Pass the Certificate
Last updated
Was this helpful?
Last updated
Was this helpful?
The Kerberos authentication protocol works with tickets in order to grant access. An ST (Service Ticket) can be obtained by presenting a TGT (Ticket Granting Ticket). That prior TGT can only be obtained by validating a first step named "pre-authentication" (except if that requirement is explicitly removed for some accounts, making them vulnerable to ). The pre-authentication can be validated symmetrically (with a DES, RC4, AES128 or AES256 key) or asymmetrically (with certificates). The asymmetrical way of pre-authenticating is called PKINIT.
Pass the Certificate is the fancy name given to the pre-authentication operation relying on a certificate (i.e. key pair) to pass in order to obtain a TGT. This operation is often conducted along , and .
From UNIX-like systems, 's from tool to request a TGT (Ticket Granting Ticket) for the target object. That tool supports the use of the certificate in multiple forms.
Alternatively, (Python) can be used for the same purpose.
Certipy's commands don't support PFXs with password. The following command can be used to "unprotect" a PFX file.
The ticket obtained can then be used to
authenticate with
conduct an attack. This can be done with from .
obtain access to the account's SPN with an S4U2Self. This can be done with from .
Another alternative is with (Python) which can be used to conduct multiple techniques like elevate a user for DCSync or change password for a specific user.
From Windows systems, (C#) can be used to request a TGT (Ticket Granting Ticket) for the target object from a base64-encoded PFX certificate export (with an optional password).
Certipy uses DER encryption. To generate a PFX for Rubeus, can be used.
authenticate with
conduct an attack (add the /getcredentials flag to Rubeus's asktgt command)