Pablo Guides

# certipy-ad$ Pentest Course – Section 1: Introduction & Installation

## Introduction to certipy-ad$

certipy-ad$ is a powerful tool for penetration testers that is designed to assist in the exploitation of Active Directory (AD) environments. This tool allows security professionals to manipulate AD certificates, which can be critical for bypassing authentication and gaining unauthorized access to resources within a target network.

The tool leverages the capabilities of Active Directory Certificate Services (AD CS) to exploit vulnerabilities in the certificate lifecycle, including the issuance, renewal, and revocation processes. Understanding how to effectively use certipy-ad$ can significantly enhance your pentesting toolkit, especially when targeting environments relying heavily on AD infrastructure.

## Installation and Configuration on Kali Linux

To get started with certipy-ad$, you will need to install it on your Kali Linux system. Follow these steps to set it up:

### Prerequisites

Ensure that your Kali Linux installation is up-to-date and has Python 3 installed. You can check for Python 3 by running:

"`bash
python3 –version
"`

If it's not installed, you can install Python 3 using:

"`bash
sudo apt update
sudo apt install python3
"`

### Installing certipy-ad$

1. **Clone the Repository**: Open a terminal and clone the certipy-ad$ repository from GitHub:

    git clone https://github.com/ImmunityInc/certipy-ad

    cd certipy-ad

  

2. **Install Requirements**: Install the required Python libraries:

    pip3 install -r requirements.txt

  

3. **Verify Installation**: To verify that certipy-ad$ is installed correctly, you can check the help menu:

    python3 certipy.py –help

  

If the installation was successful, you should see the help menu listing all available commands and options.

### Configuration

Before using certipy-ad$, you need to configure it according to your environment. This typically involves setting up the correct credentials and specifying the target domain.

1. **Create a Configuration File**: Create a new file named `config.yml` in the `certipy-ad` directory:

[/dm_code_snippet]yaml
domain: "YOURDOMAIN.local"
user: "YOUR_USERNAME"
password: "YOUR_PASSWORD"
[/dm_code_snippet]

2. **Adjust Permissions**: Ensure that the `config.yml` file has the correct permissions to be read by the certipy-ad$ tool:

    chmod 600 config.yml

  

### External References

For detailed documentation on certipy-ad$, you can visit the official repository: [certipy-ad GitHub](https://github.com/ImmunityInc/certipy-ad).

## Step-by-Step Usage of certipy-ad$

After successfully installing and configuring certipy-ad$, it's time to dive into its functionalities. Below are step-by-step instructions for common tasks along with real-world use cases.

### 1. Enumerating Certificates

One of the first tasks in a pentest is to understand the existing certificate structure within an Active Directory environment. You can enumerate certificates using the following command:

"`bash
python3 certipy.py ca -u YOUR_USERNAME -p YOUR_PASSWORD –domain YOURDOMAIN.local
"`

#### Example Output

Upon successful execution, the output will display a list of certificate authorities (CAs) and their associated attributes.

### 2. Requesting a Certificate

If you have identified a vulnerable CA, you can request a certificate using the command:

"`bash
python3 certipy.py request -u YOUR_USERNAME -p YOUR_PASSWORD -d TARGETDOMAIN.local -n "NewCert" -t "user"
"`

This command will attempt to request a new user certificate from the specified domain.

### Real-World Use Case: Kerberoasting

Kerberoasting is a well-known attack that allows attackers to exploit service tickets to extract service account credentials. Using certipy-ad$, you can automate the process of requesting Kerberos tickets and attempt to crack them offline.

#### Steps for Kerberoasting

1. **Enumerate Service Accounts**:

    python3 certipy.py roaster -u YOUR_USERNAME -p YOUR_PASSWORD –domain YOURDOMAIN.local

  

2. **Crack the Tickets**: After obtaining the tickets, utilize tools such as Hashcat to crack the credentials:

    hashcat -m 13100 tickets.txt wordlist.txt

  

### Detailed Technical Explanations

The tool operates through a Python-based command-line interface that communicates with the AD CS to perform various actions. It uses a combination of LDAP queries and HTTP requests to interact with the Certificate Authority.

– **LDAP Queries**: These are fundamental for communication within the AD environment. They retrieve data about users, computers, and certificates.
– **HTTP Requests**: Used primarily when interacting with the AD CS web enrollment service to request and manipulate certificates.

By understanding these technical aspects, pentesters can better navigate and exploit vulnerabilities in AD CS.

### External References for Further Reading

– [Active Directory Certificate Services (AD CS) Overview](https://docs.microsoft.com/en-us/windows-server/identity/ad-certificate-services/)
– [Kerberoasting Explained](https://book.hacktricks.xyz/windows-hardening/active-directory-security/kerberoasting)

"`markdown
### Code Examples
"`bash
# Enumerate Certificates
python3 certipy.py ca -u YOUR_USERNAME -p YOUR_PASSWORD –domain YOURDOMAIN.local

# Request a User Certificate
python3 certipy.py request -u YOUR_USERNAME -p YOUR_PASSWORD -d TARGETDOMAIN.local -n "NewCert" -t "user"

# Kerberoasting
python3 certipy.py roaster -u YOUR_USERNAME -p YOUR_PASSWORD –domain YOURDOMAIN.local
"`
"`

## Conclusion

In this section, we covered the basics of installing and configuring certipy-ad$ on Kali Linux. Furthermore, we explored its initial usages concerning certificate enumeration and request processes, alongside real-world applications like Kerberoasting. Mastery of these techniques will aid penetration testers in assessing the security of Active Directory environments effectively.

For the next section, we will delve deeper into advanced features of certipy-ad$ and explore additional attack vectors that can be leveraged using this essential tool.

Made by pablo rotem / פבלו רותם