Right.
In this video, I'm going to demonstrate the,
misconfigured user certificate template.
We can start off by using
certify
And it's come back with this one.
So this is a,
so this template is called custom user.
And this is vulnerable because it has enrollee supplies, subject enabled.
And
dev domain users have enrollment rights on this.
So any domain user in the dev
domain can request the user certificate domain.
So let's go ahead and exploit that.
We can do that with,
oops,
certify request.
We need to give it the CA.
So that would be, this one up here.
And the name of the template,
which is custom user.
And then the name of the user that we want to,
request the certificate for.
Let's go with the domain admin.
It can be any user in the domain, but we'll go with the d a.
Okay.
So this will give us the private key and the certificate within these
two blocks of text.
So we need to copy this entire thing.
And then I'm gonna jump onto Ubuntu in WSL.
And let's just put this in
nlam.
Pem.
And write that to a file.
And then we need to use this open SSL command that, certify
gives us.
So this will
be nlam dot pem in and then nlam dot
pfx out.
So all we're doing here is, just converting the format.
So we have to give it an export password.
I'll just put pass one two
three.
I think I typed it there. Pass one two three. And there we go.
So now we have both files here.
Now, this pfx is the one that we want to use with Ruby's to
request the tgt for, nlam.
So let's, cut it
and convert it to, base sixty four.
And we can use,
dash w and zero so that we don't have any line breaks.
So let's copy that.
And then we can use Ruby's
along with the ask TGT command.
All we have to give it is the, name, the username, which is nlam,
the certificate that we just, copied,
the export password, which for me was pass one two three.
Okay, and now we have this TGT as NLAM that we could,
leverage to access any machine in the domain.