ZmnWdr_fDIXDlQE4UJ3tAmBk-4058N5_EcQxir_djIufrCGxKBYjcOBAVCqSD1P3L5DKqeFTREgHVux7sWvz35EQEPLecy-_SsnsFbLulZvbVrbHvnsO0xrW2Dy8sAZYKinFwZVM92Gov3Q=s16000
Step 13: Create a new private key. As explained above, a private key is required to sign any user certificate including the root CA. This key can be used to forge a golden certificate as will be explained later.
https://blogger.googleusercontent.com/img/a/AVvXsEhUbB-fgr3qkpNxwIFjVzxiL7fjmuUfqwzM2iaxNrzhRigj3yFbRS9oqjxG1vTMlQW8emjOrQ5DDzKiHmikq2nO13zh_rdnDDMChGwi9uo28_N8wj4Bg29rDSmBzI3U8vnAZmXvRTEhTf5qtxj7Oka6OqR8g20fVwnW9lShqVxU1Zn2GHULpEuu5azSZQ=s16000
Step 14: You can modify as per your wish. We are leaving everything to the default settings.
https://blogger.googleusercontent.com/img/a/AVvXsEhjLCfMkET8rcFMzTb12TzNX2-hP40F7TY3Xlsu34JIPf8VXGqEUijqmZd5TngEbAIILHxKnKq0_EaXRKg-hgBu4RVTjvS-IxeK5lHErMuT5HWaw0xhHA_JEvAQ4WRX8xcArQtV5q_0DN3rsZHghOjf790ghSPsL1Tl48TAF7SRwkkNVCnWR_pGw5r2ZQ=s16000
Step 15: Here, you can add the common name for this CA certificate you installed
https://blogger.googleusercontent.com/img/a/AVvXsEg-zgiZj7TaKCwChdcR0EbeHiTiRKzAt59VbwBhNSykOF22mLMhb3EfOt6YfdIbyp45PQs0A9cRhw2v8EI6uXkI3JKMVLm4L7GV-xfkLmSMMIJikcusPK0zJynqN4PNDAmC-yKmE25OyrEqnNSLDMzfApdXl2uE0NH0V1JBr08CZqcdKha_-bpsjaJ_MA=s16000
Step 16: Specify the validity of the certificate. For demo purposes leaving them to the default
https://blogger.googleusercontent.com/img/a/AVvXsEjRx-uTi1lQxFPwU5nf-vMHulUTxzzcbDgu-82N3jwxVjIiJIjAJpjilLFlktG58JMi--78xqRiR0yK5YmQrZ2vqk9X9Gaf2GdWnsPgknw5cA4Syge1vVxUNOoICFR1hIxP3erJhY0XIHqoR3oQscZc1vPUe-ZVGGmTkGf5FWaQLt07MDViOLBsEV9ZSQ=s16000
Step 17: Customise the locations for the cert and click next.
https://blogger.googleusercontent.com/img/a/AVvXsEgd3mfgFSCIrVVE-Zrx5ZnWoscXTGGjcFAWTq32V1fp4uE1-yXa6t_pddeAhRA90vk-hafNqqWHLsLdrir6BBWNA0dlOCtzrB3iQH_hTflCVZkxOBPmLBpUqQlVPNLGMkgjS3G6xpCsIWFbVG5yZYoOhtbLEeM_Lx_HECp7ceiZTuu05X0BQ3cJ8Nf95A=s16000
Step 18: Click on configure
https://blogger.googleusercontent.com/img/a/AVvXsEh87CnXfdjJpq0ATlHqfZsLX3ojzOOlIWGHKGHgS_qotm6OkS6KJvUjp0tJqDKPBGVgjrsLsl6Ulr7Ms2YmfnERaYzFfL-6Gk8oDjIlFvCEy2rNz0LZ-D-_Hp0mk-maYEg1D9HRxvRXDu9x2WYjdv6c-I5WRKAxDZik-cYvo6ywHzpllzzxlYfHaZ8RNg=s16000
Step 19: As you can see, the certificate is now configured successfully
https://blogger.googleusercontent.com/img/a/AVvXsEhX-hCzhkmieiSSD6I86onZzSR6fvLlL1JV3Bdw2ePD-vSkcsWDK5UBEaujTVifof2pgmVmYr3Fo7hteR9TIyTtkgH94INKagKcpzv0izEFrgs0tgi88h8MQg2mXqZ9UEUS_DKapHAZyGwck61vdorMNTcCB0-XPR2EUw6lsBdAkjXRMWqE7vOkUIV2HA=s16000
Now that we have set up ADCS and certificate-based authentication, we are good to go.
