Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Software Entry

Aperta
  • Qualcosa non va?
#79 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
58/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
content, security

Direzione di ricerca

Start by reading the repository’s contribution guidance and existing software entries to learn the expected format for ATT&CK data. Add a Certipy entry based on the details and technique mappings in this issue, then validate that it matches the repository’s data conventions and checks. Done means the entry is complete and its references and technique mappings are represented consistently.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Certipy (New Software Entry)

Type: Tool
Platforms: Windows, Linux
Associated Groups: Used by multiple ransomware affiliates and red teams

Description

Certipy is a Python-based offensive tool for enumerating and exploiting Active Directory Certificate Services (ADCS) misconfigurations. It supports identification of eight classes of ADCS vulnerabilities (ESC1 through ESC10), automated certificate request and authentication, and post-exploitation using forged certificates. Certipy is publicly available and has been adopted by threat actors for privilege escalation in Active Directory environments.

ATT&CK Technique Mapping
Technique Use
T1649 — Steal or Forge Authentication Certificates Certipy requests certificates with forged Subject Alternative Names from misconfigured templates (ESC1, ESC2, ESC3, ESC6) and uses them for domain authentication via PKINIT.
T1558.001 — Golden Ticket After obtaining a CA certificate through ADCS exploitation, Certipy can forge certificates for any domain user, functioning as a persistent authentication backdoor analogous to a golden ticket.
T1069.002 — Domain Groups Certipy enumerates domain groups and certificate template permissions to identify which principals can enroll in vulnerable templates.
T1018 — Remote System Discovery Certipy discovers certificate authorities and their configurations through LDAP queries against the Active Directory configuration partition.
T1557 — Adversary-in-the-Middle Certipy supports NTLM relay attacks against ADCS web enrollment endpoints (ESC8), relaying coerced machine authentication to obtain certificates.
T1484.002 — Trust Modification: Domain Trust Modification Compromised CA certificates obtained through Certipy can be used to forge certificates across domain trusts within the same PKI hierarchy.
References
  • Oliver Lyak. (2022). Certipy — Active Directory Certificate Services enumeration and abuse. GitHub (ly4k/Certipy).
  • Will Schroeder and Lee Christensen. (2021). Certified Pre-Owned. SpecterOps.
Lingua principale
Python
Stelle
701
Fork
150
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di mitre-attack/attack-stix-data

Tutte le issue di mitre-attack/attack-stix-data

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.