In this video, I demonstrate how to exploit the unpatched Active Directory Certificate Services vulnerability that exists in the web enrollment feature. NTLMRelayx and dementor.py are used to trigger authentication and receive a base64 encoded certificate for the Domain Controller. This certificate is then used with Rubeus by a low-priv Domain User on their workstation with AV enabled in order to obtain Domain Admin privileges. Finally, BetterSafetyKatz (Mimikatz alternative) is used to dump all the domain hashes in the network.
NTLMRelayx with ADCS flag: [ Ссылка ]
Dementor.py: [ Ссылка ]
My fork of PowerSharpPack (Contains Rubeus, BetterSafetyKatz, etc.): [ Ссылка ]
Guides that helped me and may help you:
[ Ссылка ]
[ Ссылка ]
Chapters:
0:00 Intro + Setup
0:48 Checking for Updates
1:23 NTLMRelayx
1:53 Dementor.py
2:27 Getting Certificate
2:48 Passing the Ticket with Rubeus
4:45 Dump all Domain Hashes with BetterSafetyKatz
5:47 Conclusion
I hope you all enjoy the video!