Here, we have the following architecture for testing:
Domain Controller- DC1@ignite.local – Admin
User (Client) – harshit@ignite.local – Windows 10 client connected
Attacker Machine – Kali Linux standalone Extracting CA certificateThis article demonstrates domain persistence. Hence, we are assuming that the attacker has already compromised a user machine in the domain and escalated its privileges to the domain admin. Now, the attacker wants his connection to persist for a long period of time. That’s where the golden certificate comes into play. To forge a golden certificate, we will extract the CA certificate+private key combo first, using that file (private key), we[...]
Step 11: Choose enterprise CA
https://blogger.googleusercontent.com/img/a/AVvXsEig8zG16NBCtNI09hv37JiOxYRarSK5_bGQDVKuFy6oiwgQKHB9YABlVk9Zyyq6Cq8qQaixqUMNjzekDAiZ4ZxTZq-xLsTzuIQDdEdcRDWOwrKNvigZtO3BN98aeG4l_7aaRrkugXGLOZjwAo4JY9KVWcaYX2r3L7LKxk81Pyat1KATvcHpXSGJKSD6Dg=s16000
Step 12: Choose Root CA as domain admin is the one that is on the top of PKI structure
https://blogger.googleusercontent.com/img/a/AVvXsEg5fZPZoUYgpyjDSo4EC-rR3s-YKPYdN69BTjzxVFzyT21ZmnWdr_fDIXDlQE4UJ3tAmBk-4058N5_EcQxir_djIufrCGxKBYjcOBAVCqSD1P3L5DKqeFTREgHVux7sWvz35EQEPLecy-_SsnsFbLulZvbVrbHvnsO0xrW2Dy8sAZYKinFwZVM92Gov3Q=s16000
Step 13: Create a new private key. As explained above, a private key is required to sign any user certificate including the root CA. This key can be used to forge a golden certificate as will be explained later.
https://blogger.googleusercontent.com/img/a/AVvXsEhUbB-fgr3qkpNxwIFjVzxiL7fjmuUfqwzM2iaxNrzhRigj3yFbRS9oqjxG1vTMlQW8emjOrQ5DDzKiHmikq2nO13zh_rdnDDMChGwi9uo28_N8wj4Bg29rDSmBzI3U8vnAZmXvRTEhTf5qtxj7Oka6OqR8g20fVwnW9lShqVxU1Zn2GHULpEuu5azSZQ=s16000
Step 14: You can modify as per your wish. We are leaving everything to the default settings.
