bats3c / adcspwn Goto Github PK
View Code? Open in Web Editor NEWA tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.
adcspwn's People
Contributors
Stargazers
Watchers
Forkers
xistens 0xsv1 flangvik freeide jermainlaforce gavz marcosd4h rvrsh3ll timb-machine-mirrors curtishoughton topotam rmdavy cwjl fxcebx dannymas archangel-michael phuong39 justan00b91 ashr iiiusky w00t3k hansesecure f1r4s keystroke95 papadope-zz dycsy zha0 ak4l3r3 funnydog896 goowen superuser5 virgilcj immunef1 scriptidiot idfix007 jeningogo preventions kingcode-x yougar0 fdlucifer fengzihk 0neatsec aarandomhacker 3m1za4 beerandgin luemmelsec v4nyl pwnisherx 0n1con3 b0q1 chann-tx reverse-ex rns-sec inspiringz t43wiu6 ykankaya mathevsval kkm1 shantanu561993 id-10086 wrathfuldiety hyabcd mlynchcogent zhouzu josemezavila omicrono 5l1v3r1 askyeye sanjvijay dimopouloselias sts0mrg0 pawnmuncher 0xsudo tai-rex bigbrobro izj007 mmg1 modulexcite slooppe adversaryemulator tinyb0y toteb majid-derkaoui justinforbes crimsonlabs-io gysf666 startagain2016 beyondcy raitomx 6b6f6c6a61 nanaao red-infosec cvlabsio convlabs 4869aptx blurbdust khatcode zpaav viwen194 0xsojalsecadcspwn's Issues
why stop here and nothing happened
Nice work bro!
But why stop here and nothing happened?
LDAP query searches entire domain with --dc option
When you specify the --dc option, the LDAP query that's used does not include the base string:
String Base = "LDAP://CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=";
This causes the query to search through the entire domain.
Help for lab setup?
Hello there,
I'm SUPER excited to try this in the lab. I spun up a fresh Server 2019, joined to my test domain, and then followed this blog to install ADCS. All services appear to be good to go, and if I browse to http://adcs.my.domain/certsrv I get the ADCS page.
However, if I try to trigger ADCSPwn, I only get...
[i] Found 34 certificate templates
[i] Set ADCS web service as: adcs.my.domain
[i] Triggering authentication from target [dc.my.domain]
...and then that's it.
Are there some basic troubleshooting things I can do? Not sure where the disconnect is here.
Thanks,
Brian
ERROR EXECUTE
ADCSPwn.exe --adcs barcelona12.dc.nova --remote 192.168.172.129 --output C:\Temp\cert_b64.txt
The local computer is not part of a domain or the domain cannot be contacted.
even with everything right and connected
my computer is pt-br -> The local computer is not part of a domain or the domain cannot be contacted.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.