Skip to content

Commit 426036b

Browse files
jakehildrethjakehildreth
authored
Merge pull request #8 from jakehildreth/test/HerrHozi-main
Thanks, @HerrHozi!
2 parents 7fd92b5 + 47677f3 commit 426036b

6 files changed

Lines changed: 78 additions & 20 deletions

File tree

‎ADCSGoat/ADCSGoat.psm1‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Dot source public/private functions
2-
$public = @(Get-ChildItem -Path (Join-Path -Path $PSScriptRoot -ChildPath 'Public/*.ps1') -Recurse -ErrorAction Stop)
2+
$public = @(Get-ChildItem -Path (Join-Path -Path $PSScriptRoot -ChildPath 'Public/*.ps1') -Recurse -ErrorAction Stop)
33
$private = @(Get-ChildItem -Path (Join-Path -Path $PSScriptRoot -ChildPath 'Private/*.ps1') -Recurse -ErrorAction Stop)
44
foreach ($import in @($public + $private)) {
55
try {
@@ -10,3 +10,4 @@ foreach ($import in @($public + $private)) {
1010
}
1111

1212
Export-ModuleMember -Function $public.Basename
13+

‎ADCSGoat/Public/Install-ADCSGoat.ps1‎

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,30 @@
11
function Install-ADCSGoat {
22
[CmdletBinding()]
33
param (
4-
[switch]$Randomize
4+
[switch]$Randomize,
5+
[string]$TemplatePrefix = "AG",
6+
[string]$Server
57
)
68

9+
if ([string]::IsNullOrEmpty($Server)) {
10+
$Server = [System.Net.Dns]::GetHostEntry($env:LOGONSERVER.TrimStart('\')).HostName
11+
}
12+
713
#region template issues
814
$Templates = @(
9-
@{Name = 'AGESC1'; ESC = 'ESC1'}
10-
@{Name = 'AGESC2'; ESC = 'ESC2'}
11-
@{Name = 'AGESC3c1'; ESC = 'ESC3c1'}
12-
@{Name = 'AGESC3c2'; ESC = 'ESC3c2'}
13-
@{Name = 'AGESC4'; ESC = 'ESC4'}
14-
@{Name = 'AGESC9'; ESC = 'ESC9'}
15+
@{Name = "${TemplatePrefix}ESC1"; ESC = 'ESC1' }
16+
@{Name = "${TemplatePrefix}ESC2"; ESC = 'ESC2' }
17+
@{Name = "${TemplatePrefix}ESC3c1"; ESC = 'ESC3c1' }
18+
@{Name = "${TemplatePrefix}ESC3c2"; ESC = 'ESC3c2' }
19+
@{Name = "${TemplatePrefix}ESC4"; ESC = 'ESC4' }
20+
@{Name = "${TemplatePrefix}ESC9"; ESC = 'ESC9' }
1521
)
1622

1723
# What: Create blank template objects.
1824
# Why:
1925
$Templates | ForEach-Object {
2026
Write-Verbose "Creating blank template object: $($_.Name)"
21-
New-AGBlankTemplateObject -TemplateName $_.Name
27+
New-AGBlankTemplateObject -TemplateName $_.Name -Server $Server
2228
}
2329

2430
# What: Assign properties to the blank template objects to turn them into real templates with vulnerable configs.
@@ -27,21 +33,21 @@ function Install-ADCSGoat {
2733
Write-Verbose "Assigning $($_.ESC) configuration to: $($_.Name)"
2834
$PropertiesPath = Join-Path -Path $PSScriptRoot -ChildPath "..\Private\Template\$($_.ESC).xml"
2935
$Properties = Import-Clixml -Path $PropertiesPath
30-
Set-AGTemplateProperty -TemplateName $_.Name -Properties $Properties
36+
Set-AGTemplateProperty -TemplateName $_.Name -Properties $Properties -Server $Server
3137
}
3238

3339
# What: Grant low privileged users Enroll right on template objects to turn them into ESC issues (except ESC4)
3440
# Why:
3541
$Templates.Where( { $_.ESC -ne 'ESC4' } ) | ForEach-Object {
3642
Write-Verbose "Granting Authenticated Users Enroll rights on: $($_.Name)"
37-
Set-AGTemplateAce -TemplateName $_.Name -AceType Enroll
43+
Set-AGTemplateAce -TemplateName $_.Name -AceType Enroll -Server $Server
3844
}
3945

4046
# What: Grant low privileged users Full Control over a template object to turn it into an ESC4.
4147
# Why:
4248
$Templates.Where( { $_.ESC -eq 'ESC4' } ) | ForEach-Object {
4349
Write-Verbose "Granting Authenticated Users Full Control of: $($_.Name)"
44-
Set-AGTemplateAce -TemplateName $_.Name -AceType GenericAll
50+
Set-AGTemplateAce -TemplateName $_.Name -AceType GenericAll -Server $Server
4551
}
4652
#endregion template issues
4753

@@ -67,10 +73,20 @@ function Install-ADCSGoat {
6773

6874
# What: Enable ESC11 configuration on all CAs.
6975
# Why:
76+
7077
$EnrollmentServices | ForEach-Object {
7178
Write-Verbose "Assigning ESC11 configuration to: $($_.Name)"
7279
Disable-PSCInterfaceFlag -CAFullName $_.FullName -Flag IF_ENFORCEENCRYPTICERTREQUEST
7380
}
7481