https://blogger.googleusercontent.com/img/a/AVvXsEhjLCfMkET8rcFMzTb12TzNX2-hP40F7TY3Xlsu34JIPf8VXGqEUijqmZd5TngEbAIILHxKnKq0_EaXRKg-hgBu4RVTjvS-IxeK5lHErMuT5HWaw0xhHA_JEvAQ4WRX8xcArQtV5q_0DN3rsZHghOjf790ghSPsL1Tl48TAF7SRwkkNVCnWR_pGw5r2ZQ=s16000
Step 15: Here, you can add the common name for this CA certificate you installed
https://blogger.googleusercontent.com/img/a/AVvXsEg-zgiZj7TaKCwChdcR0EbeHiTiRKzAt59VbwBhNSykOF22mLMhb3EfOt6YfdIbyp45PQs0A9cRhw2v8EI6uXkI3JKMVLm4L7GV-xfkLmSMMIJikcusPK0zJynqN4PNDAmC-yKmE25OyrEqnNSLDMzfApdXl2uE0NH0V1JBr08CZqcdKha_-bpsjaJ_MA=s16000
Step 16: Specify the validity of the certificate. For demo purposes leaving them to the default
https://blogger.googleusercontent.com/img/a/AVvXsEjRx-uTi1lQxFPwU5nf-vMHulUTxzzcbDgu-82N3jwxVjIiJIjAJpjilLFlktG58JMi--78xqRiR0yK5YmQrZ2vqk9X9Gaf2GdWnsPgknw5cA4Syge1vVxUNOoICFR1hIxP3erJhY0XIHqoR3oQscZc1vPUe-ZVGGmTkGf5FWaQLt07MDViOLBsEV9ZSQ=s16000
Step 17: Customise the locations for the cert and click next.
https://blogger.googleusercontent.com/img/a/AVvXsEgd3mfgFSCIrVVE-Zrx5ZnWoscXTGGjcFAWTq32V1fp4uE1-yXa6t_pddeAhRA90vk-hafNqqWHLsLdrir6BBWNA0dlOCtzrB3iQH_hTflCVZkxOBPmLBpUqQlVPNLGMkgjS3G6xpCsIWFbVG5yZYoOhtbLEeM_Lx_HECp7ceiZTuu05X0BQ3cJ8Nf95A=s16000
Step 18: Click on configure
https://blogger.googleusercontent.com/img/a/AVvXsEh87CnXfdjJpq0ATlHqfZsLX3ojzOOlIWGHKGHgS_qotm6OkS6KJvUjp0tJqDKPBGVgjrsLsl6Ulr7Ms2YmfnERaYzFfL-6Gk8oDjIlFvCEy2rNz0LZ-D-_Hp0mk-maYEg1D9HRxvRXDu9x2WYjdv6c-I5WRKAxDZik-cYvo6ywHzpllzzxlYfHaZ8RNg=s16000
Step 19: As you can see, the certificate is now configured successfully
https://blogger.googleusercontent.com/img/a/AVvXsEhX-hCzhkmieiSSD6I86onZzSR6fvLlL1JV3Bdw2ePD-vSkcsWDK5UBEaujTVifof2pgmVmYr3Fo7hteR9TIyTtkgH94INKagKcpzv0izEFrgs0tgi88h8MQg2mXqZ9UEUS_DKapHAZyGwck61vdorMNTcCB0-XPR2EUw6lsBdAkjXRMWqE7vOkUIV2HA=s16000
Now that we have set up ADCS and certificate-based authentication, we are good to go.
Here, we have the following architecture for testing:
Domain Controller- DC1@ignite.local – Admin
User (Client) – harshit@ignite.local – Windows 10 client connected
Attacker Machine – Kali Linux standalone Extracting CA certificateThis article demonstrates domain persistence. Hence, we are assuming that the attacker has already compromised a user machine in the domain and escalated its privileges to the domain admin. Now, the attacker wants his connection to persist for a long period of time. That’s where the golden certificate comes into play. To forge a golden certificate, we will extract the CA certificate+private key combo first, using that file (private key), we[...]
Hacking Articles Tips Tricks Videos Tutorials
qSy7YzmNIzSOZH8xemOqhHycXLO8ymfY1a_mL9rGpZPjRB4faz8jD0vmfHCGwHAU_woUvyQwx2k6-rbjuoFyDPXhNgg6iMTBPeIPolsIRgvK9sfs6Z_q00jkANeUTMljLST48vnlFJDzX5F8nhfWDCqu545nePYA=s16000 Step 11: Choose enterprise CA https://blogger.googleusercontent.com/img/a/AVvXsEig8z…
will forge a new certificate for a particular user (here, DC) and then use that certificate to ask for tickets, dump hashes etc.
