Support Issuing Certificates With NTDS_CA_SECURITY_EXT #18078
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
zeroSteiner
commented
Jun 8, 2023
Comment on lines
+338
to
+340
| Luckily we can also do this with the `icpr_cert` module. We just need to also set the `ALT_SID` and `ALT_UPN` options to | ||
| specify who we would like to authenticate as instead. Note that this only works with certificate templates that are | ||
| vulnerable to ESC1 due to having the `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag set. |
There was a problem hiding this comment.
Technically setting ALT_SID isn't always required. It's required today on fully patched servers with the registry key set to require the strong mapping and will be required by default in the future. To avoid providing an abundance of details, this simply mentions that it should be set. If the SID isn't required because the server isn't patched, then including it is harmless.
smcintyre-r7
added
module
library
enhancement
rn-enhancement
zeroSteiner
force-pushed
the
feat/mod/dcerpc-icpr4
branch
from
346bc31
to
238118e
Compare
|
Neat! Thank you sir. |
adfoster-r7
reviewed
Jun 9, 2023
space-r7
reviewed
Jun 14, 2023
zeroSteiner
force-pushed
the
feat/mod/dcerpc-icpr4
branch
from
66d2477
to
1823801
Compare
space-r7
approved these changes
Jun 14, 2023
|
Looks good to me! Testing with ALT_SID setTesting without ALT_SID |
space-r7
added a commit
that referenced
this pull request
Jun 15, 2023
Release NotesThis adds support to the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds support to the
icpr_certmodule to issue certificates for an explicit SID by specifying it within the NTDS_CA_SECURITY_EXT. Prior to this PR, if the server added this extension, it would be parsed using#get_cert_ext_propertybut it couldn't be included in the request. Including it in the request is required now when targeting servers with the KB5014754 patch applied and theStrongCertificateBindingEnforcementREG_DWORD value set to 2. Including it in the request will be required by default in November of this year when Microsoft changes the default value of this from 1 to 2. The default value is used when the item is not present in the registry.Making these changes now ensures that Metasploit is ready for this change and that users will continue to be able to exploit ESC1 just with the extra step of needing to find and set the SID. Users can get the SID using the ldap_query module. Metasploit also currently supports exploit ESC2, ESC3 and ESC4. When I tested my fully patched Server 2019 instance, certificates that were requested using
ON_BEHALF_OFandPFXwould include the SID in their response. ESC4 makes a certificate template vulnerable to ESC1 which will also continue to work. This means our currently supported attacks of ESC1-4 will continue to work by default after November.For additional context on these changes, see the following references which I found helpful:
PKINIT Changes
The AS-REQ request used as part of PKINIT functionality had to be updated in order to work with the new certificate. The underlying issue was in the data that was being signed which caused the signature validation to fail and an integrity error to be raised.
Verification
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\Kdc /v StrongCertificateBindingEnforcement /t REG_DWORD /d 2ALT_SIDdatastore option to the SID of the target accountauxiliary/admin/kerberos/get_ticketmoduleKDC_ERR_CERTIFICATE_MISMATCHauxiliary/admin/kerberos/get_ticketmoduleDemo