Last updated
Last updated
Certificates can also be useful for maintaining persistent access to both users and computers, because they tend to have a longer shelf-life compared to passwords. For example, User certificates are valid for an entire year by default, regardless of password changes.
Certificates only become invalid if they're revoked by the CA (or expire). This also does not rely on any vulnerable templates. We can extract certificates that have already been issued, or just request new ones.
User Persistence
User certificates that have already been issued can be found in the user's Personal Certificate store.
If we have a Beacon running on their machine, we can enumerate their certificates with Seatbelt.
Always ensure the certificate is used for client authentication.
Certificates can be exported with Mimikatz using crypto::certificates (although it drops them to disk).
Go to View > Downloads to sync files from Cobalt Strike to your local machine.
Base64 encode the pfx file.
Then use it with Rubeus to obtain a TGT. The export password will be mimikatz.
OPSEC
You may notice that this will request RC4 tickets by default. You can force the use of AES256 by including the /enctype:aes256 parameter.
If the user does not have a certificate in their store, we can just request one with Certify.
The same can be applied to computer accounts, but we must elevate to extract those certificates.
If requesting a machine certificate with Certify, the /machine parameter is required to auto-elevate to SYSTEM and assume the identity of the computer account.