First step is to extract the CA. We can use certsrv.msc run command on the compromised domain admin system.
https://blogger.googleusercontent.com/img/a/AVvXsEgXLdNBBFjv-8TTc6NgOgeEOHJsiSE0sQZTt5KKjPUCsPh1WH6IPlYM_35cU6jF52pVzPiNv0M8zDIlSN262YIoU0oMe2_jFQOxf6IJR5uibvtXzwruk2LbWzEWvpAySn3-Vi_In7nRzC6_R76Dw0rHNEKMGk2GxLz7NCAETMFLpBA6VwBgUrH7RLFb-w=s16000
It will open up a window listing all the CAs in server pool. We choose back up CA
https://blogger.googleusercontent.com/img/a/AVvXsEj9nJaiAkLVGXZGr3U5_bZWeO5Yv7fLyM8xEBJd2RJLlseqk_vs8D08SUyOc-A6DKabBfYkLhcZ-Q5ts9-_BAzYK6Lmr7bhiaSJ76b7RWAnHN9HA9oE0znKw4Gu_m7eaFkrgAjKeMKwYT8VrDdNQQb9muOcibB5F7JZ3kFWezKGQcyIqamRKueM9jRKhw=s16000
Press next
https://blogger.googleusercontent.com/img/a/AVvXsEg3cQxgbdvzgPescT-6ELULy9iI2d2oNwpOmoGlyWjbkLHTKrNDqJULPRFdw_nqs_vJoD6jeZ5DgggxeLD6dZmGUBLWJv2PiFtSeKE5Hit2U1zf_XEjUW_TITzJSqpDoewZQ45rZQToaNtrrqOCdBAWQ12lPesFIaZunULXcluD_VixtMjTkltKUIwoxw=s16000
Here, click on Private Key and CA certificate and give the location of the directory where you want to back this certificate up. Our location is C:\cert
https://blogger.googleusercontent.com/img/a/AVvXsEjQBUJiAqwutC0joNtUfPCDTic-KDyLov3TB3OEm28PJTLGIEXSHf0PUHkmt4SdkdF-v3RUDvaGzsSPoFlmyn6ERHhTRgHgzK3HamCtsenHz9AhxkIaNfKorYcwezznyhmZ34TAMWWuNlMQgEo82hB_GMUNK_6oE8RFobFHUfiqUgTsm4iV_qLw-WMKYg=s16000
You can input the password to protect this backup file. This is optional but we can keep a simple password like 12345
https://blogger.googleusercontent.com/img/a/AVvXsEj9JguUj1wGyDxv5eSVuD0p7JCE27-AKUvKbCwzSRtXAJShG9vAOpZw1VmXgaaKQROKoq25CDSe1lvnxWaCUlGvZ35geVvQVSRTjkIG7rJFDsIYheMQgH9nXc3kim5xjSTX5VmA73ngTMrHYarKusATkOfGfHKQRMIweLkUMwZkcWybOf3jA87KBURckQ=s16000
Now, the certificate has been extracted successfully. There are other methods to extract the CA certificate too. You can do this using mimikatz as well. Forging a new CA certificateAs you would observe the extracted certificate has a p12 format. This is equivalent to pfx format and theoretically a simple extension change should have converted p12 into pfx but due to some errors, we used openssl to properly convert p12 into pfx using a 2-step process.
First, you need to download Openssl from here. Once installed you can go to the C:\cert (folder where the certificate was backed up) and run the following command to convert this p12 certificate into a pem file.
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in ignite-DC1-CA.p12 -out newfile.pem
Here, you need to enter the import password 12345. You can set a new password for this pem file. We kept it as 12345 only for simplicity. As you can see “newfile.pem” has been created.
https://blogger.googleusercontent.com/img/a/AVvXsEi0j0-m4qhz0F6FZLgnow5Hg-JJgNX7nPd3J-UXEggYpCKei73GwtP_0f_-zoPruvzIkihTngGZ5Jy7R4J87_aHTiF5uKyEqWg4HFU2vK6eYETEqT2fQZ6X09X8YP55NNi8IccycdxFcNbnEoPp9-RZMIAvgXptOUlnOncAo2iFZOxC-yR0M9Q4fSC3Ug=s16000
Now, you need to run another openssl command to convert this pem into pfx.