82+
# What: Publish Certificate Templates
83+
# Why:
84+
$EnrollmentServices = Find-AGEnrollmentService
85+
$Templates | ForEach-Object {
86+
Write-Verbose "Publish $($_.Name) to: $($EnrollmentServices.Path)"
87+
Publish-AGCertifcateTemplate -TemplateName $_.Name -EnrollmentService $EnrollmentServices.Path -Server $Server
88+
}
89+
7590
#endregion ca issues
7691
}
92+

‎ADCSGoat/Public/New-AGBlankTemplateObject.ps1‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,20 @@ function New-AGBlankTemplateObject {
44
[Parameter(ValueFromPipeline, Mandatory)]
55
# TODO Add input validation to $TemplateName and $name
66
# TODO Generalize to create any objectClass in any location
7-
[string[]]$TemplateName
7+
[string[]]$TemplateName,
8+
[Parameter(ValueFromPipeline, Mandatory)]
9+
[string]$Server
810
)
911

1012
begin {
1113
# Load the S.DS
1214
Add-Type -AssemblyName System.DirectoryServices
1315

1416
# Get the Configuration partition automatically via RootDSE
15-
$RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
17+
$RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$Server/RootDSE")
1618
$ConfigurationPartition = $rootDSE.configurationNamingContext
1719
$TemplatesContainer = "CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigurationPartition"
18-
$TemplatePath = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$TemplatesContainer")
20+
$TemplatePath = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$Server/$TemplatesContainer")
1921
}
2022

2123
process {

‎ADCSGoat/Public/Publish-AGCertficateTemplate.ps1‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
function Publish-AGCertifcateTemplate {
2+
[CmdletBinding()]
3+
param (
4+
[Parameter(ValueFromPipeline, Mandatory)]
5+
[string[]]$TemplateName,
6+
[Parameter(ValueFromPipeline, Mandatory)]
7+
[string]$EnrollmentService,
8+
[Parameter(ValueFromPipeline, Mandatory)]
9+
[string]$Server
10+
)
11+
12+
begin {
13+
Add-Type -AssemblyName System.DirectoryServices
14+
$EnrollmentServiceObject = [ADSI]$EnrollmentService.Replace("LDAP://", "LDAP://$Server/")
15+
}
16+
17+
process {
18+
19+
if ($EnrollmentServiceObject.certificateTemplates -notcontains $TemplateName) {
20+
$EnrollmentServiceObject.PutEx(3, "certificateTemplates", @($TemplateName))
21+
$EnrollmentServiceObject.SetInfo()
22+
Write-Verbose "Template '$TemplateName' published."
23+
} else {
24+
Write-Verbose "Template '$TemplateName' already published on CA!"
25+
}
26+
}
27+
}
28+
29+

‎ADCSGoat/Public/Set-AGTemplateAce.ps1‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
function Set-AGTemplateAce {
2+
23
[CmdletBinding()]
34
param (
5+
[Parameter(ValueFromPipeline, Mandatory)]
6+
[string]$Server,
47
[Parameter(ValueFromPipeline, Mandatory)]
58
[string[]]$TemplateName,
69
[Parameter(Mandatory)]
7-
[ValidateSet('Enroll','FullControl','GenericAll','WriteProperty')]
10+
[ValidateSet('Enroll', 'FullControl', 'GenericAll', 'WriteProperty')]
811
[string]$AceType
912
)
1013

@@ -13,8 +16,12 @@ function Set-AGTemplateAce {
1316
Add-Type -AssemblyName System.DirectoryServices
1417

1518
# Get the Configuration partition automatically via RootDSE
16-
$RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
17-
$ConfigurationPartition = $rootDSE.configurationNamingContext
19+
try {
20+
$RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$Server/RootDSE")
21+
$ConfigurationPartition = $RootDSE.configurationNamingContext
22+
} catch {
23+
throw "Failed to query RootDSE on $Server. $_"
24+
}
1825
$TemplateContainer = "CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigurationPartition"
1926

2027
# Define principals for use in ACEs
@@ -39,6 +46,7 @@ function Set-AGTemplateAce {
3946
$Allow = [System.Security.AccessControl.AccessControlType]::Allow
4047
# $Deny = [System.Security.AccessControl.AccessControlType]::Deny
4148

49+
# Build AccessRule
4250
$AccessRule = switch -Regex ($AceType) {
4351
'Enroll' {
4452
@(

‎ADCSGoat/Public/Set-AGTemplateProperty.ps1‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
function Set-AGTemplateProperty {
22
[CmdletBinding()]
33
param (
4+
[Parameter(ValueFromPipeline, Mandatory)]
5+
[string]$Server,
46
[Parameter(ValueFromPipeline, Mandatory)]
57
[string]$TemplateName,
68
[Parameter(ValueFromPipeline, Mandatory)]
@@ -10,14 +12,14 @@ function Set-AGTemplateProperty {
1012
begin {
1113
Add-Type -AssemblyName System.DirectoryServices
1214
# Get the Configuration partition
13-
$RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
15+
$RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$Server/RootDSE")
1416
$ConfigurationPartition = $rootDSE.configurationNamingContext
1517
}
1618

1719
process {
1820
# Connect to the specific template
1921
$TemplateDN = "CN=$TemplateName,CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigurationPartition"
20-
$Template = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$TemplateDN")
22+
$Template = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$Server/$TemplateDN")
2123

2224
try {
2325
# Set displayName and description for easy cleanup later.

0 commit comments

Comments
 (0)