Privilege Escalation

Summary ESC8 is an AD CS vulnerability where the Certificate Enrollment Web Service is enabled over HTTP (without HTTPS). This allows intercepting a Domain Controller’s authentication and relaying it to the CA to request a certificate. With that certificate we can impersonate the DC, perform DCSync, and take full control of the domain. Requirements Valid domain user credentials (Rosie.Powell:Cicada123) The CA has Web Enrollment over HTTP enabled NTLM disabled in the domain (authentication must use Kerberos) Machine Account Quota > 0 (allows adding DNS records, default is 10) Step-by-step Walkthrough 1. Initial Setup Ensure correct DNS resolution in /etc/hosts: ...

Introduction ESC11 is a vulnerability in Active Directory Certificate Services (ADCS) that occurs when the RPC interface of the Certificate Authority (CA) — specifically the ICertPassage (MS-ICPR) interface — does not enforce signing or encryption for certificate enrollment requests. This happens because the IF_ENFORCEENCRYPTICERTREQUEST flag is disabled on the CA. Since no packet signing or encryption is required on this RPC interface, it becomes vulnerable to NTLM Relay attacks. If an attacker manages to coerce the NTLM authentication of a privileged account (such as the machine account of a Domain Controller or a Domain Admin), they can relay that authentication to the CA’s RPC port and request a valid certificate on behalf of the victim. ...

Introduction ESC8 is a vulnerability in Active Directory Certificate Services (ADCS) that occurs when the Web Enrollment service is enabled over HTTP without encryption, or over HTTPS without Channel Binding (EPA) enabled. The vulnerable endpoint is: http://<CA>/certsrv/certfnsh.asp This endpoint accepts NTLM authentication without signing or channel binding, making it susceptible to NTLM Relay attacks. In essence, an attacker can intercept the NTLM authentication of a privileged account (such as the Domain Controller’s machine account) and relay it to the ADCS service to obtain a valid certificate on behalf of that account. ...

INTRODUCTION Domain Trust relationships in Active Directory are fundamental to allowing users from one domain to access resources in other domains. However, from a Red Teaming perspective, these relationships represent an excellent vector for privilege escalation and lateral movement. In this post, we will explore how to abuse a Child-to-Parent trust relationship within the same forest to escalate privileges from a fully compromised subdomain to the root domain. KEY CONCEPTS What is a Domain Trust? It is a trust mechanism between two domains that enables cross-domain authentication. Its key properties are: ...