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in newfile.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
Note, we have added two additional parameters here.
-keyex: Specifies that the private key is to be used for key exchange or just signing.
-CSP: Stands for a cryptographic service provider. This command specifies that the output file is in a standard format for Microsoft CSP. You can read more about it here.
You can see that cer.pfx has been exported to this directory now.
https://blogger.googleusercontent.com/img/a/AVvXsEjE8DN1v06jnc16BQCNNW38Kssz-7hkJuk-1JfRbyTAK04nHd292lVtgHactdrXVG_oHux7OIcYLdOyQq_RJ7wZbuVoPxxNcADK1etoCXr_RneUjWr0FMQHBrJHLZS3oMJ-ecB3QPmKpRaPLDyMEGuZ99MrWdx5v6xryy2fCuenJJSkRDYBm4VChhtjMg=s16000
Using the private key available in t[...]
First step is to extract the CA. We can use certsrv.msc run command on the compromised domain admin system.
https://blogger.googleusercontent.com/img/a/AVvXsEgXLdNBBFjv-8TTc6NgOgeEOHJsiSE0sQZTt5KKjPUCsPh1WH6IPlYM_35cU6jF52pVzPiNv0M8zDIlSN262YIoU0oMe2_jFQOxf6IJR5uibvtXzwruk2LbWzEWvpAySn3-Vi_In7nRzC6_R76Dw0rHNEKMGk2GxLz7NCAETMFLpBA6VwBgUrH7RLFb-w=s16000
It will open up a window listing all the CAs in server pool. We choose back up CA
https://blogger.googleusercontent.com/img/a/AVvXsEj9nJaiAkLVGXZGr3U5_bZWeO5Yv7fLyM8xEBJd2RJLlseqk_vs8D08SUyOc-A6DKabBfYkLhcZ-Q5ts9-_BAzYK6Lmr7bhiaSJ76b7RWAnHN9HA9oE0znKw4Gu_m7eaFkrgAjKeMKwYT8VrDdNQQb9muOcibB5F7JZ3kFWezKGQcyIqamRKueM9jRKhw=s16000
Press next
https://blogger.googleusercontent.com/img/a/AVvXsEg3cQxgbdvzgPescT-6ELULy9iI2d2oNwpOmoGlyWjbkLHTKrNDqJULPRFdw_nqs_vJoD6jeZ5DgggxeLD6dZmGUBLWJv2PiFtSeKE5Hit2U1zf_XEjUW_TITzJSqpDoewZQ45rZQToaNtrrqOCdBAWQ12lPesFIaZunULXcluD_VixtMjTkltKUIwoxw=s16000
Here, click on Private Key and CA certificate and give the location of the directory where you want to back this certificate up. Our location is C:\cert
https://blogger.googleusercontent.com/img/a/AVvXsEjQBUJiAqwutC0joNtUfPCDTic-KDyLov3TB3OEm28PJTLGIEXSHf0PUHkmt4SdkdF-v3RUDvaGzsSPoFlmyn6ERHhTRgHgzK3HamCtsenHz9AhxkIaNfKorYcwezznyhmZ34TAMWWuNlMQgEo82hB_GMUNK_6oE8RFobFHUfiqUgTsm4iV_qLw-WMKYg=s16000
You can input the password to protect this backup file. This is optional but we can keep a simple password like 12345
https://blogger.googleusercontent.com/img/a/AVvXsEj9JguUj1wGyDxv5eSVuD0p7JCE27-AKUvKbCwzSRtXAJShG9vAOpZw1VmXgaaKQROKoq25CDSe1lvnxWaCUlGvZ35geVvQVSRTjkIG7rJFDsIYheMQgH9nXc3kim5xjSTX5VmA73ngTMrHYarKusATkOfGfHKQRMIweLkUMwZkcWybOf3jA87KBURckQ=s16000
Now, the certificate has been extracted successfully. There are other methods to extract the CA certificate too. You can do this using mimikatz as well. Forging a new CA certificateAs you would observe the extracted certificate has a p12 format. This is equivalent to pfx format and theoretically a simple extension change should have converted p12 into pfx but due to some errors, we used openssl to properly convert p12 into pfx using a 2-step process.
