Windows Certificate Authority Removal

This module allows the attacker to remove an arbitrary CA certificate from the victim's Trusted Root store.

Search Other Modules

Rank

Normal

Authors

vt < nick.freeman [at] security-assessment.com >

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use post/windows/manage/remove_ca
msf post(remove_ca) > set CERTID [STRING]
msf post(remove_ca) > set SESSION [INTEGER]

Module Options

CERTID	SHA1 hash of the certificate to remove. (default: )
SESSION	The session to run this module on.
VERBOSE	Enable detailed status messages
WORKSPACE	Specify the workspace for this module