Add parse sub command to perform stealthy offline AD CS enumeration based on local registry data #247
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is in preparation for usecases such as offline registry parsing where the CA certificate might not be available.
This is based on The Registry Rundown research by Outflank's Cedric Van Bockhaven and Max Grim as presented at Troopers 24. Given the output of TrustedSec's reg_query BOF of the certificate template cache as found in the registry, parse template properties and analyze them for possible vulnerabilities. reg_query_recursive HKU .DEFAULT\Software\Microsoft\Cryptography\CertificateTemplateCache The introduced parse command works completely offline and does not connect to any remote system. Therefore, CA information is not available and the reported data might be outdated. As a result, it is unknown whether a given template is actually enabled/published. Manually query the `certificateTemplates` attribute of objects with class `pKIEnrollmentService` over LDAP and supply the comma separated list to the `-published` command line option. ldapsearch "(objectclass=pKIEnrollmentService)" --attributes certificateTemplates --dn "CN=Configuration,DC=testlab,DC=local" Similarly, the `-vulnerable` option requires a list of SIDs you control. These can be specified as a comma separated list to the `-sids` option. For testing purposes, the sorted JSON output of the regular `certipy find` and newly introduced `certipy parse` can be compared using the following jq(1) one-liner: jq '[ ."Certificate Templates"|values[] ] | sort_by(."Template Name")'
This allows to parse .reg files as for example produced by regedit.exe via the File > Export functionality.
This is solely for output purposes, to make result comparison with LDAP easier.
|
thank you very much |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds a new
certipy parsesub command which can be used to offline parse the content of the local registry certificate template cache as captured by either TrustedSec'sreq_queryBOF or a.regexport as produced by the nativeregedit.exeutility.It is based on The Registry Rundown research by Outflank's Cedric Van Bockhaven and Max Grim as presented at Troopers 24.
The implementation tries to minimize code duplication by implementing the existing LDAP interfaces using the data from the registry. As such modification to the generic vulnerability detection logic in
find.pyis mostly avoided.The changes have been tested against Ludus' AD CS role.
First a regular LDAP enumeration was performed with:
This was then compared to the data obtained by parsing the output of:
With a command like:
Where the published certificate templates were looked up with:
Similarly, the corresponding registry branch was exported from a client machine using the native
regedit.exeutility and subsequently parsed with:Results were compared with the data obtained via LDAP after normalizing the JSON output with:
The only observed differences concern some template metadata fields (creation/modification date) and a few settings related to issuance policies.
@zimedev the changes should also be compatible with your certipy-merged repository.