Skip to content

Commit f74b7cc

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#19415, Update the ldap_esc_vulnerable_cert_finder module
Merge branch 'land-19415' into upstream-master
2 parents 2e0a738 + 4cfa93f commit f74b7cc

File tree

3 files changed

+239
-522
lines changed

3 files changed

+239
-522
lines changed

‎docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md

Lines changed: 102 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -190,17 +190,19 @@ msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > show options
190190
191191
Module options (auxiliary/gather/ldap_esc_vulnerable_cert_finder):
192192
193-
Name Current Setting Required Description
194-
---- --------------- -------- -----------
195-
BASE_DN no LDAP base DN if you already have it
196-
DOMAIN no The domain to authenticate to
197-
PASSWORD no The password to authenticate with
198-
REPORT_NONENROLLABLE false yes Report nonenrollable certificate templates
199-
RHOSTS yes The target host(s), see https://github.com/rapid7/metasploit
200-
-framework/wiki/Using-Metasploit
201-
RPORT 389 yes The target port
202-
SSL false no Enable SSL on the LDAP connection
203-
USERNAME no The username to authenticate with
193+
Name Current Setting Required Description
194+
---- --------------- -------- -----------
195+
BASE_DN no LDAP base DN if you already have it
196+
DOMAIN no The domain to authenticate to
197+
PASSWORD no The password to authenticate with
198+
REPORT_NONENROLLABLE false yes Report nonenrollable certificate templates
199+
REPORT_PRIVENROLLABLE false yes Report certificate templates restricted to domain
200+
and enterprise admin
201+
RHOSTS yes The target host(s), see https://github.com/rapid7/metasploit
202+
-framework/wiki/Using-Metasploit
203+
RPORT 389 yes The target port
204+
SSL false no Enable SSL on the LDAP connection
205+
USERNAME no The username to authenticate with
204206
205207
206208
View the full module info with the info, or info -d command.
@@ -218,114 +220,81 @@ msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
218220
219221
[*] Discovering base DN automatically
220222
[+] 172.30.239.85:389 Discovered base DN: DC=daforest,DC=com
221-
[*] Template: SubCA
222-
[*] Distinguished Name: CN=SubCA,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
223-
[*] Vulnerable to: ESC1, ESC2, ESC3_TEMPLATE_2
224-
[*] Certificate Template Enrollment SIDs:
225-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
226-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
227-
[*] Issuing CAs:
228-
[*] * daforest-WIN-BR0CCBA815B-CA
229-
[*] Server: WIN-BR0CCBA815B.daforest.com
230-
[*] Enrollment SIDs:
231-
[*] * S-1-5-11 (Authenticated Users)
232-
[*] Template: ESC1-Template
233-
[*] Distinguished Name: CN=ESC1-Template,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
234-
[*] Vulnerable to: ESC1
235-
[*] Certificate Template Enrollment SIDs:
236-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
237-
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
238-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
239-
[*] Issuing CAs:
240-
[*] * daforest-WIN-BR0CCBA815B-CA
241-
[*] Server: WIN-BR0CCBA815B.daforest.com
242-
[*] Enrollment SIDs:
243-
[*] * S-1-5-11 (Authenticated Users)
244-
[*] Template: ESC2-Template
245-
[*] Distinguished Name: CN=ESC2-Template,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
246-
[*] Vulnerable to: ESC2
247-
[*] Certificate Template Enrollment SIDs:
248-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
249-
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
250-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
251-
[*] Issuing CAs:
252-
[*] * daforest-WIN-BR0CCBA815B-CA
253-
[*] Server: WIN-BR0CCBA815B.daforest.com
254-
[*] Enrollment SIDs:
255-
[*] * S-1-5-11 (Authenticated Users)
256-
[*] Template: ESC3-Template1
257-
[*] Distinguished Name: CN=ESC3-Template1,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
258-
[*] Vulnerable to: ESC3_TEMPLATE_1
259-
[*] Certificate Template Enrollment SIDs:
260-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
261-
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
262-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
263-
[*] Issuing CAs:
264-
[*] * daforest-WIN-BR0CCBA815B-CA
265-
[*] Server: WIN-BR0CCBA815B.daforest.com
266-
[*] Enrollment SIDs:
267-
[*] * S-1-5-11 (Authenticated Users)
268-
[*] Template: User
269-
[*] Distinguished Name: CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
