Rogue Certificate Challenge: No Hardware Tokens, No Linux, Just a Web Server with Certificate Mapping.

I am back to my favorite security research: How to abuse certificates in a Windows / Active Directory environment! If an Active Directory integrated certification authority sign a certificate with a custom Subject Alternative Name of your choosing, you can impersonate any administrator in an AD forest. I've published two blog posts about how to … Continue reading Rogue Certificate Challenge: No Hardware Tokens, No Linux, Just a Web Server with Certificate Mapping.

Looking Back: Hacking and Defending Windows Public Key Infrastructure (ADCS)

I live at the fringes of the cybersecurity community. I have never attended infosec conferences. There will be a talk on PKI hacking at Blackhat 2021 soon: Top AD offensive security gurus are presenting comprehensive research on abusing ADCS (Active Directory Certificate Services). I only know about that, because I noticed backlinks from their article … Continue reading Looking Back: Hacking and Defending Windows Public Key Infrastructure (ADCS)

Injecting an EFS Recovery Agent – and Let the Virus Scanner Help You!

How can you read files encrypted with Windows's Encrypting File System if you neither have access to the owner's encryption certificate and key and nor that of a legit data recovery agent (DRA) ... but if you are a local administrator? This work is still inspired by the hackthebox machine Helpline. You were able to … Continue reading Injecting an EFS Recovery Agent – and Let the Virus Scanner Help You!

Parse Certificates Stored in the Windows Registry

You can parse the binary blobs that represent certificates stored in the Windows registry with certutil correctly, even when the Windows Explorer / GUI tells you that this is not a certificate. certutil seems to be able to handle / ignore meta data better. Once upon a time I played with the machine Ethereal provided by … Continue reading Parse Certificates Stored in the Windows Registry

The RSA Algorithm

You want this: Encrypt a message to somebody else - using information that is publicly available. Somebody else should then be able to decrypt the message, using only information they have; nobody else should be able to read this information. The public key cryptography algorithm RSA does achieve this. This article is my way of … Continue reading The RSA Algorithm

Impersonating a Windows Enterprise Admin with a Certificate: Kerberos PKINIT from Linux

This is about a serious misconfiguration of a Windows Public Key Infrastructure integrated with Active Directory: If you can edit certificate templates, you can impersonate the Active Directory Forests's Enterprise Administrator by logging on with a client certificate. You have a persistent credential that will also survive the reset of this admin's password. In the … Continue reading Impersonating a Windows Enterprise Admin with a Certificate: Kerberos PKINIT from Linux

Locating Domain Controllers and Spoofing Active Directory DNS Servers

Last year, hackthebox let me test something I have always found fascinating - and scary: You can impersonate any user in a Windows Active Directory Forest if you have control over the certificate templates of an AD-integrated Windows Public Key Infrastructure: Add extended key usages for smartcard logon to the template, enroll for the certificate, … Continue reading Locating Domain Controllers and Spoofing Active Directory DNS Servers

Helpline @ hackthebox: Injecting an EFS Recovery Agent to Read Encrypted Files

Another great machine has been retired on hackthebox.eu - Helpline by @egre55! Here is my 'silly' unintended way to root the box: You can get both the encrypted user and root flag via the cumbersome web RCE alone - if you wait for a legit user to just look at the file. This is unlikely … Continue reading Helpline @ hackthebox: Injecting an EFS Recovery Agent to Read Encrypted Files

Sizzle @ hackthebox – Unintended: Getting a Logon Smartcard for the Domain Admin!

My writeup - how to pwn my favorite box on hackthebox.eu, using a (supposedly) unintended path. Sizzle - created by @mrb3n813 and @lkys37en - was the first box on HTB that had my favorite Windows Server Role - the Windows Public Key Infrastructure / Certification Authority. This CA allows a low-privileged user - amanda - … Continue reading Sizzle @ hackthebox – Unintended: Getting a Logon Smartcard for the Domain Admin!

Echo Unreadable Hex Characters in Windows: forfiles

How to transfer small files to a locked-down Windows machine? When there is no option to copy, ftp, or http GET a file. When powershell is blocked so that you can only use Windows cmd commands? My first choice would be to use certutil: certutil is a built-in tool for certificate and PKI management. It … Continue reading Echo Unreadable Hex Characters in Windows: forfiles

Ethereal @ hackthebox: Certificate-Related Rabbit Holes

This post is related to the 'insanely' difficult hackthebox machine Ethereal (created by egre55 and MinatoTW) that was recently retired. Beware - It is not at all a full comprehensive write-up! I zoom in on openssl, X.509 certificates, signing stuff, and related unnecessary rabbit holes that were particularly interesting to me - as somebody who … Continue reading Ethereal @ hackthebox: Certificate-Related Rabbit Holes

Certificates and PKI. The Prequel.

Some public key infrastructures run quietly in the background since years. They are half forgotten until the life of a signed file has come to an end - but then everything is on fire. In contrast to other seemingly important deadlines (Management needs this until XY or the world will come to an end!) this … Continue reading Certificates and PKI. The Prequel.

Unintended 2nd Order SQL Injection

Why I am not afraid of the AI / Big Data / Cloud powered robot apocalypse. SQL order injection means to run custom SQL queries through web interfaces because the input to the intended query is not sanitized, like appending the infamous ' OR '1'='1 to a user name or search term. It is 2nd … Continue reading Unintended 2nd Order SQL Injection

Hacking

I am joining the ranks of self-proclaimed productivity experts: Do you feel distracted by social media? Do you feel that too much scrolling feeds transforms your mind - in a bad way? Solution: Go find an online platform that will put your mind in a different state. Go hacking on hackthebox.eu. I have been hacking … Continue reading Hacking

Infinite Loop: Theory and Practice Revisited.

