Skip to content

Commit fbeaab6

Browse files
jakehildrethjakehildreth
committed
feat: Deploy-AdcsGoat now deploys all basic ESCs
1 parent 60c9da3 commit fbeaab6

27 files changed

Lines changed: 1017 additions & 900 deletions

‎ADCSGoat/ADCSGoat.psd1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ PowerShellVersion = '5.1'
5151
# ProcessorArchitecture = ''
5252

5353
# Modules that must be imported into the global environment prior to importing this module
54-
# RequiredModules = @()
54+
# RequiredModules = @('PSCertutil', 'AutomatedLab')
5555

5656
# Assemblies that must be loaded prior to importing this module
5757
# RequiredAssemblies = @()

‎ADCSGoat/Public/Deploy-AdcsGoat.ps1‎

Lines changed: 64 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,77 @@
11
function Deploy-AdcsGoat {
2-
$TemplateNames = @(
3-
'ESC1'
4-
'ESC2'
5-
'ESC3c1'
6-
'ESC3c2'
7-
'ESC4'
8-
'ESC9'
2+
[CmdletBinding()]
3+
param (
4+
[switch]$Randomize
95
)
106

11-
# We need blank template objects.
12-
$TemplateNames | ForEach-Object {
13-
New-AGBlankTemplateObject -TemplateName $_
7+
#region template issues
8+
$Templates = @(
9+
@{Name = 'AGESC1'; ESC = 'ESC1'}
10+
@{Name = 'AGESC2'; ESC = 'ESC2'}
11+
@{Name = 'AGESC3c1'; ESC = 'ESC3c1'}
12+
@{Name = 'AGESC3c2'; ESC = 'ESC3c2'}
13+
@{Name = 'AGESC4'; ESC = 'ESC4'}
14+
@{Name = 'AGESC9'; ESC = 'ESC9'}
15+
)
16+
17+
# What: Create blank template objects.
18+
# Why:
19+
$Templates | ForEach-Object {
20+
Write-Verbose "Creating blank template object: $($_.Name)"
21+
New-AGBlankTemplateObject -TemplateName $_.Name
1422
}
1523

16-
# We need to assign properties to the blank template objects to turn them into real templates.
17-
$TemplateNames.Where( { $_ -ne 'ESC4' } ) | ForEach-Object {
18-
$PropertiesPath = Join-Path -Path ".\Research" -ChildPath "${_}.xml"
24+
# What: Assign properties to the blank template objects to turn them into real templates with vulnerable configs.
25+
# Why:
26+
$Templates | ForEach-Object {
27+
Write-Verbose "Assigning $($_.ESC) configuration to: $($_.Name)"
28+
$PropertiesPath = Join-Path -Path ".\Research" -ChildPath "$($_.ESC).xml"
1929
$Properties = Import-Clixml -Path $PropertiesPath
20-
Set-AGTemplateProperty -TemplateName $_ -Properties $Properties
30+
Set-AGTemplateProperty -TemplateName $_.Name -Properties $Properties
31+
}
32+
33+
# What: Grant low privileged users Enroll right on template objects to turn them into ESC issues (except ESC4)
34+
# Why:
35+
$Templates.Where( { $_.ESC -ne 'ESC4' } ) | ForEach-Object {
36+
Write-Verbose "Granting Authenticated Users Enroll rights on: $($_.Name)"
37+
Set-AGTemplateAce -TemplateName $_.Name -AceType Enroll
38+
}
39+
40+
# What: Grant low privileged users Full Control over a template object to turn it into an ESC4.
41+
# Why:
42+
$Templates.Where( { $_.ESC -eq 'ESC4' } ) | ForEach-Object {
43+
Write-Verbose "Granting Authenticated Users Full Control of: $($_.Name)"
44+
Set-AGTemplateAce -TemplateName $_.Name -AceType GenericAll
2145
}
46+
#endregion template issues
47+
48+
#region ca issues
49+
# What: Get the list of all Enrollment Services, generate their full CA names, then add the name to the CA object
50+
# Why:
51+
$EnrollmentServices = Find-AGEnrollmentService
52+
$EnrollmentServicesWithFullName = $EnrollmentServices | Set-AGEnrollmentServiceFullName
2253