270-
[*] Vulnerable to: ESC3_TEMPLATE_2
271-
[*] Certificate Template Enrollment SIDs:
272-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
273-
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
274-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
275-
[*] Issuing CAs:
276-
[*] * daforest-WIN-BR0CCBA815B-CA
277-
[*] Server: WIN-BR0CCBA815B.daforest.com
278-
[*] Enrollment SIDs:
279-
[*] * S-1-5-11 (Authenticated Users)
280-
[*] Template: Administrator
281-
[*] Distinguished Name: CN=Administrator,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
282-
[*] Vulnerable to: ESC3_TEMPLATE_2
283-
[*] Certificate Template Enrollment SIDs:
284-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
285-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
286-
[*] Issuing CAs:
287-
[*] * daforest-WIN-BR0CCBA815B-CA
288-
[*] Server: WIN-BR0CCBA815B.daforest.com
289-
[*] Enrollment SIDs:
290-
[*] * S-1-5-11 (Authenticated Users)
291-
[*] Template: Machine
292-
[*] Distinguished Name: CN=Machine,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
293-
[*] Vulnerable to: ESC3_TEMPLATE_2
294-
[*] Certificate Template Enrollment SIDs:
295-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
296-
[*] * S-1-5-21-3290009963-1772292745-3260174523-515 (Domain Computers)
297-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
298-
[*] Issuing CAs:
299-
[*] * daforest-WIN-BR0CCBA815B-CA
300-
[*] Server: WIN-BR0CCBA815B.daforest.com
301-
[*] Enrollment SIDs:
302-
[*] * S-1-5-11 (Authenticated Users)
303-
[*] Template: DomainController
304-
[*] Distinguished Name: CN=DomainController,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
305-
[*] Vulnerable to: ESC3_TEMPLATE_2
306-
[*] Certificate Template Enrollment SIDs:
307-
[*] * S-1-5-21-3290009963-1772292745-3260174523-498 (Enterprise Read-only Domain Controllers)
308-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
309-
[*] * S-1-5-21-3290009963-1772292745-3260174523-516 (Domain Controllers)
310-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
311-
[*] * S-1-5-9 (Enterprise Domain Controllers)
312-
[*] Issuing CAs:
313-
[*] * daforest-WIN-BR0CCBA815B-CA
314-
[*] Server: WIN-BR0CCBA815B.daforest.com
315-
[*] Enrollment SIDs:
316-
[*] * S-1-5-11 (Authenticated Users)
317-
[*] Template: ESC3-Template2
318-
[*] Distinguished Name: CN=ESC3-Template2,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
319-
[*] Vulnerable to: ESC3_TEMPLATE_2
320-
[*] Certificate Template Enrollment SIDs:
321-
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
322-
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
323-
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
324-
[*] Issuing CAs:
325-
[*] * daforest-WIN-BR0CCBA815B-CA
326-
[*] Server: WIN-BR0CCBA815B.daforest.com
327-
[*] Enrollment SIDs:
328-
[*] * S-1-5-11 (Authenticated Users)
223+
[+] Template: ESC1-Template
224+
[*] Distinguished Name: CN=ESC1-Template,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
225+
[*] Manager Approval: Disabled
226+
[*] Required Signatures: 0
227+
[+] Vulnerable to: ESC1
228+
[*] Notes: ESC1: Request can specify a subjectAltName (msPKI-Certificate-Name-Flag)
229+
[*] Certificate Template Enrollment SIDs:
230+
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
231+
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
232+
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
233+
[+] Issuing CA: daforest-WIN-BR0CCBA815B-CA (WIN-BR0CCBA815B.daforest.com)
234+
[*] Enrollment SIDs:
235+
[*] * S-1-5-11 (Authenticated Users)
236+
[+] Template: ESC2-Template
237+
[*] Distinguished Name: CN=ESC2-Template,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
238+
[*] Manager Approval: Disabled
239+
[*] Required Signatures: 0
240+
[+] Vulnerable to: ESC2
241+
[*] Notes: ESC2: Template defines the Any Purpose OID or no EKUs (PkiExtendedKeyUsage)
242+
[*] Certificate Template Enrollment SIDs:
243+
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
244+
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
245+
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
246+
[+] Issuing CA: daforest-WIN-BR0CCBA815B-CA (WIN-BR0CCBA815B.daforest.com)
247+
[*] Enrollment SIDs:
248+
[*] * S-1-5-11 (Authenticated Users)
249+
[+] Template: ESC3-Template1
250+
[*] Distinguished Name: CN=ESC3-Template1,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
251+
[*] Manager Approval: Disabled
252+