First, you need to download Openssl from here. Once installed you can go to the C:\cert (folder where the certificate was backed up) and run the following command to convert this p12 certificate into a pem file.
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in ignite-DC1-CA.p12 -out newfile.pem
Here, you need to enter the import password 12345. You can set a new password for this pem file. We kept it as 12345 only for simplicity. As you can see “newfile.pem” has been created.
https://blogger.googleusercontent.com/img/a/AVvXsEi0j0-m4qhz0F6FZLgnow5Hg-JJgNX7nPd3J-UXEggYpCKei73GwtP_0f_-zoPruvzIkihTngGZ5Jy7R4J87_aHTiF5uKyEqWg4HFU2vK6eYETEqT2fQZ6X09X8YP55NNi8IccycdxFcNbnEoPp9-RZMIAvgXptOUlnOncAo2iFZOxC-yR0M9Q4fSC3Ug=s16000
Now, you need to run another openssl command to convert this pem into pfx.
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in newfile.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
Note, we have added two additional parameters here.
-keyex: Specifies that the private key is to be used for key exchange or just signing.
-CSP: Stands for a cryptographic service provider. This command specifies that the output file is in a standard format for Microsoft CSP. You can read more about it here.
You can see that cer.pfx has been exported to this directory now.
https://blogger.googleusercontent.com/img/a/AVvXsEjE8DN1v06jnc16BQCNNW38Kssz-7hkJuk-1JfRbyTAK04nHd292lVtgHactdrXVG_oHux7OIcYLdOyQq_RJ7wZbuVoPxxNcADK1etoCXr_RneUjWr0FMQHBrJHLZS3oMJ-ecB3QPmKpRaPLDyMEGuZ99MrWdx5v6xryy2fCuenJJSkRDYBm4VChhtjMg=s16000
Using the private key available in t[...]
Hacking Articles Tips Tricks Videos Tutorials
will forge a new certificate for a particular user (here, DC) and then use that certificate to ask for tickets, dump hashes etc. First step is to extract the CA. We can use certsrv.msc run command on the compromised domain admin system. https://blogger.…
his cert.pfx (combo of CA and private key) we will forge a certificate. The tool that we will be using is ForgeCert. This program can be compiled in Visual Studio 2022 just by importing the *.sln file and building the exe. Note that along with the exe, we would need BouncyCastle.dll and some config files. These files will be output in Project folder/bin/debug. Copy these files as it is in the C:\cert folder.
Now, we will forge our new certificate with the following command:
ForgeCert.exe --CaCertPath cert.pfx --CaCertPassword 12345 --Subject CN=User --SubjectAltName DC1@ignite.local --NewCertPath admincert.pfx --NewCertPassword ignite@123
You can keep a complex password here but we are keeping a simple ignite@123
Now, the golden certificate with a validity of 1 year has been saved! This means I have had access to the domain for at least a year now!
