admin/trustedsec-CS-Remote-OPs-BOF
1
0
Fork 0
mirror of https://github.com/trustedsec/CS-Remote-OPs-BOF synced 2026-06-08 17:56:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'make_token_cert'

Browse Source
This commit is contained in:
christopher.paschen
2026-03-05 15:50:08 -06:00
parent 7bd9b08df5 59a6c65f76
commit 73a8896e0c
3 changed files with 32 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Remote/make_token_cert/make_token_cert.x64.o
BIN
View File
Binary file not shown.
Remote/make_token_cert/make_token_cert.x86.o
BIN
View File
Binary file not shown.
src/Remote/make_token_cert/entry.c
+32 -2
View File
@@ -38,13 +38,31 @@ HCERTSTORE LoadCert(unsigned char * cert, const wchar_t * password, DWORD certle
if (passlen == 2) {
password = NULL;
}
HCERTSTORE store = CRYPT32$PFXImportCertStore(&pfxData, password, CRYPT_USER_KEYSET);
HCERTSTORE store = CRYPT32$PFXImportCertStore(&pfxData, password, PKCS12_ALLOW_OVERWRITE_KEY | PKCS12_ALWAYS_CNG_KSP);
if(store == NULL)
{
internal_printf("Failed to import cert, make sure its in the right format: %x\n", KERNEL32$GetLastError());
return NULL;
}
*pcert = CRYPT32$CertEnumCertificatesInStore(store, NULL);
// Iterate through certs in the PFX to find the one with a private key (skip CA certs)
PCCERT_CONTEXT pEnumCert = NULL;
while ((pEnumCert = CRYPT32$CertEnumCertificatesInStore(store, pEnumCert)) != NULL)
{
DWORD keySpec = 0;
DWORD keySpecSize = sizeof(keySpec);
if (CRYPT32$CertGetCertificateContextProperty(pEnumCert, CERT_KEY_SPEC_PROP_ID, &keySpec, &keySpecSize))
{
*pcert = pEnumCert;
break;
}
}
if (*pcert == NULL)
{
internal_printf("No certificate with a private key found in PFX\n");
CRYPT32$CertCloseStore(store, 0);
CRYPT32$CertCloseStore(hCertStore, 0);
return NULL;
}
CRYPT32$CertAddCertificateContextToStore(hCertStore, *pcert, CERT_STORE_ADD_ALWAYS, &pnewcert);
CRYPT32$CertDeleteCertificateFromStore(*pcert);
CRYPT32$CertCloseStore(store, 0);
@@ -91,6 +109,11 @@ void ImpersonateUser(PCCERT_CONTEXT pCertContext)
#endif
BeaconPrintf(CALLBACK_OUTPUT, "success");
end:
if(hToken)
{
KERNEL32$CloseHandle(hToken);
}
}
#ifdef BOF
@@ -109,6 +132,13 @@ VOID go(
{
return;
}
if(!cert || len == 0)
{
internal_printf("Cert data is empty\n");
goto go_end;
}
internal_printf("Loading Cert into temp store\n");
PCCERT_CONTEXT pcert = NULL;
HCERTSTORE store = LoadCert(cert, password, len, passlen, &pcert);