23-
# We need to grant low privileged users Enroll right on template objects to turn them into ESC issues.
24-
$TemplateNames.Where( { $_ -ne 'ESC4' } ) | ForEach-Object {
25-
Set-AGTemplateAce -TemplateName $_ -AceType Enroll
54+
# What: Enable ESC5 configuration on all CAs.
55+
# Why:
56+
$EnrollmentServicesWithFullName | ForEach-Object {
57+
Write-Verbose "Granting Authenticated Users Full Control of: $($_.FullName)"
58+
# Enable-PCEditFlag -CAFullName $_.FullName -Flag EDITF_ATTRIBUTESUBJECTALTNAME2
2659
}
2760

28-
# We need to grant low privileged users Full Control over a template object to turn it into an ESC4.
29-
$TemplateNames.Where( { $_ -eq 'ESC4' } ) | ForEach-Object {
30-
Set-AGTemplateAce -TemplateName $_ -AceType GenericAll
61+
# What: Enable ESC6 configuration on all CAs.
62+
# Why:
63+
$EnrollmentServicesWithFullName | ForEach-Object {
64+
Write-Verbose "Assigning ESC6 configuration to: $($_.Name)"
65+
Enable-PCEditFlag -CAFullName $_.FullName -Flag EDITF_ATTRIBUTESUBJECTALTNAME2
3166
}
67+
68+
# What: Enable ESC11 configuration on all CAs.
69+
# Why:
70+
$EnrollmentServicesWithFullName | ForEach-Object {
71+
Write-Verbose "Assigning ESC11 configuration to: $($_.Name)"
72+
Disable-PCInterfaceFlag -CAFullName $_.FullName -Flag IF_ENFORCEENCRYPTICERTREQUEST
73+
}
74+
75+
#endregion ca issues
3276
}
3377

‎ADCSGoat/Public/Get-AGEnrollmentServiceFullName.ps1‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎ADCSGoat/Public/Set-AGEnrollmentServiceFullName.ps1‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
function Set-AGEnrollmentServiceFullName {
22
param (
3-
[Parameter(Mandatory)]
3+
[Parameter(Mandatory, ValueFromPipeline)]
44
[ValidateScript({ $_.objectClass -eq 'pKIEnrollmentService' })]
5-
[System.DirectoryServices.DirectoryEntry]$EnrollmentService,
6-
[Parameter(Mandatory)]
7-
[string]$EnrollmentServiceFullName
5+
[System.DirectoryServices.DirectoryEntry]$EnrollmentService
86
)
97

10-
$EnrollmentService | Add-Member -NotePropertyName 'FullName' -NotePropertyValue $EnrollmentServiceFullName -Force
8+
process {
9+
$EnrollmentServiceFullName = "$($EnrollmentService.dNSHostName)\$($EnrollmentService.name)"
10+
$EnrollmentService | Add-Member -NotePropertyName 'FullName' -NotePropertyValue $EnrollmentServiceFullName -Force
11+
}
1112
}

‎ADCSGoat/Public/Set-AGTemplateProperty.ps1‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ function Set-AGTemplateProperty {
2121

2222
try {
2323
# Apply $Properties to the object
24+
$Template.Properties['displayName'].Add($TemplateName)
2425
foreach ($property in $Properties.GetEnumerator()) {
26+
Write-Verbose "Attempting to set $($property.Name) on $TemplateName to: $($property.Value)"
2527
# Each $property could be of a different type, and each type has to be applied differently.
2628
if ($property.Value -is [System.Collections.ICollection] -and $property.Value -isnot [byte[]]) {
2729
# Handle different collection types (ArrayList, Array, etc.), but not byte arrays

