Az - Pass the Certificate

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Pass the Certificate (Azure)

Katika mashine zilizounganishwa na Azure, inawezekana kuthibitisha kutoka mashine moja hadi nyingine kwa kutumia vyeti ambavyo vinapaswa kutolewa na Azure AD CA kwa mtumiaji anayehitajika (kama somo) wakati mashine zote zinasaidia NegoEx utaratibu wa uthibitishaji.

Kwa maneno rahisi sana:

• Mashine (mteja) inayozindua muunganisho inahitaji cheti kutoka Azure AD kwa mtumiaji.

• Mteja anaunda kichwa cha JSON Web Token (JWT) kinachojumuisha PRT na maelezo mengine, kinatia saini kwa kutumia Funguo iliyotokana (kwa kutumia funguo za kikao na muktadha wa usalama) na kinituma kwa Azure AD

• Azure AD inathibitisha saini ya JWT kwa kutumia funguo za kikao za mteja na muktadha wa usalama, inakagua uhalali wa PRT na inajibu kwa cheti.

Katika hali hii na baada ya kupata taarifa zote zinazohitajika kwa Pass the PRT shambulio:

• Jina la mtumiaji

• Kitambulisho cha mpangilio

• PRT

• Muktadha wa usalama

• Funguo iliyotokana

Inawezekana kuomba cheti cha P2P kwa mtumiaji kwa kutumia zana PrtToCert:

RequestCert.py [-h] --tenantId TENANTID --prt PRT --userName USERNAME --hexCtx HEXCTX --hexDerivedKey HEXDERIVEDKEY [--passPhrase PASSPHRASE]

Vyeti vitadumu kwa muda sawa na PRT. Kutumia cheti unaweza kutumia zana ya python AzureADJoinedMachinePTC ambayo it ithibitisha kwenye mashine ya mbali, ikakimbia PSEXEC na fungua CMD kwenye mashine ya mwathirika. Hii itaturuhusu kutumia Mimikatz tena kupata PRT ya mtumiaji mwingine.

Main.py [-h] --usercert USERCERT --certpass CERTPASS --remoteip REMOTEIP

References

• Kwa maelezo zaidi kuhusu jinsi Pass the Certificate inavyofanya kazi angalia chapisho asilia https://medium.com/@mor2464/azure-ad-pass-the-certificate-d0c5de624597

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.