grimlockx / adcskiller Goto Github PK
View Code? Open in Web Editor NEWAn ADCS Exploitation Automation Tool Weaponizing Certipy and Coercer
Home Page: https://hexastrike.com
License: MIT License
An ADCS Exploitation Automation Tool Weaponizing Certipy and Coercer
Home Page: https://hexastrike.com
License: MIT License
sudo python3 adcskiller.py -u user1 -p 'pass123@' -d project.local -dc-ip 10.70.8.100 -L 192.168.131.128
[*] Trying to find vulnerable certificate templates
[+] Saved certipy output to 20231222174052_Certipy.json
[*] Trying to bind to ldap://10.70.8.100:389
[+] Bind to ldap://10.70.8.100:389 successful
[] Getting Domain SID
[+] Received Domain SID: S-1-5-21-2703137250-2132316582-3818591014
[] Getting Domain Administrators Group Common Name of project.local using objectSID: S-1-5-21-2703137250-2132316582-3818591014-512
[*] Getting Domain Administrators of project.local using Common Name: Domain Admins
[+] Found Domain Administrators: admintemp, task, prd Admin, local Admin, Administrator
[*] Getting Domaincontrollers
[+] Found domain controllers: DC-SVR1.project.local
[+] Parsing certipy output 20231222174052_Certipy.json
[-] Error reading Certipy JSON file: [Errno 2] No such file or directory: '20231222174052_Certipy.json'
┌──(kali㉿kali)-[~/Desktop/ADCSKiller]
I think dont save .
Bug:
https://github.com/grimlockx/ADCSKiller/blob/main/adcskiller.py#L59
[*] Certificate authority CA01-SERVER.pentest.lab is not a domain controller
[+] Started Relaying to CA01-SERVER.pentest.lab
[*] Sleep for 5 seconds to wait for Certipy relay setup
Certipy v4.8.0 - by Oliver Lyak (ly4k)
usage: certipy relay [-h] -target hostname [-debug]
[-ca certificate authority name]
[-template template name] [-upn alternative UPN]
[-dns alternative DNS] [-sid alternative Object SID]
[-retrieve request ID] [-key-size RSA key length]
[-out output file name] [-interface ip address]
[-port PORT] [-forever] [-no-skip] [-timeout seconds]
certipy relay: error: the following arguments are required: -target
[+] Started coercion from DC01.pentest.lab to KALI
[+] Finished coercion from DC01.pentest.lab to KALI
And even though the target needs to be specified by -target
for certipy, otherwise you get the error on certipy!
Originally posted by @BakaValen in #5 (comment)
Bug:
https://github.com/grimlockx/ADCSKiller/blob/main/adcskiller.py#L77
Exception in thread CoercerThread:
Traceback (most recent call last):
File "/usr/lib/python3.11/threading.py", line 1038, in _bootstrap_inner
self.run()
File "/opt/ADCSKiller/./adcskiller.py", line 77, in run
subprocess.run(["Coercer", "coerce", "-u", self.username, "-p", self.password, "-d", self.domain, "-t", self.target_dc, "-l", self.lhost, "--always-continue"], capture_output=True, text=True).stdout
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.11/subprocess.py", line 548, in run
with Popen(*popenargs, **kwargs) as process:
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.11/subprocess.py", line 1026, in __init__
self._execute_child(args, executable, preexec_fn, close_fds,
File "/usr/lib/python3.11/subprocess.py", line 1950, in _execute_child
raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: 'Coercer'
Coercer should be coercer. Maybe a typo!
[+] Parsing certipy output XX_Certipy.json
[-] Error reading Certipy JSON file: [Errno 2] No such file or directory: 'XX_Certipy.json'
tried with python3.10 and python3.11 on kali
─# certipy -h
Certipy v4.4.0 - by Oliver Lyak (ly4k)
Coercer -h
______
/ / ___ _____________ _____
/ / / __ / _ / / / _ / /
/ // // / / / / // / / v2.4-blackhat-edition
_/_/__// _/_// by @Podalirius
usage: Coercer [-h] [-v] {scan,coerce,fuzz} ...
ex command ran
python3.11 adcskiller.py -u test-p test-d test.org -dc-ip test -L test
I wanted to let you know that this tool is awesome! Already a fan.
I was thinking about it and I noticed that ESC8 and ESC11 are almost the same steps with the tools that are already in place. I bet it would be really easy to add ESC11 to the functionality of this tool.
Just installed on a fully updated Kali instance.
exactly as your documentation described.
The image describes my error.
What info or logs will you require to help debug please?
All the requirements were installed by your documented methods or were already there via kali repo.
EDIT: I have also done this on Parrot OS and the same error occurs.
It would be very helpful if you could tag releases. This would enable distributions to track releases instead of commits.
Thanks
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.