Add Authenticating Web Enrollment module for AD/CS #20752
Conversation
| super({ | ||
| 'Name' => 'ESC8 Relay: SMB to HTTP(S)', | ||
| 'Description' => %q{ | ||
| This module creates an SMB server and then relays the credentials passed to it |
There was a problem hiding this comment.
Ooops...... Copy/pasta.
|
|
||
| register_options( | ||
| [ | ||
| OptEnum.new('MODE', [ true, 'The issue mode.', 'ALL', %w[ALL QUERY_ONLY SPECIFIC_TEMPLATE]]), |
There was a problem hiding this comment.
For this module, unlike the relay one, we're highly likely to be able to run it multiple times due to initiating the authentication ourselves. If you set this to default to SPECIFIC_TEMPLATE instead of all, it'd be more closely aligned with the icpr_cert module. Being very similar to that will probably make it easier to drop this in as a replacement for that one when the web service is available but not the ICPR service.
Also is there any way to add support for the additional options that icpr_cert has? If we had the ALT_UPN, ON_BEHALF_OF, PFX, options etc. the user would be able to exploit all of the ESC flaws that they could with that module. IIRC in most cases, the options end up going into the CSR, so there may be an opportunity for more code reuse.
There was a problem hiding this comment.
I updated the mode, but still need to look into support for icpr_cert options.
Simply importing the same library and changing the invocation for the CSR is not enough as the library has required options that are no longer required. I'll need to play around further to see what information is required.
smcintyre-r7
added
module
docs
rn-modules
Still neet to add `on_behalf_of`
|
This still needs some work, but I wanted to put the most recent commit up. |
| include Msf::Exploit::Remote::MsIcpr | ||
| def initialize(info = {}) | ||
| super | ||
| deregister_options('CA', 'CERT_TEMPLATE', 'ADD_CERT_APP_POLICY', 'RPORT', 'SMBDomain', 'SMBPassword', 'HttpUsername', 'HttPassword') |
There was a problem hiding this comment.
| deregister_options('CA', 'CERT_TEMPLATE', 'ADD_CERT_APP_POLICY', 'RPORT', 'SMBDomain', 'SMBPassword', 'HttpUsername', 'HttPassword') | |
| deregister_options('CA', 'CERT_TEMPLATE', 'ADD_CERT_APP_POLICY', 'RPORT', 'SMBDomain', 'SMBPassword', 'HttpUsername', 'HttpPassword') |
| #request = Rex::Proto::X509::Request.create_csr(private_key, cert_template) | ||
| #private_key = OpenSSL::PKey::RSA.new(2048) |
There was a problem hiding this comment.
| #request = Rex::Proto::X509::Request.create_csr(private_key, cert_template) | |
| #private_key = OpenSSL::PKey::RSA.new(2048) |
| temp_password = datastore['HttpPassword'] | ||
| # datastore and options must be nil to fail login so we get ntlm challenge | ||
| datastore['HttpUsername'] = nil | ||
| datastore['HttpUsername'] = nil |
There was a problem hiding this comment.
| datastore['HttpUsername'] = nil | |
| datastore['HttpPassword'] = nil |
3 participants
Adds a module to authenticate to Windows AD/CS web enrollment services to query available templates and/or mint certificates based on available templates. It is essentially the same as
auxiliary/server/relay/esc8but we proved the authentication rather than relaying the authentication.Verification Steps
NTLM
msfconsoleuse auxiliary/admin/http/web_enrollment_certRHOSTSoption to the AD CS Web Enrollment serverHTTP::Authoption tontlmKerberos
msfconsoleuse auxiliary/admin/http/web_enrollment_certRHOSTSoption to the AD CS Web Enrollment serverHTTP::Authoption tokerberosDOMAINoption to the FQDNDomainControllerRhostif it is not available through DNSScenarios
NTLM
Kerberos