📄 ADCS: New Ways to Abuse ManageCA Permissions

The Certsrv service exhibits a race condition during the creation of CRL files, any standard user with ManageCA ACL and publish the CDP and carry out arbitrary file movements, ultimately leading to domain elevation of privileges.

🔗 https://whoamianony.top/posts/ad-cs-new-ways-to-abuse-manageca-permissions/

#ad #adcs #manageca #privesc

Так, ADCS ESC13

https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53

P.S. А 12 тоже мимо вас прошел😅

#ad #adcs #pentest #redteam

Про принудительную аутентификацию самого центра сертификации ADCS

https://decoder.cloud/2024/02/26/hello-im-your-adcs-server-and-i-want-to-authenticate-against-you/

Не знаю в чем цель, но все равно прикольно😅

#ad #pentest #redteam #adcs

ADCS ESC 14...

https://posts.specterops.io/adcs-esc14-abuse-technique-333a004dc2b9

А еще много будет?

#ad #redteam #pentest #adcs

Забыл написать, тут же ESC15 появился))

https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc

Для поиска в BloodHound CE:

MATCH p=(:Base)-[:Enroll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(:Domain)
WHERE ct.enrolleesuppliessubject = True
AND ct.authenticationenabled = False AND ct.requiresmanagerapproval = False
AND ct.schemaversion = 1
RETURN p

И заодно нашел скрипт для патча:
https://github.com/JonasBK/Powershell/blob/master/Remediate-ESC15.ps1

#pentest #redteam #adcs