‎Research/ESC1.json‎

Lines changed: 56 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,56 @@
1-
{
2-
"msPKI-Enrollment-Flag": 9,
3-
"flags": 131642,
4-
"msPKI-Certificate-Name-Flag": 1,
5-
"pKIExtendedKeyUsage": [
6-
"1.3.6.1.4.1.311.10.3.4",
7-
"1.3.6.1.5.5.7.3.4",
8-
"1.3.6.1.5.5.7.3.2"
9-
],
10-
"pKIOverlapPeriod": [
11-
0,
12-
128,
13-
166,
14-
10,
15-
255,
16-
222,
17-
255,
18-
255
19-
],
20-
"pKIDefaultCSPs": [
21-
"1,Microsoft Enhanced Cryptographic Provider v1.0",
22-
"2,Microsoft Base Cryptographic Provider v1.0"
23-
],
24-
"pKIDefaultKeySpec": 1,
25-
"revision": 100,
26-
"msPKI-Private-Key-Flag": 16842768,
27-
"pKICriticalExtensions": [
28-
"2.5.29.15",
29-
"2.5.29.7"
30-
],
31-
"pKIMaxIssuingDepth": 0,
32-
"msPKI-Certificate-Application-Policy": [
33-
"1.3.6.1.4.1.311.10.3.4",
34-
"1.3.6.1.5.5.7.3.4",
35-
"1.3.6.1.5.5.7.3.2"
36-
],
37-
"msPKI-Template-Minor-Revision": 2,
38-
"msPKI-Minimal-Key-Size": 2048,
39-
"displayName": "ESC1",
40-
"pKIExpirationPeriod": [
41-
0,
42-
64,
43-
57,
44-
135,
45-
46,
46-
225,
47-
254,
48-
255
49-
],
50-
"msPKI-Template-Schema-Version": 2,
51-
"msPKI-RA-Signature": 0,
52-
"pKIKeyUsage": [
53-
160,
54-
0
55-
],
56-
"msPKI-Cert-Template-OID": "1.3.6.1.4.1.311.21.8.4872519.969661.15616387.15184524.2635045.52.984423.9484079"
57-
}
1+
{
2+
"revision": 100,
3+
"pKIDefaultCSPs": [
4+
"1,Microsoft Enhanced Cryptographic Provider v1.0",
5+
"2,Microsoft Base Cryptographic Provider v1.0"
6+
],
7+
"pKIOverlapPeriod": [
8+
0,
9+
128,
10+
166,
11+
10,
12+
255,
13+
222,
14+
255,
15+
255
16+
],
17+
"pKIExpirationPeriod": [
18+
0,
19+
64,
20+
57,
21+
135,
22+
46,
23+
225,
24+
254,
25+
255
26+
],
27+
"msPKI-Enrollment-Flag": 9,
28+
"flags": 131642,
29+
"pKIDefaultKeySpec": 1,
30+
"msPKI-Private-Key-Flag": 16842768,
31+
"msPKI-Template-Schema-Version": 2,
32+
"msPKI-Certificate-Application-Policy": [
33+
"1.3.6.1.4.1.311.10.3.4",
34+
"1.3.6.1.5.5.7.3.4",
35+
"1.3.6.1.5.5.7.3.2"
36+
],
37+
"pKIExtendedKeyUsage": [
38+
"1.3.6.1.4.1.311.10.3.4",
39+
"1.3.6.1.5.5.7.3.4",
40+
"1.3.6.1.5.5.7.3.2"
41+
],
42+
"msPKI-Template-Minor-Revision": 2,
43+
"pKICriticalExtensions": [
44+
"2.5.29.15",
45+
"2.5.29.7"
46+
],
47+
"msPKI-Certificate-Name-Flag": 1,
48+
"pKIKeyUsage": [
49+
160,
50+
0
51+
],
52+
"msPKI-Cert-Template-OID": "1.3.6.1.4.1.311.21.8.4872519.969661.15616387.15184524.2635045.52.984423.9484079",
53+
"msPKI-RA-Signature": 0,
54+
"msPKI-Minimal-Key-Size": 2048,
55+
"pKIMaxIssuingDepth": 0
56+
}

‎Research/ESC1.ps1‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
$ESC1Properties = @{
2-
displayName = 'ESC1'
1+
$ESC1 = @{
32
flags = 131642
43
'msPKI-Certificate-Application-Policy' = @( '1.3.6.1.4.1.311.10.3.4', '1.3.6.1.5.5.7.3.4', '1.3.6.1.5.5.7.3.2' )
54
'msPKI-Certificate-Name-Flag' = 1

0 commit comments

Comments
 (0)