https://blogger.googleusercontent.com/img/a/AVvXsEiKQwZ0jo3_ZGdeD4cONugDpYfEjRMWk2Bf6jRwRbKQspMN0taoXtd0Yoh1vgi571lJiNmanPbYVSFBh9alRqaL5BKox2LgyhVP8A8Aep758oKzlg-1fOBN4mR3tVEHm-LHLA9TZqPsDmE41hZql9z2v0XF-RhDyGBAX0zqQwQe6YfLOUjKX4BS4_gdgQ=s16000 Obtaining domain admin’s TGTNow that I have forged my golden certificate, I can perform a number of attacks. We are simulating a scenario where the admin password has changed now. Attacker no longer can access domain admin yet still has a user system with him (windows 10 client here). Also, the attacker still has a golden certificate with him! He can use Rubeus to ask for admin’s TGT like so:
Rubeus.exe asktgt /user:DC1 /certificate:admincert.pfx /password:ignite@123
It gives a *.kirbi ticket which is a base64 encoded format of a TGT.
https://blogger.googleusercontent.com/img/a/AVvXsEhpGMQlU745xFsdlrPANs61xRgi7FPzK73CGKqJv4NIbJMknMjxnHVy2KL3nM__kum4-Gbee8YWQbsfF8z_35HSyvCN4XLIgWujY6U9g61LSxa6JH9zwbDfWG1yTXen37QfOZne13zsPa_AyKoSkFoS1iwQkZ_JuXm6iFPT0LdvPkbrLoRxVlmgzaQkwg=s16000
So, we can convert this TGT into a base64 decoded format using the kali command:
echo "<ticket" | base64 --decode > ticket.kirb
https://blogger.googleusercontent.com/img/a/AVvXsEjKwI3tdnIKbXsrrCzDWk4UYYFFfasMyF-gpSIKKUjXUWW5_ZjUKGK7sIKDG9OFedZtXihJJ1-m_TrsKL6aLsGd1BZX-HdGkuxHQbgVp_BTjNLnK35UM8F7EViMuppBwI1vb3f8q3ba3AahsuYslkhfcKFUO2zAHFDiY-bsAGfhyU5egpStXLeGjtOAPw=s16000 Extracting admin NTLM hashWith this ticket.kirbi, we can do pass the ticket attacks, extract NTLM hashes among other things. Since we don’t know the admin’s new password now, let us try to extract his credentials.
For that we will run mimikatz on the user (windows 10 compromised non-admin system on the AD), import the ticket.kirbi using Kerberos::ptt module and then perform a DCSync attack. Since the ticket is the domain admin’s ticket, we can perform functions that require elevated privileges.
kerberos::ptt ticket.kirbi
lsadump::dcsync /domain:ignite.local /user:administrator
This gives us a fresh set of admin’s NTLM hash
https://blogger.googleusercontent.com/img/a/AVvXsEjVfxxGlYn0_Z3LrOcWyI33tfm1AGEeiUxI0ZuUCi8GOHw-wO3HHxKA3-bin5WG1ZY5nxUuCUTgnGdH7rGG8bXlS8aBOOnw2O55fsUYc3kH1bJ7NQesLJF9XYS1Dli-E0tsiHNQEKLK9CH5GYgMUOMm64G-i6_DtV559CIVZxla3exxaHcpkhMP3Gn86A=s16000 Performing PtH (Pass the Hash) attackWe can further perform Pass the hash attack using these credentials, or crack them using john/hashcat. We head over to our Kali terminal and use pth-winexe binary, which is a part of the pass the hash toolkit by byt3bl33d3r. This comes built-in in new kali os.
pth-winexe -U Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.188 cmd.exe
As you can see we have added 32 bits of 0s before the hash we dumped. As from the release of Windows 10, Microsoft made a change that LM hashes are not used anymore. But the tools that we are going to use in the practical are being used since the old NT and LM times. So, in those tools, we will be using a string of 32 zeros instead of the LM hash.
Also, to be no[...]
