corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a07df5-21bb-71db-812f-ba085ef82369

CertPotato – Using ADCS to privesc from virtual and network service accounts to local system

SensePost · published 4 November 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at sensepost.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
41
Words captured
2,169

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://exploit.ph/delegate-2-thyself.html
exploit.ph
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/7b8085317776524c7baf28e4ad6f3b28.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/cbc6d511fff3c5e65c942269ca6582f5.png
sensepost.com
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn617203(v=ws.11
learn.microsoft.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/6d6fc5124a76bf1e23b858c433ab5742.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/f7967e1ac9f3cecd23b80c04d3c62b49.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/df2f675e5a6241575eea5427ac1ae883.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/b721acc8721dca0f2d79b33473c353b8.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/4cae64d055e6d51810de837e1802fab7.png
sensepost.com
https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
specterops.io
https://twitter.com/gentilkiwi/status/998219775485661184
twitter.com
https://github.com/GhostPack/Rubeus
github.com
https://github.com/GhostPack/Rubeus/blob/4c9145752395d48a73faf326c4ae57d2c565be7f/Rubeus/lib/LSA.cs
github.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/7769c1a6a40165f1ca7b790db3742c64.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/9383b45a9eec8b14c630a5e65a933722.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/e241403158850d5a7c221078e6870a13.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/88ea9156df2ace6922cf84eaa3e43080.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/2aaa936cc017fc3bb8cbed7c20da8f67.png
sensepost.com
NTLM relaying to AD CS - On certificates, printers and a little hippo Read at the source ↗
dirkjanm.io
https://twitter.com/_dirkjan
twitter.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/48b08b1091b85404b512117a91f73e6a.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/9402c5d4447cdb9c5902e7daa58b54a8.png
sensepost.com
https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab
posts.specterops.io
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/3dc2801c1edbf7411d56a2ecf90dec71.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/2c24ac036c7e3e6d7eebc6d84a3e3501.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/1d4a52e6df6e5ed32d6361e57f423d48.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/fbbf9670ba8784ab5f543f94ae3a87ee.png
sensepost.com
https://sensepost.com/img/pages/blog/2022/certpotato-using-adcs-to-privesc-from-virtual-and-network-service-accounts-to-local-system/2a34f73bd33190fd8f676348aa6a2494.png
sensepost.com
https://twitter.com/ly4k_
twitter.com
https://github.com/ly4k/Certipy
github.com
https://medium.com/@oliverlyak
medium.com
https://twitter.com/harmj0y
twitter.com
https://twitter.com/tifkin_
twitter.com
https://github.com/GhostPack/Certify
github.com
https://github.com/dirkjanm/PKINITtools
github.com
https://twitter.com/gentilkiwi
twitter.com
https://twitter.com/elad_shamir
twitter.com
https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
shenaniganslabs.io
https://twitter.com/_nwodtuhs/
twitter.com
https://youtu.be/7_iv_eaAFyQ
youtu.be
https://posts.specterops.io/rubeus-now-with-more-kekeo-6f57d91079b9
posts.specterops.io