[Feature] Receiving AES Keys for a User

[chr1s-uni]

✨ Feature Description

Hello,
when abusing certificate-based authentication for a user who is a member of Domain Admins, it is possible to obtain their NTLM hash.

However, if this high-privileged account is also a member of the Protected Users group, the NTLM hash becomes effectively useless for authentication purposes (aside from offline password cracking), since NTLM-based authentication mechanisms are disabled for such accounts.

Given this restriction, the question arises:

Is it possible to retrieve the Kerberos AES keys (AES128/AES256) of a user account by presenting the certificate in order to authenticate as the user?

🚀 Why is this feature important?

• Post Exploitation is not possible when Users inside the Domain Admins group are also in the Protected Users group, since NTLM authentication is prohibited

🔄 Alternatives or Workarounds

No response

📎 Additional Context or Mockups

No response

[fgeek]

You can use:

certipy auth -pfx 'foo.pfx' -dc-ip '10.1.1.1'

And you receive ccache file and then you can for example:

ncx smb dc1.example.com -k --use-kcache -u 'user'

Protected Users group does not protect against this.

[chr1s-uni]

You can use:

certipy auth -pfx 'foo.pfx' -dc-ip '10.1.1.1'

And you receive ccache file and then you can for example:

ncx smb dc1.example.com -k --use-kcache -u 'user'

Protected Users group does not protect against this.

Yes, this might work. My assumption was that the certificate is revoked after some time and then the NTLM hashes are not usable.

But is it possible in AD to receive the AES key via the certificate?