Wrong parameters how to debug ?

[k4nfr3]

Hi,

trying to access the tool for future pentests after the nice podcast but so far no success (yet)

FYi : The host 192.168.16.4 has no AV

$masky -d timatec -u fbu -p 'xxx' -dc-ip 192.168.16.11 -ca "DC01.timatec.local\timatec-DC01-CA" 192.168.16.4 -v
...
[] Loading options...
[] 1 target(s) loaded
[o] Initialization of the threadpool (size: 1)
[o] (192.168.16.4) Start of target processing
[o] (192.168.16.4) The Masky agent binary will be uploaded in: \Windows\Temp\wydxnkqo.exe
[o] (192.168.16.4) The Masky agent output will be stored in: \Windows\Temp\kwkcqilt.jpg
[o] (192.168.16.4) The Masky agent errors will be stored in: \Windows\Temp\rxqgmhcr.png
[+] (192.168.16.4) Current user seems to be local administrator, attempting to run Masky agent...
[o] (192.168.16.4) Masky agent was successfuly uploaded in: '\Windows\Temp\wydxnkqo.exe'
[o] (192.168.16.4) The service 'ocrooivu' was successfuly created
[o] (192.168.16.4) The 'ocrooivu' was restarted for command execution
[×] (192.168.16.4) The provided CA server seems to be invalid or unreachable, please check its value
[o] (192.168.16.4) The 'ocrooivu' service binary path has been removed
[] (192.168.16.4) No user session was hijacked
[o] (192.168.16.4) End of target processing
[] Exiting...

I've used : -ca "DC01.timatec.local\timatec-DC01-CA"
From Certipy:
more 20221024092059_Certipy.txt
Certificate Authorities
0
CA Name : timatec-DC01-CA
DNS Name : DC01.timatec.local

[Z4kSec]

Hi,

Thanks a lot for your feedback !

The targeted host (192.168.16.4) seems to not be able to interact with the RPC services exposed by the ADCS hosted on your DC (192.168.16.11 / DC01.timatec.local).

Could you please check if the targeted host is able to resolve the domain DC01.timatec.local and that no network restrictions are in place between both systems ?

If it works, it could be interesting to test running Certify agent on the targeted host to ensure that it is possible to request a user certificate. You can do it with the following command: .\Certify.exe request /ca:'DC01.timatec.local\timatec-DC01-CA' /template:User.

Otherwise, you can run manually the Masky agent on the targeted host as following: .\Masky.exe /ca:'DC01.timatec.local\timatec-DC01-CA' /template:User and check for more precise debugging information within the newly created file Masky_debug.txt.

Hope this will help ! :)

[Z4kSec]

Hi @k4nfr3 !

Any feedbacks regarding your issue?

[k4nfr3]

Mhmm basically with Certify, I'm unable to request a cert and with Masky agent I get this debug output.
it seems there is an issue with RPC, but I know that i can access the PKI with Certipy from my Kali machine.

System.Runtime.InteropServices.COMException (0x800706BA): CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
at CERTCLILib.ICertRequest3.Submit(Int32 Flags, String strRequest, String strAttributes, String strConfig)
at Masky.Cert.SendCertificateRequest(String CA, String message)
at Masky.Cert.GetCertUser()
at Masky.Impersonate.ExecuteActionWithToken(Action action, IntPtr& NewhProcToken, IntPtr& currentProcHH, Boolean revert)
System.Runtime.InteropServices.COMException (0x800706BA): CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
at CERTCLILib.ICertRequest3.Submit(Int32 Flags, String strRequest, String strAttributes, String strConfig)
at Masky.Cert.SendCertificateRequest(String CA, String message)
at Masky.Cert.GetCertUser()
at Masky.Impersonate.ExecuteActionWithToken(Action action, IntPtr& NewhProcToken, IntPtr& currentProcHH, Boolean revert)
System.Runtime.InteropServices.COMException (0x800706BA): CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
at CERTCLILib.ICertRequest3.Submit(Int32 Flags, String strRequest, String strAttributes, String strConfig)
at Masky.Cert.SendCertificateRequest(String CA, String message)
at Masky.Cert.GetCertUser()
at Masky.Impersonate.ExecuteActionWithToken(Action action, IntPtr& NewhProcToken, IntPtr& currentProcHH, Boolean revert)

[Z4kSec]

I made few checks with Wireshark to reproduce the issue on my lab. I confirm that this error might be due to a network restriction from your targeted host to the ADCS RPC services.

From your initial example, the server 192.168.16.4 is not able to communicate via the DCERPC protocol through the TCP port 135 that your ADCS DC01.timatec.local exposed.

Certify and Masky tools requests a certificate from the host 192.168.16.4. I think it works on your kali box via certipy because this tool directly query a certificate without going through the 192.168.16.4 server.

So I guess that the kali system is able to query the tcp/135 port of your ADCS where the system 192.168.16.4 cannot. Note that relying on MSRPC include the remote TCP/135 port as well as an ephemeral port (ex. 49761, etc.).

Maybe this issue could be solved on your lab by changing the outbound rules set on the local firewall of the targeted server.

But still, this is an issue that could arise in some company networks. I will think to implement a fallback feature to proxify the certificate request to the attacker computer :)

[k4nfr3]

mhmm I did packet capture and all, disable EDR, checked no RPC firewall neither Windows Firewall.
between 192.168.16.4 and 192.168.16.11 (ADCS) there is no FW.
TCP 135 is open as you can see from PrintScreen.

[sdcampbell]

I just had this same issue but it was my fault. I specified the /ca parameter using /ca:'host.domain.com\rootca' with quotes. Once I removed the quotes it worked. Please specify the redacted command line options that you used @k4nfr3 .

[k4nfr3]

Hi,

unfortunatly the issue is not there.
The Certify command or the Masky.exe command with ' or no ' doesn't change the output.

I will stay a mistery for the time being. :-|