PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Becoming the Machine, A Virtual Account's Guide to Total Control

abdulmhsblog.com | blog | #active-directory | #privilege-escalation | #adcs | #virtual-account | #mssql | #pkinit | #silver-ticket
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Presents an ADCS takeover path: from a MSSQL virtual account, enroll a machine certificate with certreq, recover the machine account NTLM hash via PKINIT, then use S4U2SELF for a silver ticket.
Published
Collected

Related coverage

blog · semperis.com
AD Group Risks: How Cryptographic Operators Dangers Escalate Quickly
At first glance, the Cryptographic Operators group doesn’t look scary. But it sits dangerously close to the systems that define trust—and in Windows, trust is everything. Here’s how to head off risk in your environment.
blog · netspi.com
ADPathFinder: OpenGraph Attack Path Mapping in BloodHound CE
ADPathFinder extends BloodHound CE by unifying SharpHound with OpenGraph collectors, mapping privilege escalation paths across AD, ADCS, MSSQL, and SCCM plus context-aware password audits.
blog · abdulmhsblog.com
When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss
A pentester notes Certify and Certipy can misjudge ESC8 NTLM relay exposure: even with EPA enabled, AD CS Web Enrollment may stay relayable when channel or service binding isn't configured right.
blog · abdulmhsblog.com
ESC8s and Where to Find Them
How to locate AD CS Web Enrollment endpoints for ESC8 relay attacks by enumerating constrained delegation with nxc and BloodHound, then confirming certsrv endpoints with curl before relaying.
blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
blog · hunt.io
Over 68 GB of Philippine Overseas-Employment Database Backups Copied From an Exposed Staging Server
An exposed staging server at UpCloud revealed a completed 68 GB copy of 27 Philippine overseas-employment database backups, a rebranded GodPotato privilege escalation tool, and the operator's own transfer logs.
Back