Read on Twitter
Did you know that it is possible to elevate privileges with SeImpersonate in an ADCS environment? It is an alternative to *Potato that you can use in your Red Team operations. And you can do it all with Kraken! #redteam #webshell
You can read about this technique explained in… twitter.com/i/web/status/1…
You can read about this technique explained in… twitter.com/i/web/status/1…
First, you must obtain a delegation TGT, you can do it with Rubeus (previous image).
Then you convert the Ticket in KIRBI format to CCACHE. You can use ticketConverter from Impacket:
Then you convert the Ticket in KIRBI format to CCACHE. You can use ticketConverter from Impacket:
With the imported Ticket, you can request a certificate for the machine account using the "Machine" template. Then, you can use PKINIT authentication to get the NT Hash of the machine account. Use Certipy and keep it simple!
Finally, with the NT hash of the machine account, you can create TGS for any service and compromise the machine. By forging a TGS for the CIFS service we can get execution as SYSTEM using Impacket's PsExec:
• • •
Missing some Tweet in this thread? You can try to
force a refresh
