Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ESC8s and Where to Find Them

abdulmhsblog.com | blog | #pentesting | #vulnerability-research | #active-directory | #adcs | #esc8 | #certipy | #relay-attack | #web-enrollment

Summary

How to locate AD CS Web Enrollment endpoints for ESC8 relay attacks by enumerating constrained delegation with nxc and BloodHound, then confirming certsrv endpoints with curl before relaying.
Published
Collected

original ↗

Related coverage

  1. When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss (abdulmhsblog.com)
  2. NetSPI/AD-PathFinder: Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data (github.com)
  3. Detecting and Mitigating the PetitPotam Attack on Windows Domains (semperis.com)
  4. Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled (projectblack.io)
  5. Becoming the Machine, A Virtual Account's Guide to Total Control (abdulmhsblog.com)
  6. Google Bug Hunters (bughunters.google.com)

back