Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Certify over Winrm #37

Open
sukhwin08 opened this issue Jun 1, 2024 · 1 comment
Open

Certify over Winrm #37

sukhwin08 opened this issue Jun 1, 2024 · 1 comment

Comments

@sukhwin08
Copy link

sukhwin08 commented Jun 1, 2024

Hi,
I am new to blue teaming activities. I am trying to use certify to work on abusing ADCS service in my lab.

I am using a server for performing all attacks. I am logged into that PC using standard user and trying to gain access to user with local admin rights and then perform other enumeration
I have used whisker and rubeus to get TGT of local admin and used winrs to connect to CMD using that admin on the same server
Now when I am trying to run certify commands like certify cas, find, pkiobjects etc but getting the errors

Same is happening with other tools like Sharpshares etc.

Can someone suggest

@Fabrizzio53
Copy link

If your last shell is over a winrm then everything that requires creds over the network will not work, winrm use a logon type that does not store creds on memory, some tools enable you to pass -user and -password, certify dont as far as I remember since he uses your current login. What you need to do is import a tgt to your current session using rubeus or RunasCS to get a revshell with creds on memory. (I think is that someone can correct me If I'm wrong)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants