Report CA, ADCS Template and Password along with Pkcs12 in the database

[cdelafuente-r7]

This adds support to the new Pkcs12 data format added in rapid7/metasploit-credential#183. Now, the CA and ADCS template can be added to the Pkcs12 as metadata in the database.

Also, it is now possible to store a Pkcs12 password as a metadata in the database. If the Pkcs12 is encrypted, the password can (and must) be added to the metadata field. It will be used to decrypt the Pkcs12. The creds command has been updated to accept a new option pkcs12-password. The validation will fail if the Pkcs12 we want to add with creds is encrypted and the password is wrong or empty.

This PR needs the metasploit-credentials counterpart be landed first. I have updated the Gemfile to point to the feature branch to be able to test it. This will need to be reverted before landing.

Verification

Testing auxiliary/admin/dcerpc/icpr_cert

Follow the instructions here to set up an AD CS server for testing purposes.

• Start msfconsole
• use auxiliary/admin/dcerpc/icpr_cert
• run verbose=true CA=<CA name> RHOSTS=<remote host> username=<username> password=<user password> CERT_TEMPLATE=User
• Verify creds returns the generated Pkcs12
• Check with irb in msfconsole if the Pkcs12 model contains the metadata filed with the expected values.

msf6 auxiliary(admin/dcerpc/icpr_cert) > run verbose=true CA=myca-CA RHOSTS=10.100.54.12 username=muser password=vagrant CERT_TEMPLATE=User
[*] Running module against 10.100.54.12
[*] 10.100.54.12:445 - Connecting to ICertPassage (ICPR) Remote Protocol
[*] 10.100.54.12:445 - Binding to \cert...
[+] 10.100.54.12:445 - Bound to \cert
[*] 10.100.54.12:445 - Requesting a certificate for user muser - digest algorithm: SHA256 - template: User
[+] 10.100.54.12:445 - The requested certificate was issued.
[*] 10.100.54.12:445 - Certificate UPN: [email protected]
[*] 10.100.54.12:445 - Certificate stored at: /home/n00tmeg/.msf4/loot/20241216151952_default_10.100.54.12_windows.ad.cs_020208.pfx
[*] Auxiliary module execution completed
msf6 auxiliary(admin/dcerpc/icpr_cert) > creds
Credentials
===========

host          origin        service        public              private                                                                                   realm  private_type  JtR Format  cracked_password
----          ------        -------        ------              -------                                                                                   -----  ------------  ----------  ----------------
10.100.54.12  10.100.54.12  445/tcp (smb)  [email protected]  subject:/DC=local/DC=pro/DC=ad/OU=UK/OU=Support/CN=muser,issuer:/DC=local/DC (TRUNCATED)         Pkcs12 (pfx)

msf6 auxiliary(admin/dcerpc/icpr_cert) > irb
[*] Starting IRB shell...
[*] You are in auxiliary/admin/dcerpc/icpr_cert

>> Metasploit::Credential::Pkcs12.all
=>
[#<Metasploit::Credential::Pkcs12:0x00007f3f4d255dd0
  id: 1,
  type: "Metasploit::Credential::Pkcs12",
  data: "<REDACTED>",
  created_at: 2025-02-06 13:25:11.731165 UTC,
  updated_at: 2025-02-06 13:25:11.731165 UTC,
  jtr_format: nil,
  metadata: {"ca"=>"myca-CA", "adcs_template"=>"User"}>]

Testing creds command

• Start msfconsole
• Add a certificate manually with creds add user:testuser pkcs12:<pkcs12 filepath> ca:myca adcs-template:OtherTemplate
• Verify creds returns the generated Pkcs12
• Check with irb in msfconsole if the Pkcs12 model contains the metadata filed with the expected values.

Testing creds command with an encrypted Pkcs12 and a password

First we need to get an password protected Pkcs12. We can use openssl command with an already retrieved pkcs12, with the auxiliary/admin/dcerpc/icpr_cert module for example, and set a password. Check the certificate files with the loot command to get the filepath.

1. Extract client certificate:

openssl pkcs12 -in /home/n00tmeg/.msf4/loot/20250206142511_default_10.232.45.111_windows.ad.cs_641319.pfx -out existingpkcs12_clcert.pem -nokeys -clcerts

Hit Enter when asked for the Import Password (there is no password).
2. Extract client certificate's private key:

openssl pkcs12 -in /home/n00tmeg/.msf4/loot/20250206142511_default_10.232.45.111_windows.ad.cs_641319.pfx -out existingpkcs12_key.pem -nocerts -des3

Hit Enter when asked for the Import Password (there is no password).
Enter a password for the private key export (e.g. password)
3. Re-create the PKCS#12

openssl pkcs12 -export -in existingpkcs12_clcert.pem -inkey existingpkcs12_key.pem -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -out newpkcs12.p12

Enter the previous password set when asked for the pass phrase for existingpkcs12_key.pem (e.g. password)
Enter Export Password: 123456

• Start msfconsole
• Add a certificate manually with creds add user:testuser pkcs12:newpkcs12.p12 ca:myca adcs-template:OtherTemplate pkcs12-password:123456
• Verify creds returns the generated Pkcs12
• Check with irb in msfconsole if the Pkcs12 model contains the metadata filed with the expected values.
• Try to add it again with a wrong password: creds add user:testuser pkcs12:newpkcs12.p12 ca:myca adcs-template:OtherTemplate pkcs12-password:wrongpasswd
• Verify you get a PKCS12 Data ArgumentError

[cdelafuente-r7]

Apparently hash corresponds to a Nonreplayable hash instead of a PasswordHash. This change were required otherwise the specs were failing.

[cdelafuente-r7]

These tests are now working properly. I've added them back even if it is not related to the changes in this PR.

[cdelafuente-r7]

This will need to be reverted before landing.

[cdelafuente-r7]

This file will need to be updated to point to the new metasploit-credential gem is available instead of the this feature branch.