shenaniganslabs.io

www.pkisolutions.com

blog.keyfactor.com

ethicalchaos.dev

docs.microsoft.com

tools.ietf.org

comodosslstore.com

fossies.org

specterops.io

dementor.py

help.zscaler.com

digitalscepter.com

medium.com

10942.ad

msrc-blog.microsoft.com

mmc.exe

wagging-the-dog.html

blog.key

ldp.exe

active-directory-certificate-services-ad-cs-network-device-enrollment-service-ndes.aspx

ad-cs-security-guidance.aspx

what-is-ssl-tls-client-authentication-how-does-it-work.html

certutil.exe

dpapi.cs

c:\ folder up to 10 folders deep for .pfx

pfx2john_8py_source.html

certify.exe

www.sys

approve-certificaterequest.ps1

sharpdpapi.exe

c:\temp\cert.crt

schannel.dll

certuil.exe

dsfunctions.ps1

ghostpack

comaeio

leechristensen

hashcat

notmedic

fe4e98405589e96ed6de5e05ce3c872f8108c0a0

4d82f078246eec3b4d55bfe588cde228ec7f1c08

deda47e05a981387435894f1143623b0abfbc800

5.5.7.3

11.20.2.2

2.5.29.37

5.1.3.2

3.1.4.2

3.1.1.10

3.1.5.2

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/126300e8-5ff9-4643-9ac6-97e3f4aa1926

https://github.com/ghostpack/sharpdpapi

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn786426(v=ws.11

https://github.com/ghostpack/pspkiaudit

https://twitter.com/gentilkiwi/status/1117124086604488709

https://github.com/gentilkiwi/kekeo

https://msrnd-cdn-stor.azureedge.net/bluehat/bluehatil/2019/assets/doc/you%20(dis)liked%20mimikatz%20wait%20for%20kekeo.pdf

https://github.com/gentilkiwi/mimikatz/wiki/howto-

https://www.microsoftpressstore.com/store/windows-server-2008-pki-and-certificate-security-9780735640788

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/4c6950e4-1dc2-4ae3-98c3-b8919bb73822

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-icpr/9b8ed605-6b00-41d1-9a2a-9897e40678fc

https://github.com/cfalta/poshadcs

https://blog.keyfactor.com/hidden-dangers-certificate-subject-alternative-names-sans

https://elkement.blog/2019/06/01/sizzle-hackthebox-unintended-getting-a-logon-smartcard-for-the-domain-admin-2

https://blog.qdsecurity.se/2020/09/04/supply-in-the-request-shenanigans

https://github.com/ghostpack/rubeus/blob/master/changelog.md#160

https://twitter.com/markgamachenerd

https://www.pkisolutions.com/understanding-active-directory-certificate-services-containers-in-active-directory

https://www.pkisolutions.com/object-identifiers-oid-in-pki

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/c83e95a4-ac5e-4519-b885-37a4d1b8d08b#:

https://docs.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings#allow

https://docs.microsoft.com/en-us/windows/win32/secauthz/object-specific-aces

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-csra/509360cf-9797-491e-9dd1-795f63cb1538

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wstep/4766a85d-0d18-4fa1-a51f-e5cb98b752ea

https://social.technet.microsoft.com/wiki/contents/articles/9063.active-directory-certificate-services-ad-cs-network-device-enrollment-service-ndes.aspx

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/ec71fd43-61c2-407b-83c9-b52272dec8a1

https://social.technet.microsoft.com/wiki/contents/articles/10942.ad-cs-security-guidance.aspx#establish_restricted_enrollment_agents

https://tools.ietf.org/html/rfc5280#section-4.2.1.6

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/d0cf1763-3541-4008-a75f-a577fa5e8c5b

https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/import-third-party-ca-to-enterprise-ntauth-store

https://github.com/cfalta/poshadcs#virtual

https://comodosslstore.com/blog/what-is-ssl-tls-client-authentication-how-does-it-work.html

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/8e73932f-70cf-46d6-88b1-8d9f86235e81

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/setting-up-tpm-protected-certificates-using-a-microsoft/ba-p/1129055

https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107

https://docs.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval#key

https://github.com/gentilkiwi/mimikatz/blob/fe4e98405589e96ed6de5e05ce3c872f8108c0a0/modules/kull_m_key.h#l18

https://github.com/ghostpack/sharpdpapi/blob/a81031fe714fab80339187bc2bd8b22c110a08af/sharpdpapi/lib/dpapi.cs#l446

https://docs.microsoft.com/en-us/windows/win32/seccrypto/system-store-locations#cert_system_store_local_machine

https://github.com/hashcat/hashcat/issues/351#issuecomment

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/4e5fb325-eabc-4fac-a0da-af2b6b4430cb

https://blog.keyfactor.com/certificate-auto-enrollment-issuance

https://www.pkisolutions.com/tools/pspki/get-certificatetemplateacl

https://social.technet.microsoft.com/wiki/contents/articles/10942.ad-cs-security-guidance.aspx#roles_and_activities

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-csra/1b69ebd9-a728-4cd2-ba67-fc5c9f2fc7c8

https://www.pkisolutions.com/powershell-pki-pspki-3-7-enhancements-certification-authority-api-part-1

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-csra/ffba57d3-f471-4d74-ad37-87114182df30

https://www.slideshare.net/harmj0y/derbycon-the-unintended-risks-of-trusting-active-directory#slide=41

https://github.com/notmedic/netntlmtosilverticket/blob/master/dementor.py

https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/import-third-party-ca-to-enterprise-ntauth-store#method

https://www.slideshare.net/harmj0y/an-ace-in-the-hole-stealthy-host-persistence-via-security-descriptors

https://www.oreilly.com/library/view/windows-server-2008/9780735625167

https://social.technet.microsoft.com/wiki/contents/articles/2900.offline-root-certification-authority-ca.aspx

https://help.zscaler.com/zia/signing-csr-using-active-directory-certificate-services

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/680736/microsoft-ca-deep-packet-inspection#create

https://digitalscepter.com/blog/entry/ssl-decryption-implementation

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/constraints-what-they-are-and-how-they-amp-8217-re-used/ba-p/1129048

https://blog.keyfactor.com/restricting-ssl-intercept-and-proxy-sub-ca-certificates

https://posts.specterops.io/not-a-security-boundary-breaking-forest-trusts-cd125829518d

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc759073(v=ws.10

https://docs.microsoft.com/en-us/security/compass/esae-retirement#why

https://social.technet.microsoft.com/wiki/contents/articles/10942.ad-cs-security-guidance.aspx

https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-considerations#domain

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/tpm-key-attestation

https://mskb.pkisolutions.com/kb/4043463

https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings#certificatemappingmethods

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn786422(v=ws.11

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4887

https://docs.microsoft.com/en-us/archive/blogs/pki/disposition-values-for-certutil-view-restrict-and-some-creative-samples

http://github.com/ghostpack/pspkiaudit

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/e0c8660c-f299-4725-b090-20354b1db9a6

https://docs.microsoft.com/en-us/windows/win32/rpc/security-support-providers-ssps-

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4876

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662

https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/blob/deda47e05a981387435894f1143623b0abfbc800/ntobjectmanager/dsfunctions.ps1#l86

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4890

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn786435(v=ws.11

HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates90

HKLM\SYSTEM\CurrentControlSet\Services\Kdc