ESC8
Last updated
Was this helpful?
Last updated
Was this helpful?
ESC8 attacks fall under the category of NTLM relay attacks. Active Directory Certificate Services (AD CS) supports multiple enrollment methods, including HTTP-based enrollment, which enables users to request and obtain certificates over HTTP. The core concept of ESC8 abuse involves coercing authentication from a machine account and relaying it to AD CS to acquire a certificate that permits client authentication.
Since the HTTP protocol does not enforce NTLM signature verification during authentication, if the HTTP enrollment endpoint is enabled, an attacker can obtain NTLM authentication (through techniques like authentication coercion or poisoning), relay it to the AD CS HTTP endpoint, and request a certificate for the authenticated account.
vulnerable web enrollment endpoint
at least one certificate template that is enabled and allows for domain computer enrollement and client authentication
After identifying a vulnerable web enrollment endpoint we can next setup the NTLM relay. We can use either ntlmrelayx or certipy.
Once either of the relay listeners is running we can use Coercer to perform forced authentication.
Once coercion is successful, certipy or ntlmrelayx will both save the certificate file to the current directory.
Then use certipy to obtain credentials
Various post-exploitation steps can be undertaken after obtaining a machine account hash. The below example will focus on post-exploitation with a Domain Controller hash.
A simple approach would be to perform a DCsync with impacket-secretsdump using the domain controller hash obtained from the certificate.
As an alternative option we can generate a silver ticket for a particular service such as CIFS and then gain direct command execution over the target, in this case the Domain Controller.
Firstly, identify the domain SID.
Next, we use ticketer to forge a silver ticket for a given service. In this case CIFS over Domain Controller.
Then export the TGS.
Finally, authenticate and issue commands.
Local administrator rights are required on Windows to perform this attack as SMB traffic needs to be redirected to a non-default port.
Certify does not identify web enrollment endpoints as such, some manual identification should be enough. Browse to the Web Enrollement for the Certificate Authority.
If we connect over HTTP and see an authentication form such as that shown below, the endpoint is likely vulnereable to ESC8.
NTLMrelayx.exe
DivertTCPconn
SharpEFSTrigger
Configure DivertTCPconn to redirect SMB traffic to port 8445 (Requires Local Admin)
Set up NTLMRelayx and target the Certificate Authority web enrollment point. Ensuring to specify --smb-port 8445.
Coerce a Domain Controller to authenticate to the testing host in order to capture the certificate for the Domain Controller
This should capture the certificate of the Domain Controller providing the coercion is successful.
A simple approach would be to perform a DCsync with PsMapExec using the domain controller TGT obtained from the certificate.
Enable EPA for Certificate Authority Web Enrollment
Disable NTLM for Internet Information Services (IIS) on AD CS Servers in your domain running the "Certificate Authority Web Enrollment" or "Certificate Enrollment Web Service" services.
URL:
Disable NTLM on any AD CS Servers in your domain using the group policy . To configure this GPO, open Group Policy and go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options and set Network security: Restrict NTLM: Incoming NTLM traffic to Deny All Accounts or Deny All domain accounts. If needed, you can add exceptions as necessary using the setting .
