Issue deploying win2019 adcs

[leJoPra]

Hello,

I am having some trouble deploying the lab, especially the ADCS. It gets stuck at "configure AD CS certification authority via Install-ADCSCertificationAuthority". If i try to cancel, delete win2019-adcs, and restart vagrant up for the machine, it gets stuck usually at the last ansible task which is adding default certificate.
Any clue why this is happening?
Thanks

[Marshall-Hallenbeck]

@leJoPra So I had this same issue and I thought I fixed it. There's something weird happening during the ADCS deployment process where the Windows host isn't done setting up something related to the service.

Out of curiosity how many times have you tried to vagrant up win2019-adcs? I found that sometimes it works and sometimes it doesn't, so I had to vagrant destroy win2019-adcs and re-run it.

If you want to run the entire environment minus that host, just run a custom vagrant up dc01 win2019-1 win10-1 etc.

I'll create an issue based on this and try to re-fix it (I thought I had it working).

[Marshall-Hallenbeck]

So I made sure that I could exploit it before, but it seems like I changed something and it messed it up.

Can you explain "when I look in ADCS manager I get certificate failed"? Can you post a screenshot of that?

Worst case right now, after running vagrant/ansible, even if it fails, go into the Server Manager via the UI and finish the ADCS installation manually (or make sure that everything is installed), then restart the computer. I know for sure this method works.

[leJoPra]

So here is what I get on ntlmrelayx :

And on the certification authority manager, in failed requests :

I have tried to add some more modules (Certificate Enrollment Policy Web Service) with the Server Manager UI but I get the same errors.

Error message on ADCS :
Active Directory Certificate Services denied request 3 because The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE). The request was for CN=DC01$. Additional information: Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: Machine.

[Marshall-Hallenbeck]

Sorry for the delay here, did you use https://github.com/ExAndroidDev/impacket.git & the ntlmrelayx-adcs-attack branch?

Can you post the actual ntlmrelax command you used? From the looks of it, this is requesting a Machine ticket, but you need to request a Kerberos ticket like this:
sudo python3 examples/ntlmrelayx.py -debug -smb2support --target http://10.0.1.14/certsrv/certfnsh.asp --adcs --template KerberosAuthentication

[leJoPra]

Right! That was my mistake, forgot the --template KerberosAuthentication argument. Thanks for the troubleshooting and well done for the lab!

[Marshall-Hallenbeck]

You're welcome, I'm glad you're finding it helpful!

[avi8892]

@Marshall-Hallenbeck @leJoPra It is impossible to install the ADCS server. it is always failed, event thought I have tried about 20 times.

[leJoPra]

Can you send the error message or the step where it fails ?