[*] Required Signatures: 0
253+
[+] Vulnerable to: ESC3_TEMPLATE_1
254+
[*] Notes: ESC3: Template defines the Certificate Request Agent OID (PkiExtendedKeyUsage)
255+
[*] Certificate Template Enrollment SIDs:
256+
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
257+
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
258+
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
259+
[+] Issuing CA: daforest-WIN-BR0CCBA815B-CA (WIN-BR0CCBA815B.daforest.com)
260+
[*] Enrollment SIDs:
261+
[*] * S-1-5-11 (Authenticated Users)
262+
[+] Template: User
263+
[*] Distinguished Name: CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
264+
[*] Manager Approval: Disabled
265+
[*] Required Signatures: 0
266+
[+] Vulnerable to: ESC3_TEMPLATE_2
267+
[*] Certificate Template Enrollment SIDs:
268+
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
269+
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
270+
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
271+
[+] Issuing CA: daforest-WIN-BR0CCBA815B-CA (WIN-BR0CCBA815B.daforest.com)
272+
[*] Enrollment SIDs:
273+
[*] * S-1-5-11 (Authenticated Users)
274+
[+] Template: Machine
275+
[*] Distinguished Name: CN=Machine,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
276+
[*] Manager Approval: Disabled
277+
[*] Required Signatures: 0
278+
[+] Vulnerable to: ESC3_TEMPLATE_2
279+
[*] Certificate Template Enrollment SIDs:
280+
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
281+
[*] * S-1-5-21-3290009963-1772292745-3260174523-515 (Domain Computers)
282+
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
283+
[+] Issuing CA: daforest-WIN-BR0CCBA815B-CA (WIN-BR0CCBA815B.daforest.com)
284+
[*] Enrollment SIDs:
285+
[*] * S-1-5-11 (Authenticated Users)
286+
[+] Template: ESC3-Template2
287+
[*] Distinguished Name: CN=ESC3-Template2,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com
288+
[*] Manager Approval: Disabled
289+
[*] Required Signatures: 0
290+
[+] Vulnerable to: ESC3_TEMPLATE_2
291+
[*] Certificate Template Enrollment SIDs:
292+
[*] * S-1-5-21-3290009963-1772292745-3260174523-512 (Domain Admins)
293+
[*] * S-1-5-21-3290009963-1772292745-3260174523-513 (Domain Users)
294+
[*] * S-1-5-21-3290009963-1772292745-3260174523-519 (Enterprise Admins)
295+
[+] Issuing CA: daforest-WIN-BR0CCBA815B-CA (WIN-BR0CCBA815B.daforest.com)
296+
[*] Enrollment SIDs:
297+
[*] * S-1-5-11 (Authenticated Users)
329298
[*] Auxiliary module execution completed
330299
msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) >
331300
```
@@ -893,21 +862,21 @@ ESC13-Test template is vulenerable to ESC13 and will yield a ticket including th
893862
```
894863
msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
895864
...
896-
[*] Template: ESC13-Test
897-
[*] Distinguished Name: CN=ESC13-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=collalabs1,DC=local
898-
[*] Vulnerable to: ESC13
899-
[*] Notes: ESC13 groups: ESC13-Group
900-
[*] Certificate Template Enrollment SIDs:
901-
[*] * S-1-5-21-3474343397-3755413101-2031708755-512 (Domain Admins)
902-
[*] * S-1-5-21-3474343397-3755413101-2031708755-513 (Domain Users)
865+
[+] Template: ESC13-Test
866+
[*] Distinguished Name: CN=ESC13-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=collalabs1,DC=local
867+
[*] Manager Approval: Disabled
868+
[*] Required Signatures: 0
869+
[+] Vulnerable to: ESC13
870+
[*] Notes: ESC13 groups: ESC13-Group
871+
[*] Certificate Template Enrollment SIDs:
872+
[*] * S-1-5-21-3474343397-3755413101-2031708755-512 (Domain Admins)
873+
[*] * S-1-5-21-3474343397-3755413101-2031708755-513 (Domain Users)
874+
[*] * S-1-5-21-3474343397-3755413101-2031708755-519 (Enterprise Admins)
875+
[+] Issuing CA: collalabs1-SRV-ADDS01-CA (SRV-ADDS01.collalabs1.local)
876+
[*] Enrollment SIDs:
877+
[*] * S-1-5-11 (Authenticated Users)
903878
[*] * S-1-5-21-3474343397-3755413101-2031708755-519 (Enterprise Admins)
904-
[*] Issuing CAs:
905-
[*] * collalabs1-SRV-ADDS01-CA
906-
[*] Server: SRV-ADDS01.collalabs1.local
907-
[*] Enrollment SIDs:
908-
[*] * S-1-5-11 (Authenticated Users)
909-
[*] * S-1-5-21-3474343397-3755413101-2031708755-519 (Enterprise Admins)
910-
[*] * S-1-5-21-3474343397-3755413101-2031708755-512 (Domain Admins)
879+
[*] * S-1-5-21-3474343397-3755413101-2031708755-512 (Domain Admins)
911880
```
912881

913882
In this case, the ticket can be issued with the `icpr_cert` module. No additional options are required to issue the

0 commit comments

Comments
 (0)