-
Notifications
You must be signed in to change notification settings - Fork 89
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #179 from TrimarcJake/testing
Accelerated Release Schedule in Preparation for Antisyphon Training
- Loading branch information
Showing
26 changed files
with
1,605 additions
and
427 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| function Find-ESC11 { | ||
| <# | ||
| .SYNOPSIS | ||
| This script finds AD CS (Active Directory Certificate Services) objects that have the ESC11 vulnerability. | ||
| .DESCRIPTION | ||
| The script takes an array of ADCS objects as input and filters them based on objects that have the objectClass | ||
| 'pKIEnrollmentService' and the InterfaceFlag set to 'No'. For each matching object, it creates a custom object with | ||
| properties representing various information about the object, such as Forest, Name, DistinguishedName, Technique, | ||
| Issue, Fix, and Revert. | ||
| .PARAMETER ADCSObjects | ||
| Specifies the array of ADCS objects to be processed. This parameter is mandatory. | ||
| .OUTPUTS | ||
| The script outputs an array of custom objects representing the matching ADCS objects and their associated information. | ||
| .EXAMPLE | ||
| $ADCSObjects = Get-ADCSObject -Target (Get-Target) | ||
| Find-ESC11 -ADCSObjects $ADCSObjects | ||
| $Results | ||
| #> | ||
| [CmdletBinding()] | ||
| param( | ||
| [Parameter(Mandatory)] | ||
| $ADCSObjects | ||
| ) | ||
| process { | ||
| $ADCSObjects | Where-Object { | ||
| ($_.objectClass -eq 'pKIEnrollmentService') -and | ||
| ($_.InterfaceFlag -ne 'Yes') | ||
| } | ForEach-Object { | ||
| [string]$CAFullName = "$($_.dNSHostName)\$($_.Name)" | ||
| $Issue = [pscustomobject]@{ | ||
| Forest = $_.CanonicalName.split('/')[0] | ||
| Name = $_.Name | ||
| DistinguishedName = $_.DistinguishedName | ||
| Technique = 'ESC11' | ||
| Issue = $_.InterfaceFlag | ||
| Fix = 'N/A' | ||
| Revert = 'N/A' | ||
| } | ||
| if ($_.InterfaceFlag -eq 'No') { | ||
| $Issue.Issue = @" | ||
| The IF_ENFORCEENCRYPTICERTREQUEST flag is disabled on this Certification | ||
| Authority (CA). It is possible to relay NTLM authentication to the RPC interface | ||
| of this CA. | ||
| If the LAN Manager authentication level of any domain in this forest is 2 or | ||
| less, an attacker can coerce authentication from a Domain Controller (DC) to | ||
| receive a certificate which can be used to authenticate as that DC. | ||
| "@ | ||
| $Issue.Fix = @" | ||
| # Enable the flag | ||
| certutil -config $CAFullname -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST | ||
| # Restart the Ceritification Authority service | ||
| Invoke-Command -ComputerName `'$($_.dNSHostName)`' -ScriptBlock { | ||
| Get-Service -Name `'certsvc`' | Restart-Service -Force | ||
| } | ||
| "@ | ||
| $Issue.Revert = @" | ||
| # Disable the flag | ||
| certutil -config $CAFullname -setreg CA\InterfaceFlags -IF_ENFORCEENCRYPTICERTREQUEST | ||
| # Restart the Ceritification Authority service | ||
| Invoke-Command -ComputerName `'$($_.dNSHostName)`' -ScriptBlock { | ||
| Get-Service -Name `'certsvc`' | Restart-Service -Force | ||
| } | ||
| "@ | ||
| } | ||
| $Issue | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| function Find-ESC13 { | ||
| <# | ||
| .SYNOPSIS | ||
| This script finds AD CS (Active Directory Certificate Services) objects that have the ESC13 vulnerability. | ||
| .DESCRIPTION | ||
| The script takes an array of ADCS objects as input and filters them based on the specified conditions. | ||
