Learning to Hack Active Directory Certificate Services (with Shikata!)

[BLUF: The video demonstrates how misconfigured Active Directory Certificate Services (ADCS) can lead to zero-to-full domain compromise via unauthenticated attacks, specifically using forced authentication coercion and relay to a web enrollment endpoint, resulting in domain admin access.]2:15

Key Takeaways:
• ADCS misconfigurations, especially HTTP enrollment enabled by default, create a critical vulnerability allowing unauthenticated attackers to escalate privileges 5:00.
• The "petite patam" attack forces a domain controller to authenticate via SMB, relaying the net TLMv2 session to the ADCS HTTP endpoint to gain domain controller machine account access 18:00.
• Once authenticated, attackers can use Kerberos over a certificate to extract the NT hash via "unpack the hash," enabling persistent access to domain admin credentials 23:00.
• The attacker leverages the domain controller’s replication privileges to dump the NTDS database and retrieve domain admin credentials via NTDS.dit 27:00.

This attack path, discovered by Spectre Ops, allows full domain compromise in just a few commands from no initial access, highlighting the critical importance of securing ADCS configurations.

Sources:

• 2:15 Overview of asymmetric encryption and certificate trust model
• 5:00 Explanation of ADCS HTTP enrollment as a common misconfiguration
• 18:00 Walkthrough of the petite patam attack and SMB authentication coercion
• 23:00 Description of Kerberos over certificate and "unp