Add module for issuing certificates #16939
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
16 tasks
Comment on lines
213
to
219
| ext_asn = OpenSSL::ASN1.decode(OpenSSL::ASN1.decode(ext.to_der).value[1].value) | ||
| ext_asn.value.each do |value| | ||
| value = value.value | ||
| next unless value.is_a?(Array) | ||
| next unless value[0]&.value == OID_NTDS_OBJECTSID | ||
|
|
||
| return value[1].value[0].value |
There was a problem hiding this comment.
Many of these value's are called without the safe navigation operator (&.). Are we sure no NoMethodError will be raised in some corner cases?
|
Thanks @zeroSteiner ! It looks good to me. I tested against a Windows Server 2019 and verified the certificates are correctly issued. I also checked I could authenticate to the DC. |
cdelafuente-r7
approved these changes
Aug 26, 2022
cdelafuente-r7
added
module
docs
blocked
|
Not a blocker for this PR to land - but could we test this from a machine running OpenSSL 3? i.e. Ubuntu 22.04, or Kali with Ruby 3.04: Some of Ruby's OpenSSL library calls have broken with OpenSSL 3 - and it'd probably best to verify it works for newer versions of openssl whilst it's fresh in the PR queue 😄 |
|
Looks like it's working correctly. Ruby 3.1.2 with OpenSSL 3.0.5 installed via RVM on Fedora. |
New features include the necessary MS-ICPR definition and more authentication support for DCERPC over named pipes.
zeroSteiner
force-pushed
the
feat/mod/dcerpc-icpr
branch
from
1fdefaa
to
ba527f8
Compare
|
Thanks @zeroSteiner ! Everything looks good to me now. I'll go ahead and land it. |
cdelafuente-r7
added
rn-modules
Release NotesThis adds a module for issuing certificates via Active Directory Certificate Services, which is useful in a few contexts including persistence and for some specific exploits. The resulting PFX certificate file is stored to the loot and is encrypted using a blank password. |
23 tasks
9 tasks
This was referenced Dec 14, 2022
3 tasks
5 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds a module for issuing certificates via Active Directory Certificate Services. Issuing certificates is useful in a few contexts including persistence, ESC1 and as a primitive necessary for exploiting CVE-2022-26923 (coming soon). The resulting PFX certificate file is stored to loot and is encrypted using a blank password. It doesn't look like Ruby supports writing PFX files without encryption, and specifying a password would break compatibility with other tools.
Requires rapid7/ruby_smb#236 to be landed first for the necessary DCERPC definitions and functionality.
This is not blocked by #16938, but the documentation does refer to the queries that are added in there as part of the workflow, so it is related. Without that functionality, the user will just need to know the
CAandCERT_TEMPLATEnames. Either you'd know them because you set them up in Active Directory, or you'd have obtained them through another tool like Certipy'sfindcommand.Verification
CAdatastore option)certtmpl.mscESC1-Testcertsrv.mscCA,RHOSTS,SMBUser, andSMBPassoptions correctlycertificate template (set CERT_TEMPLATE User`)ALT_UPNto a domain administrator, likesmcintyre@msflab.localwheresmcintyreis the domain admin andmsflab.localis the DNS domain nameCERT_TEMPLATEoption toESC1-Testand run the modulePFX Certificate Validation
Regardless of how the certificate is obtained, the easiest way to validate that it is correct is to use Certipy's
authsub command. The certificate stored in loot by Metasploit should be able to be used to authenticate to the domain controller.Example showing that a certificate is working, and the hash for user MSFLAB\smcintyre is recovered.
Metasploit can't perform this step natively yet because there's no support for the PKINIT extension when authenticating with Kerberos.