certipy-ad

Certipy is an offensive and defensive toolkit designed for enumerating and abusing Active Directory Certificate Services (AD CS). It is used by red teamers, penetration testers, and defenders to identify and exploit AD CS misconfigurations, specifically covering the full range of ESC1 through ESC17 attack paths.

Key capabilities include:

• Discovering Certificate Authorities and Templates.
• Identifying misconfigurations.
• Requesting and forging certificates.
• Performing authentication using certificates.
• Relaying NTLM authentication to AD CS HTTP(S)/RPC endpoints.
• Supporting Shadow Credentials, Golden Certificates, and Certificate Mapping Attacks.

Certipy provides a module to implement NTLM relay attacks against Active Directory Certificate Services (AD CS) to obtain certificates for other users. It supports two primary attack vectors:

• ESC8: Relaying NTLM authentication to AD CS HTTP endpoints (Web Enrollment).
• ESC11: Relaying NTLM authentication to AD CS RPC endpoints (MS-ICPR).

These attacks allow for privilege escalation or persistence by obtaining certificates on behalf of relayed users.

The auth command provides certificate-based authentication workflows, including PKINIT for Kerberos and Schannel for LDAPS. It can be used to obtain Kerberos tickets (TGT), extract NT hashes via Kerberos User-to-User (U2U) authentication, or launch an interactive LDAP shell.

Key Capabilities

• PKINIT Authentication: Authenticate to Kerberos using a certificate to obtain a TGT.
• NT Hash Extraction: Automatically attempts to extract the NT hash from the Kerberos ticket using U2U.
• LDAP/LDAPS Authentication: Connect to LDAP servers using certificate-based authentication.
• Interactive LDAP Shell: Launches an enhanced LDAP shell for manual administration after successful authentication.

The forge module allows you to create forged certificates (Golden Certificates) by signing them with a compromised CA private key. This is used for privilege escalation and lateral movement in Active Directory environments.

Key Capabilities

• Custom Subject Alternative Names (SAN): Specify UPN (User Principal Name) or DNS names.
• SID Extensions: Include Security Identifiers (SID) for domain authentication.
• Template-based Forgery: Use an existing certificate as a template to inherit properties.
• Customization: Set custom validity periods, serial numbers, issuer names, and CRL distribution points.
• Application Policies: Add specific application policy OIDs.
• S/MIME: Add S/MIME capability identifiers.

You can use the write_default_configuration option to transform a template into an ESC1-vulnerable state. This requires providing a target SID.

When write_default_configuration is used, the following attributes are configured:

• Security Descriptor: Grants the provided sid full control.
• Flags: Enables PUBLISH_TO_DS, EXPORTABLE_KEY, AUTO_ENROLLMENT, ADD_TEMPLATE_NAME, and IS_DEFAULT.
• EKU: Sets client authentication for both pKIExtendedKeyUsage and msPKI-Certificate-Application-Policy.
• Name Flags: Sets msPKI-Certificate-Name-Flag to ENROLLEE_SUPPLIES_SUBJECT.
• Key Settings: Sets msPKI-Private-Key-Flag to EXPORTABLE_KEY and minimum key size to 2048 bits.

Certipy provides helper functions to process successful certificate requests by saving the resulting certificate and private key to disk.

• handle_request_response(...): Used after a successful request(). It extracts identities, determines an output filename, and saves the certificate and key as a .pfx file.
• handle_retrieve(...): Used after a successful retrieve(). It attempts to find a matching private key (looking for a file named {request_id}.key) to create a .pfx. If no key is found, it saves the certificate as a .crt (PEM) file.
• handle_pending_key_save(...): For pending requests, this function prompts the user to save the private key to a file (defaulting to {request_id}.key).

If no ca_pfx is provided, the module defaults to creating a new self-signed CA certificate. This is useful for testing or creating a local CA.

• Default Subject: CN=Certipy CA (unless overridden by --subject).
• Default Output: ca.pfx (unless overridden by --out).

To create a forged certificate that inherits properties from an existing certificate, use the --template flag. The module will copy extensions from the template while allowing you to override specific fields like Subject, SAN, and SID.

Note: Certain extensions like AuthorityKeyIdentifier, SubjectAlternativeName, ExtendedKeyUsage, and NTDS_CA_SECURITY_EXT are skipped from the template to allow for the new forged identity.

The find command is used to discover and analyze Active Directory Certificate Services (AD CS) components, including certificate templates, certificate authorities (CAs), and issuance policies (OIDs). It also detects vulnerabilities (ESC1-17) and analyzes security permissions/ACLs.

Key capabilities:

• Discovery: Enumerates templates, CAs, and issuance policies via LDAP.
• Relationship Mapping: Links CAs to templates and templates to issuance policies.
• Vulnerability Detection: Identifies misconfigurations and potential attack vectors.
• Property Analysis: Extracts CA configuration (e.g., SAN usage, request disposition, web enrollment status) and template properties (e.g., EKU, enrollment flags, validity periods).