bats3c / adcspwn Goto Github PK

ADCSPwn.exe --adcs barcelona12.dc.nova --remote 192.168.172.129 --output C:\Temp\cert_b64.txt

The local computer is not part of a domain or the domain cannot be contacted.
even with everything right and connected

my computer is pt-br -> The local computer is not part of a domain or the domain cannot be contacted.

Hello there,

I'm SUPER excited to try this in the lab. I spun up a fresh Server 2019, joined to my test domain, and then followed this blog to install ADCS. All services appear to be good to go, and if I browse to http://adcs.my.domain/certsrv I get the ADCS page.

However, if I try to trigger ADCSPwn, I only get...

[i] Found 34 certificate templates
[i] Set ADCS web service as: adcs.my.domain
[i] Triggering authentication from target [dc.my.domain]

...and then that's it.

Are there some basic troubleshooting things I can do? Not sure where the disconnect is here.

Thanks,
Brian

Nice work bro!
But why stop here and nothing happened?

When you specify the --dc option, the LDAP query that's used does not include the base string:
String Base = "LDAP://CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=";

This causes the query to search through the entire domain.