> For the complete documentation index, see [llms.txt](https://dmcxblue.gitbook.io/red-team-notes-2-0/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmcxblue.gitbook.io/red-team-notes-2-0/active-directory/active-directory-attacks/active-directory-certificate-services.md). # Active Directory Certificate Services AD CS is Microsoft PKI implementation that integrates with existing Active Directory forests, and provides everything from encrypting file systems to digital signatures, to user authentication. While AD CS is not installed by default it is widely deployed. Attackers con request or renew certificates for users and computers, providing the same persistence approach as other techniques. The certutil binary is a command line tool which can be used to quickly discover if there is a certificate authority on the domain.

We can verify the server has been identified as adcs.dominioncyber.local

I'll proceed with utilizing ntlmrelay from impacket suite we can capture the authentication of the Domain Controller machine Account and relay it to the Certification Authority Server `ntlmrelay -t` [`http://IPOFADCS/certsrv/certfnsh.asp`](http://IPOFADCS/certsrv/certfnsh.asp)`-smb2support --adcs --template DomainController`

We can force authentication via PetitPotam this will make an API call (EfsRpcOpenFileRaw) that will trigger the machine account to authenticate to another system We can see a successful attack since we can monitor that the Certificate was captured, when passing credentials onto Petitpotam we notice the authentication was successful

Here the tool mentioning it has been successful

The certificate will be generated in Base64 format

Moving back to the Windows Workstation we can utilize Rubeus to pass the Ticket

Successfully passing the ticket can be verified by using the klist command on the cmd

We can DCSync the Domain with these permissions

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://dmcxblue.gitbook.io/red-team-notes-2-0/active-directory/active-directory-attacks/active-directory-certificate-services.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.