Hacks Weekly #58 The Biggest PKI Misconfigurations

[@EmilGitman]

Thanks for sharing. Step n#1: protect your endpoints and, block any variations of mimikatz, disable debug privileges ...

[@jerryxie777]

If you don't know the password for the certification in example 1. Is the Bug still there???😮

[@CQUREAcademy]

Hi, that's a great question! In all of these examples, we assume that the user has permission to request the certificate. If the user is not able to do so, then it is not possible to abuse CA in this way.