AD on Garrettoh's Research / Blog

ADCS: Net-NTLM Relay & PetitPotam

Thu, 25 Sep 2025 00:00:00 +0000

/notes/500-hacking/adcs_relay

Certificate Templates

Templates are critical; they define the certificate’s purpose. Common use cases include:

Client Authentication
Email Encryption
Code Signing

Net-NTLM Relay to ADCS HTTP Endpoints

The Certificate Enrollment web interface is typically hosted at: http://<ADCS-SERVER>/certsrv/

Forced Auth Coercion (PetitPotam)

Many forced auth coercion techniques utilize RPC calls to trigger authentication. Most RPC-based auth can be performed on servers with low-privileged authentication.

Key Protocol: MS-EFSR (Remotely manage encrypted information over the network using RPC).

Mon, 01 Jan 0001 00:00:00 +0000

Ad user requests a TGT (ticket granting ticket) to access a service on a specified server

DC sends the TGT ticket back

User requests a TGS (ticket granting service) to access a specific service or server using kerberos

AD user sends TGS to specified server

Server sends back service specific information

impacket-GetUserSPNs domain/user:pw -dc-ip $DCIP -request

If this doesn’t work because of a time sync error do the following sudo ntpupdate $DCIP

Mon, 01 Jan 0001 00:00:00 +0000

Similar to [[05_Kerberoasting]] but you don’t need a password just a username and then you’ll crack that users password

Gaining the hash

impacket-GetNPUsers <DOMAIN>/<USER>:<PASSWORD> -dc-ip <DC_IP> -request impacket-GetNPUsers <DOMAIN>/ -usersfile users.txt -format hashcat -dc-ip <DC_IP>

Cracking the Hash

hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

Mon, 01 Jan 0001 00:00:00 +0000