Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Becoming the Machine, A Virtual Account's Guide to Total Control

abdulmhsblog.com | blog | #active-directory | #privilege-escalation | #adcs | #virtual-account | #mssql | #pkinit | #silver-ticket

Summary

Presents an ADCS takeover path: from a MSSQL virtual account, enroll a machine certificate with certreq, recover the machine account NTLM hash via PKINIT, then use S4U2SELF for a silver ticket.
Published
Collected

original ↗

Related coverage

  1. Why You Should Pay Attention to Excessive Privilege in Active Directory (semperis.com)
  2. NetSPI/AD-PathFinder: Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data (github.com)
  3. Vulnerability in Kerberos Allows Elevation of Privilege (semperis.com)
  4. When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss (abdulmhsblog.com)
  5. ESC8s and Where to Find Them (abdulmhsblog.com)
  6. Plug & Pwn: Mapping the Windows PnP Auto-Install Attack Surface (netlas.io)

back