I've unlocked a new achievement as a blogger, or a new milestone as a life-form. As a dinosaur telling the same old stories over and over again. I started drafting a blog post, as I always do since a while: I do it in my mind only, twist and turn in for days or weeks … Continue reading Infinite Loop: Theory and Practice Revisited.

Where Are the Files? [Winsol – UVR16x2]

Recently somebody has asked me where the log files are stored. This question is more interesting then it seems. We are using the freely programmable controller UVR16x2 (and its predecessor) UVR1611) ... .. and their Control and Monitoring Interface - CMI: The CMI is a data logger and runs a web server. It logs data … Continue reading Where Are the Files? [Winsol – UVR16x2]

Bots, Like This! I am an Ardent Fan of HTTPS and Certificates!

This is an experiment in Machine Learning, Big Data, Artificial Intelligence, whatever. But I need proper digression first. Last autumn, I turned my back on social media and went offline for a few days. There, in that magical place, the real world was offline as well. A history of physics museum had to be opened, … Continue reading Bots, Like This! I am an Ardent Fan of HTTPS and Certificates!

The Orphaned Internet Domain Risk

I have clicked on company websites of social media acquaintances, and something is not right: Slight errors in formatting, encoding errors for special German characters. Then I notice that some of the pages contain links to other websites that advertize products in a spammy way. However, the links to the spammy sites are embedded in … Continue reading The Orphaned Internet Domain Risk

Other People Have Lives – I Have Domains

These are just some boring update notifications from the elkemental Webiverse. The elkement blog has recently celebrated its fifth anniversary, and the punktwissen blog will turn five in December. Time to celebrate this - with new domain names that says exactly what these sites are - the 'elkement.blog' and the 'punktwissen.blog' (Edit: which now - … Continue reading Other People Have Lives – I Have Domains

Give the ‘Thing’ a Subnet of Its Own!

To my surprise, the most clicked post ever on this blog is this: Network Sniffing for Everyone: Getting to Know Your Things (As in Internet of Things) ... a step-by-step guide to sniff the network traffic of your 'things' contacting their mothership, plus a brief introduction to networking. I wanted to show how you can … Continue reading Give the ‘Thing’ a Subnet of Its Own!

Internet of Things. Yet Another Gloomy Post.

Technically, I work with Things, as in the Internet of Things. As outlined in Everything as a Service many formerly 'dumb' products - such as heating systems - become part of service offerings. A vital component of the new services is the technical connection of the Thing in your home to that Big Cloud. It … Continue reading Internet of Things. Yet Another Gloomy Post.

Have I Seen the End of E-Mail?

Not that I desire it, but my recent encounters of ransomware make me wonder. Some people in say, accounting or HR departments are forced to use e-mail with utmost paranoia. Hackers send alarmingly professional e-mails that look like invoices, job applications, or notifications of postal services. Clicking a link starts the download of malware that … Continue reading Have I Seen the End of E-Mail?

All My Theories Have Been Wrong. Fortunately!

I apologize to Google. They still like my blog. This blog's numbers plummeted as per Webmaster Tools, here and here you find everything you never wanted to know about it. I finally figured that my blog was a victim of Google's latest update Panda 4.1. Sites about 'anything' had suffered, and the Panda rollout matched … Continue reading All My Theories Have Been Wrong. Fortunately!

Waging a Battle against Sinister Algorithms

I have felt a disturbance of the force. As you might expect from a blog about anything, this one has a weird collection of unrelated top pages and posts. My WordPress Blog Stats tell me I am obviously an internet authority on: how rodents get into kitchen appliances, about the physics of a spinning toy, … Continue reading Waging a Battle against Sinister Algorithms

Google and Heating Systems (2)

I googled our company name. Then I found this: Auftrag means order and the obfuscated parts contain our full company name, the Chief Engineer's name, the URL of a vendor we ordered material from recently, invoice total, and a comment like The client said we should... The now inaccessible URL had pointed to a comma-separated … Continue reading Google and Heating Systems (2)

When I Did Social Engineering without Recognizing It

I planned to read something about history this summer. Then I picked the history of hacking. My favorite was Kevin Mitnick's autobiography - the very definition of a page-turner. The book is free of hardcore technical jargon and written for geeks and lay audience alike. Readers are introduced to the spirit of a hacker in … Continue reading When I Did Social Engineering without Recognizing It

5 Years Anniversary: When My Phone Got Hacked

I like to play with phones. 5 years ago my cell phone decided it wanted to play on its own. It did participate in a TV voting - so the provider said and the itemized bill proved. This was for a music show I wouldn't even watch if somebody paid me for doing so. The … Continue reading 5 Years Anniversary: When My Phone Got Hacked

What Learning about Feynman’s Path Integrals Was Good for

I have gone to great lengths on this blog in order to explain how and why a degree in physics prepares you for seemingly different careers, or at least does not hurt. But it would have been so simple. I will now illustrate this - using just two incomprehensible images. Actually, I have a hidden … Continue reading What Learning about Feynman’s Path Integrals Was Good for

Network Sniffing for Everyone – Getting to Know Your Things (As in Internet of Things)

Simple Sniffing without Hubs or Port Mirroring for the Curious Windows User [Jump to instructions and skip intro] Your science-fiction-style new refrigerator might go online to download the latest offers or order more pizza after checking your calendar and noticing that you have to finish a nerdy project soon. It may depend on your geekiness … Continue reading Network Sniffing for Everyone – Getting to Know Your Things (As in Internet of Things)