💻 CertiHound

Linux тулза для бора 💻 AD CS данных в BloodHound CE

CertiHound enumerates Active Directory Certificate Services (AD CS) via LDAP and exports BloodHound CE-compatible data for attack path visualization. Identify ESC1-ESC17 vulnerabilities and visualize certificate-based attack paths

certihound -d corp.local -u 'user' -p 'password' --dc 10.10.10.10 --format zip

Работает и как 🐍 Python библиотека:

from certihound import ADCSCollector, BloodHoundCEExporter
from certihound.ldap.connection import LDAPConnection, LDAPConfig

# Configure connection
config = LDAPConfig(
    domain="corp.local",
    username="user",
    password="password",
    dc_ip="10.10.10.10",
    use_ldaps=True,
)

# Collect and export
with LDAPConnection(config) as conn:
    collector = ADCSCollector(conn)
    data = collector.collect_all()

    exporter = BloodHoundCEExporter(data.domain, data.domain_sid)
    result = exporter.export(data)
    result.write_zip("bloodhound_adcs.zip")

Интегрирован в Netexec:

nxc ldap 10.10.10.10 -u user -p pass --bloodhound -c ADCS

😹 Repo

#windows #soft #adcs #redteam

✈️ Telegram 💬 MAX