Pass the Certificate - PKINIT
Last updated
Was this helpful?
Last updated
Was this helpful?
The Kerberos authentication protocol works with tickets in order to grant access. An ST (Service Ticket) can be obtained by presenting a TGT (Ticket Granting Ticket). That prior TGT can only be obtained by validating a first step named "pre-authentication" (except if that requirement is explicitly removed for some accounts, making them vulnerable to ASREProast). The pre-authentication can be validated symmetrically (with a DES, RC4, AES128 or AES256 key) or asymmetrically (with certificates). The asymmetrical way of pre-authenticating is called PKINIT.
Pass the Certificate is the fancy name given to the pre-authentication operation relying on a certificate (i.e. key pair) to pass in order to obtain a TGT. This operation is often conducted along , AD CS escalation and .
If you encounter the errorKDC_ERR_PADATA_TYPE_NOSUPPwhen attempting to pass the certificate through PKINIT, this may be an indication that the targeted KDC do not have certificates with the necessary EKUs (Extended Key Usages). Specifically, for a KDC to support PKINIT, its certificates must include the Smart Card Logon EKU.
However, you can try to .
From UNIX-like systems, 's from tool to request a TGT (Ticket Granting Ticket) for the target object. That tool supports the use of the certificate in multiple forms.
The ticket obtained can then be used to
authenticate with
conduct an attack. This can be done with from .
obtain access to the account's SPN with an S4U2Self. This can be done with from .
When using Certipy for Pass-the-Certificate, it automatically does to recover the account's NT hash, in addition to saving the obtained TGT.
Evil WinRM doesn't directly support PFX files and need a PEM certificate and private key. The following commands can be used to convert a PFX file in PEM formats
uses the protocol based on to give us an interactive shell on a Windows host. Winrm Supports PKINIT, so we can authenticate with a certificate.
You can also use to perform Pass-the-Certificate authentication:
From Windows systems, (C#) can be used to request a TGT (Ticket Granting Ticket) for the target object from a base64-encoded PFX certificate export (with an optional password).
Certipy uses DER encryption. To generate a PFX for Rubeus, can be used.
conduct an attack (add the /getcredentials flag to Rubeus's asktgt command)