| For each matching object, it creates a custom object with properties representing various information about | ||
| the object, such as Forest, Name, DistinguishedName, IdentityReference, ActiveDirectoryRights, Issue, Fix, Revert, and Technique. | ||
| .PARAMETER ADCSObjects | ||
| Specifies the array of ADCS objects to be processed. This parameter is mandatory. | ||
| .PARAMETER SafeUsers | ||
| Specifies the list of SIDs of safe users who are allowed to have specific rights on the objects. This parameter is mandatory. | ||
| .PARAMETER ClientAuthEKUs | ||
| A list of EKUs that can be used for client authentication. | ||
| .OUTPUTS | ||
| The script outputs an array of custom objects representing the matching ADCS objects and their associated information. | ||
| .EXAMPLE | ||
| $ADCSObjects = Get-ADCSObjects | ||
| $SafeUsers = '-512$|-519$|-544$|-18$|-517$|-500$|-516$|-9$|-526$|-527$|S-1-5-10' | ||
| $ClientAuthEKUs = '1\.3\.6\.1\.5\.5\.7\.3\.2|1\.3\.6\.1\.5\.2\.3\.4|1\.3\.6\.1\.4\.1\.311\.20\.2\.2|2\.5\.29\.37\.0' | ||
| $Results = $ADCSObjects | Find-ESC13 -ADCSObjects $ADCSObjects -SafeUsers $SafeUsers -ClientAuthEKUs $ClientAuthEKUs | ||
| $Results | ||
| #> | ||
| [CmdletBinding()] | ||
| param( | ||
| [Parameter(Mandatory)] | ||
| [Microsoft.ActiveDirectory.Management.ADEntity[]]$ADCSObjects, | ||
| [Parameter(Mandatory)] | ||
| [array]$SafeUsers, | ||
| [Parameter(Mandatory)] | ||
| $ClientAuthEKUs | ||
| ) | ||
|
|
||
| $ADCSObjects | Where-Object { | ||
| ($_.objectClass -eq 'pKICertificateTemplate') -and | ||
| ($_.pkiExtendedKeyUsage -match $ClientAuthEKUs) -and | ||
| ($_.'msPKI-Certificate-Policy') | ||
| } | ForEach-Object { | ||
| foreach ($policy in $_.'msPKI-Certificate-Policy') { | ||
| if ($ADCSObjects.'msPKI-Cert-Template-OID' -contains $policy) { | ||
| $OidToCheck = $ADCSObjects | Where-Object 'msPKI-Cert-Template-OID' -eq $policy | ||
| if ($OidToCheck.'msDS-OIDToGroupLink') { | ||
| foreach ($entry in $_.nTSecurityDescriptor.Access) { | ||
| $Principal = New-Object System.Security.Principal.NTAccount($entry.IdentityReference) | ||
| if ($Principal -match '^(S-1|O:)') { | ||
| $SID = $Principal | ||
| } else { | ||
| $SID = ($Principal.Translate([System.Security.Principal.SecurityIdentifier])).Value | ||
| } | ||
| if ( ($SID -notmatch $SafeUsers) -and ($entry.ActiveDirectoryRights -match 'ExtendedRight') ) { | ||
| $Issue = [pscustomobject]@{ | ||
| Forest = $_.CanonicalName.split('/')[0] | ||
| Name = $_.Name | ||
| DistinguishedName = $_.DistinguishedName | ||
| IdentityReference = $entry.IdentityReference | ||
| ActiveDirectoryRights = $entry.ActiveDirectoryRights | ||
| LinkedGroup = $OidToCheck.'msDS-OIDToGroupLink' | ||
| Issue = @" | ||
| $($entry.IdentityReference) can enroll in this Client Authentication template | ||
| which is linked to the group $($OidToCheck.'msDS-OIDToGroupLink'). | ||
| If $($entry.IdentityReference) uses this certificate for authentication, they | ||
| will gain the rights of the linked group while the group membership appears empty. | ||
| "@ | ||
| Fix = @" | ||
| # Enable Manager Approval | ||
| `$Object = `'$($_.DistinguishedName)`' | ||
| Get-ADObject `$Object | Set-ADObject -Replace @{'msPKI-Enrollment-Flag' = 2} | ||
| "@ | ||
| Revert = @" | ||
| # Disable Manager Approval | ||
| `$Object = `'$($_.DistinguishedName)`' | ||
| Get-ADObject `$Object | Set-ADObject -Replace @{'msPKI-Enrollment-Flag' = 0} | ||
| "@ | ||
| Technique = 'ESC13' | ||
| } | ||
| $Issue | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.