Quotidien Hebdomadaire Mensuel

Quotidien Shaarli

Tous les liens d'un jour sur une page.

December 4, 2022

Yvelines : cyberattaque contre l'hôpital André Mignot du centre hospitalier de Versailles

L'accueil des patients est limité et l'hôpital a déjà organisé le transfert de deux patients vers d'autres centres de soins, indique France Info.

Certpotato – using adcs to privesc from virtual and network service accounts to local system

The goal of this blog post is to present a privilege escalation I found while working on ADCS. We will see how it is possible to elevate our privileges to NT AUTHORITY\SYSTEM from virtual and network service accounts of a domain-joined machine (for example from a webshell on a Windows server) using ADCS. I want to call this attack chain “CertPotato” as homage to other *Potato tools and as a way to better remember it.

A popular technique for getting SYSTEM from a virtual or network service account is Delegate 2 Thyself by Charlie Clark. This technique involves using RBCD to elevate your privileges. In this article, I propose an alternative approach to become local SYSTEM using ADCS.