Now, we will forge our new certificate with the following command:
ForgeCert.exe --CaCertPath cert.pfx --CaCertPassword 12345 --Subject CN=User --SubjectAltName DC1@ignite.local --NewCertPath admincert.pfx --NewCertPassword ignite@123
You can keep a complex password here but we are keeping a simple ignite@123
Now, the golden certificate with a validity of 1 year has been saved! This means I have had access to the domain for at least a year now!
https://blogger.googleusercontent.com/img/a/AVvXsEiKQwZ0jo3_ZGdeD4cONugDpYfEjRMWk2Bf6jRwRbKQspMN0taoXtd0Yoh1vgi571lJiNmanPbYVSFBh9alRqaL5BKox2LgyhVP8A8Aep758oKzlg-1fOBN4mR3tVEHm-LHLA9TZqPsDmE41hZql9z2v0XF-RhDyGBAX0zqQwQe6YfLOUjKX4BS4_gdgQ=s16000 Obtaining domain admin’s TGTNow that I have forged my golden certificate, I can perform a number of attacks. We are simulating a scenario where the admin password has changed now. Attacker no longer can access domain admin yet still has a user system with him (windows 10 client here). Also, the attacker still has a golden certificate with him! He can use Rubeus to ask for admin’s TGT like so:
Rubeus.exe asktgt /user:DC1 /certificate:admincert.pfx /password:ignite@123
It gives a *.kirbi ticket which is a base64 encoded format of a TGT.
https://blogger.googleusercontent.com/img/a/AVvXsEhpGMQlU745xFsdlrPANs61xRgi7FPzK73CGKqJv4NIbJMknMjxnHVy2KL3nM__kum4-Gbee8YWQbsfF8z_35HSyvCN4XLIgWujY6U9g61LSxa6JH9zwbDfWG1yTXen37QfOZne13zsPa_AyKoSkFoS1iwQkZ_JuXm6iFPT0LdvPkbrLoRxVlmgzaQkwg=s16000
So, we can convert this TGT into a base64 decoded format using the kali command:
echo "<ticket" | base64 --decode > ticket.kirb
https://blogger.googleusercontent.com/img/a/AVvXsEjKwI3tdnIKbXsrrCzDWk4UYYFFfasMyF-gpSIKKUjXUWW5_ZjUKGK7sIKDG9OFedZtXihJJ1-m_TrsKL6aLsGd1BZX-HdGkuxHQbgVp_BTjNLnK35UM8F7EViMuppBwI1vb3f8q3ba3AahsuYslkhfcKFUO2zAHFDiY-bsAGfhyU5egpStXLeGjtOAPw=s16000 Extracting admin NTLM hashWith this ticket.kirbi, we can do pass the ticket attacks, extract NTLM hashes among other things. Since we don’t know the admin’s new password now, let us try to extract his credentials.
For that we will run mimikatz on the user (windows 10 compromised non-admin system on the AD), import the ticket.kirbi using Kerberos::ptt module and then perform a DCSync attack. Since the ticket is the domain admin’s ticket, we can perform functions that require elevated privileges.
kerberos::ptt ticket.kirbi
lsadump::dcsync /domain:ignite.local /user:administrator
This gives us a fresh set of admin’s NTLM hash
https://blogger.googleusercontent.com/img/a/AVvXsEjVfxxGlYn0_Z3LrOcWyI33tfm1AGEeiUxI0ZuUCi8GOHw-wO3HHxKA3-bin5WG1ZY5nxUuCUTgnGdH7rGG8bXlS8aBOOnw2O55fsUYc3kH1bJ7NQesLJF9XYS1Dli-E0tsiHNQEKLK9CH5GYgMUOMm64G-i6_DtV559CIVZxla3exxaHcpkhMP3Gn86A=s16000 Performing PtH (Pass the Hash) attackWe can further perform Pass the hash attack using these credentials, or crack them using john/hashcat. We head over to our Kali terminal and use pth-winexe binary, which is a part of the pass the hash toolkit by byt3bl33d3r. This comes built-in in new kali os.
pth-winexe -U Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.188 cmd.exe
As you can see we have added 32 bits of 0s before the hash we dumped. As from the release of Windows 10, Microsoft made a change that LM hashes are not used anymore. But the tools that we are going to use in the practical are being used since the old NT and LM times. So, in those tools, we will be using a string of 32 zeros instead of the LM hash.
Also, to be no[...]