Certificate theft

This section will focus on certificate theft at the endpoint. If AD CS is deployed in the environment, chances are high that certificates are being used for domain authentication. Windows uses a certificate in .pfx format, which contains the certificate itself and the corresponding private key. However, private keys can be stored separately – for example, on specialized hardware such as Trusted Platform Modules (TPMs), Hardware Security Modules (HSMs), or smart cards. Most companies do not introduce hardware elements, and keys are stored in the operating system. Windows protects keys with the help of the Data Protection Application Programming Interface (DPAPI). For the demonstration, let us issue the khal.drogo user certificate with a non-exportable private key. We can do it via the Certificates snap-in in Microsoft Management Console (MMC). Now, we are ready to start with the practice.

THEFT1 – Exporting certificates using the CryptoAPI

There...