Certify

These issued certificates can then be used with Rubeus to authenticate to Active Directory as this user, for as long as the certificate is valid.

The only thing I had access to was entering commands into the PowerShell terminal... Use PowerShell to load the base64-encoded bytes and call on the entry point of the application.

These issued certificates can then be used with Rubeus to authenticate to Active Directory as this user, for as long as the certificate is valid.

If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.

Post-compromise activity includes active reconnaissance, data collection, lateral movement, and the use of legitimate tools such as ConnectWise ScreenConnect, Volatility, and Certify for credential theft and privilege escalation.

These issued certificates can then be used with Rubeus to authenticate to Active Directory as this user, for as long as the certificate is valid.

Other tools found in the attack environment include Volatility... and Certify... These tools enable credential access, privilege escalation, and persistent footholds within compromised environments.

These issued certificates can then be used with Rubeus to authenticate to Active Directory as this user, for as long as the certificate is valid.

$EncodedAssemblyName = [System.Reflection.Assembly]::Load([Convert]::FromBase64String("EncodedValueGoesHere"))

This is a wonderfully easy way to get a binary that would not normally be allow-listed on the machine to run with all the functionality intact.

Enter: PowerShell Reflective Assembly Loading! What is PowerShell Reflective Assembly Loading? In short, this is a technique you can use to load .NET assemblies into memory using PowerShell.

So, if an attacker can specify an arbitrary SAN when requesting a certificate that enables domain authentication, and the CA creates and signs a certificate using the attacker-supplied SAN, the attacker can become any user in the domain!

If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.

If the certificate template lacks the required security extension (objectSid), and we control a user account, we can manipulate its attributes to request a certificate that gets mapped to a different identity, like a DA.

Once the vulnerable certificate template has been identified, we can request a new certificate on behalf of a domain administrator using Certify.

Their research demonstrates how attackers—and defenders—can leverage the Certify tool, developed by SpecterOps, to discover and exploit vulnerable certificates within a network.

We start by finding certificate templates that are vulnerable to ESC9. For that, we can use Certipy and provide domain user credentials along with the domain controller IP.

That toolkit includes a PowerShell script designed to scoop up information about victims' Windows environments, such as... installed software... In addition to using custom malware, the ransomware slingers also deployed legitimate software... Volatility; and Certify...

they found Interlock using an array of legitimate security tools during attacks, including ConnectWise ScreenConnect, incident response tool Volatility, offensive security product Certify, and more.