Pass-the-Cert

Overview Authority is a medium-difficulty Windows machine built around a chain of classic Active Directory misconfigurations. It starts with an anonymously readable SMB share containing Ansible automation, moves through cracking an Ansible Vault to unlock a PWM (password self-service) admin panel, abuses the panel’s “Test LDAP Profile” feature to capture cleartext service-account credentials, and finishes by exploiting a vulnerable AD CS certificate template (ESC1). Because the DC does not support PKINIT, the certificate is used over Schannel (Pass-the-Cert) to authenticate as Administrator and take over the domain. ...