Description
This module exploits Active Directory Certificate Services (AD CS) template misconfigurations, specifically ESC9, ESC10, and ESC16, by updating an LDAP object and requesting a certificate on behalf of a target user. The module leverages the auxiliary/admin/ldap/ldap_object_attribute module to update the LDAP object and the admin/ldap/shadow_credentials module to add shadow credentials for the target user if the target password is not provided. It then uses the admin/kerberos/get_ticket module to retrieve the NTLM hash of the target user and requests a certificate via MS-ICPR. The resulting certificate can be used for various operations, such as authentication.
The module ensures that any changes made by the ldap_object_attribute or shadow_credentials module are reverted after execution to maintain system integrity.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/admin/dcerpc/esc/update_ldap_objectmsf undefined(update_ldap_object) > show actions ...actions...msf undefined(update_ldap_object) > set ACTION < action-name >msf undefined(update_ldap_object) > show options ...show and set options...msf undefined(update_ldap_object) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub