Pass-the-Certificate Demonstrates Active Directory Access With PFX and Kerberos Tickets
Summary
A hands-on guide demonstrates using PFX certificates and derived CCACHE tickets for remote execution across Active Directory protocols, compares tools’ execution artifacts, and outlines detection opportunities and defenses.
Key points
- NetExec uses a PFX certificate for command execution over SMB, WMI, WinRM, and MSSQL; the guide assumes the administrator certificate was obtained beforehand.
- Impacket tools and Evil-WinRM use a Kerberos CCACHE ticket for remote commands or interactive shells.
- The demonstrations compare execution artifacts: PsExec creates a service and drops an executable, while WmiExec avoids those artifacts.
- Suggested monitoring includes Kerberos events 4768 and 4769, service creation event 7045, process creation event 4688, and scheduled-task event 4698.
- Recommended defenses include auditing AD CS templates, monitoring certificate issuance, restricting administrative protocols, and limiting privileged certificate use to designated workstations.
Article Details
- Topic
- Pass-the-Certificate and pass-the-ticket techniques for remote execution in Active Directory using certificates and Kerberos tickets
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesThe demonstrations use SMB and the ADMIN$ share for remote execution and file transfer.T1021.006 · Windows Remote ManagementThe demonstrations use WinRM for remote command execution and interactive shell access.T1047 · Windows Management InstrumentationWMI is used to execute commands remotely on domain-joined systems.T1053.005 · Scheduled TaskAtExec creates and runs a scheduled task to execute a command.T1059.001 · PowerShellThe Evil-WinRM demonstration provides an interactive PowerShell session.T1505.001 · SQL Stored ProceduresThe MSSQL demonstration uses the xp_cmdshell stored procedure for operating-system command execution.T1550.003 · Pass the TicketThe demonstrated CCACHE-based authentication uses a Kerberos ticket to access remote systems.T1569.002 · Service ExecutionPsExec and SmbExec create Windows services to run commands remotely.T1649 · Steal or Forge Authentication CertificatesThe article describes using a stolen or forged certificate for authentication and notes prior AD CS exploitation as a possible source.
Vendors
Products
AD CSDefensive measures include auditing AD CS templates, monitoring Kerberos events (e.g., 4768/4769), enforcing certificate rotation and PKINIT freshness, and restricting administrative protocol access.Microsoft Active Directoryticket to authenticate via PKINIT and obtain remote command execution or interactive shells in an Active Directory domain.Windows ServerThe systeminfo output reveals comprehensive details about the Domain Controller: Windows Server 2019 Standard Evaluation (Build 17763), configured as a Primary Domain Controller, running on VMware with 2 processors,
Tools
atexecTechnique 7: Impacket AtExec via CCACHEcertipy(such as ESC1-ESC16 template misconfigurations) and has converted it to a CCACHE file using tools like Certipy.Evil-WinRMTechniques use NetExec for direct PFX authentication and Impacket/Evil-WinRM for CCACHE-based authentication across SMB, WMI, WinRM, and MSSQL, and the article includes detection opportunities and defensiveImpacketTechniques use NetExec for direct PFX authentication and Impacket/Evil-WinRM for CCACHE-based authentication across SMB, WMI, WinRM, and MSSQL, and the article includes detection opportunities and defensiveNetExecTechniques use NetExec for direct PFX authentication and Impacket/Evil-WinRM for CCACHE-based authentication across SMB, WMI, WinRM, and MSSQL, and the article includes detection opportunities and defensivePsExecWmiExec is the stealthiest execution method (no disk/service artifacts) while PsExec is the most detectable (creates services and drops executables).smbexecTechnique 8: Impacket SmbExec via CCACHEwmiexecWmiExec is the stealthiest execution method (no disk/service artifacts) while PsExec is the most detectable (creates services and drops executables).