RemoteKrbRelay

root@kitploit: //, ,//\ \ / \ \ XXX XXX / //, \o-o/-o-o/ / / \ XXX | / \ / ,-/ / \ / /,| | \ | / \ / ,-,,,/ ,,, CICADA8 Research Team From Michael Zhmaylo MzHmO RemoteKrbRelay Probablemente conozcas KrbRelay y KrbRelayUp, pero ¿y si te dijera que se puede hacer de forma remota? Con...

modifyCertTemplate

用途 此工具旨在帮助操作员修改ADCS证书模板，从而利用创建的易受攻击状态进行权限提升（并在之后将模板重置为之前的状态）。该工具专门针对以下场景设计：攻击者已获得对模板的WriteProperty权限，但不确定该权限适用于哪些属性。在此场景下，可以查询模板的ACL，并将适用的ACE信息与属性GUID进行交叉引用，以确定可修改的属性。 关于该工具及主题的关联博客文章。 用法 root@kitploit: usage: modifyCertTemplate.py -h -template template name -property property name -value new val...

relay_bible

中继圣经 — 内部渗透测试中继指南 一份全面的NTLM中继攻击参考，适用于授权内部渗透测试。涵盖身份认证基础、强制认证技术、各协议的中继目标、工具使用、高级链式攻击及防御缓解措施。 先决条件 Linux攻击主机（Kali、Parrot或类似系统） 已安装Python 3.10+及Impacket 能够访问目标环境网络（授权渗透测试） 基本了解Active Directory和Windows网络 目录 1. 基础原理 NTLM认证与中继理论 — NTLM工作原理、为何能中继、NTLMv1与v2对比、签名、EPA Kerberos认证与中继理论 —...

certificate-of-compromise

Certificate of Compromise SoK/Whitepaper on Offensive Operations against Active Directory Certificate Service v1.0.0 Living Document & Community Contributions This paper is a living document. ADCS research is not static — techniques get patched, new conditions are discovered, and community analys...

ADCSDevilCOM

ADCSDevilCOM Una herramienta en C para solicitar certificados de ADCS utilizando DCOM sobre SMB. Esta herramienta permite solicitar remotamente certificados X.509 desde un servidor de CA usando el protocolo MS-WCCE sobre DCOM y evade el requisito tradicional del endpoint mapper al usar SMB...

Masky

Masky Masky 是一个 Python 库，提供了一种通过 ADCS 远程导出域用户凭证的替代方法。在此库基础上构建了一个命令行工具，以便在大范围环境中轻松收集 PFX、NT 哈希和 TGT。 该工具并未利用任何新漏洞，也并非通过转储 LSASS 进程内存来工作。实际上，它仅利用了合法的 Windows 和 Active Directory 功能（令牌模拟、通过 Kerberos 的证书认证以及通过 PKINIT 获取 NT 哈希）。已发布一篇博客文章详细介绍了所实现的技术以及 Masky 的工作原理。 Masky 的源代码在很大程度上基于优秀的 Certify 和 Certipy...

ADCSKiller

ADCSKiller - Una herramienta de automatización de explotación de ADCS ADCSKiller es una herramienta basada en Python diseñada para automatizar el proceso de descubrir y explotar vulnerabilidades de Servicios de Certificados de Active Directory ADCS. Aprovecha las funciones de Certipy y Coercer pa...

CVE-2024-38200

CVE-2024-38200 After The Patch Capturing the NTLMv2 hash over HTTP method was not fixed. The NTLMv2 hash value can still be obtained over HTTP and relayed to LDAP or ADCS. MSRC stated this situation as "as presented this looks to be part of the current design." Even if this vulnerability is fixed...

ludus-defender-lab

Ludus Defender Lab Configuración de rango Ludus y roles de Ansible para un laboratorio de seguridad de Windows preconfigurado para MDE y MDI, con una instalación de ADCS completamente mal configurada para probar la cobertura de detección. Config| VMs| Propósito ---|---|--- zsec-mde-mdi-lab.yml|...

Certiception

Certiception Certiception es un honeypot para Active Directory Certificate Services ADCS , diseñado para atrapar a los atacantes con un señuelo realista y atractivo que genera alertas de gran relevancia. Desarrollado por el Red Team de SRLabs, Certiception crea una plantilla de certificado de...

ADCSKiller - An ADCS Exploitation Automation Tool Weaponizing Certipy And Coercer

ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services ADCS vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure. Please note that the ADCSKiller is...

Active Directory Certificate Services (ADCS) privilege escalation (Certifried)

This module exploits a privilege escalation vulnerability in Active Directory Certificate Services ADCS to generate a valid certificate impersonating the Domain Controller DC computer account. This certificate is then used to authenticate to the target as the DC account using PKINIT...

Microsoft Patch Tuesday October 2022: Exchange ProxyNotShell RCE, Windows COM+ EoP, AD EoP, Azure Arc Kubernetes EoP

Hello everyone! This episode will be about Microsoft Patch Tuesday for October 2022, including vulnerabilities that were added between September and October Patch Tuesdays. As usual, I use my open source Vulristics project to create the report. Alternative video link for Russia: $ cat...

Masky - Python Library With CLI Allowing To Remotely Dump Domain User Credentials Via An ADCS Without Dumping The LSASS Process Memory

Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability and...

modifyCertTemplate - ADCS Cert Template Modification And ACL Enumeration

This tool is designed to aid an operator in modifying ADCS certificate templates so that a created vulnerable state can be leveraged for privilege escalation and then reset the template to its previous state afterwards. This is specifically designed for a scenario where WriteProperty rights over ...

[ADM Cloud] License information is missing on ADM Cloud Service and all managed ADCs enter graceful period

Licenses are missing like below on ADM Cloud Service: And managed ADCs enter graceful period due to no license activation...

adcs-neat.iadcs.ucsd.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-998560 Security Researcher devl00p Helped patch 3018 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting adcs-neat.iadcs.ucsd.edu...