Mane

禁止轉載，可以引用來源，by mane。 Introduction 下面介紹如何通過ADCS申請證書，然後連接到SSL版本的Winrm（端口是5986）。 環境：需要一個AD環境，一個有權限通過Winrm登錄的賬號，這個賬號可以通過ADCS申請證書，且AD只允許5986去登錄。 Quick to find ADCS service if installed 從兩個地方可以快速判斷到AD有沒有開啓ADCS，第一種方法是利用smb看看有沒有 CertEnroll ​這個文件夾： $smbmap -u amanda -p 'Ashare1972' -H 10.129.190.139 [+] IP: 10.129.190.139:445 Name: 10.129.190.139 Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share CertEnroll READ ONLY Active Directory Certificate Services share Department Shares READ ONLY IPC$ READ ONLY ...

Write by mane. Reproduction is not allowed (禁止轉載) !!! Introduction Some web servers NEED to verify the HTTPS certificate to allow access to the service, In pentester, if you get the ca.key file, you can self-signed to access the https service, because you can download ca.crt which include public key in HTTPS server. Private key is not allowed to be leaked, attacker can use this private key to generate new self-signed certificate and sign it in firefox, the firefox need to import PKCS#12 certificate. In general, to generate PKCS#12 to firefox, you need to obtain two files whose ca.ket and ca.crt . A Private Key Here have a example, Assuming you have obtained a ca.key file. $cat ca.key -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDPczpU3s4Pmwdb 7MJsi//m8mm5rEkXcDmratVAk2pTWwWxudo/FFsWAC1zyFV4w2KLacIU7w8Yaz0/ 2m+jLx7wNH2SwFBjJeo5lnz+ux3HB+NhWC/5rdRsk07h71J3dvwYv7hcjPNKLcRl uXt2Ww6GXj4oHhwziE2ETkHgrxQp7jB8pL96SDIJFNEQ1Wqp3eLNnPPbfbLLMW8M YQ4UlXO...