diff --git a/ClientFaux/FauxDeployCMAgent.cs b/ClientFaux/FauxDeployCMAgent.cs index 0c8dd45..e3e7e2b 100644 --- a/ClientFaux/FauxDeployCMAgent.cs +++ b/ClientFaux/FauxDeployCMAgent.cs @@ -1,20 +1,15 @@ using Microsoft.ConfigurationManagement.Messaging.Framework; using Microsoft.ConfigurationManagement.Messaging.Messages; using Microsoft.ConfigurationManagement.Messaging.Sender.Http; -using System.Web; using System; using System.Collections.Generic; using System.Linq; -using System.Net; using System.Security.Cryptography.X509Certificates; -using System.Text; -using System.Threading.Tasks; -using System.Management; using System.Diagnostics; -using System.Xml; using static CMFaux.CMFauxStatusViewClasses; using Microsoft.ConfigurationManagement.Messaging.Messages.Server; using System.IO; +using CERTENROLLLib; namespace CMFaux { @@ -28,7 +23,6 @@ public static SmsClientId RegisterClient(string CMServerName, string ClientName, { X509Certificate2 thisCert = new X509Certificate2(CertPath, pass); - Console.WriteLine(@"Using certificate for client authentication with thumbprint of '{0}'", certificate.Thumbprint); Console.WriteLine("Signature Algorithm: " + thisCert.SignatureAlgorithm.FriendlyName); @@ -164,8 +158,7 @@ public static void SendDiscovery(string CMServerName, string ClientName, string //hinvMessage.Settings.Security.EncryptMessage = true; hinvMessage.Discover(); - var Classes = CMFauxStatusViewClasses.GetWMIClasses(); - + var Classes = CMFauxStatusViewClasses.GetWMIClasses(); foreach (string Class in Classes) { @@ -188,7 +181,6 @@ public static void SendDiscovery(string CMServerName, string ClientName, string hinvMessage.SendMessage(Sender); }; } - public static void SendCustomDiscovery(string CMServerName, string ClientName, string SiteCode, string FilePath, List customClientRecords) { string ddmLocal = FilePath + "\\DDRS\\" + ClientName; @@ -212,7 +204,7 @@ public static void SendCustomDiscovery(string CMServerName, string ClientName, s FileInfo file = di.GetFiles().FirstOrDefault(); File.Copy(file.FullName, CMddmInbox, true); - System.IO.Directory.Delete(ddmLocal); + System.IO.Directory.Delete(ddmLocal, true); } public static void GetPolicy(string CMServerName, string ClientName, string DomainName, string SiteCode, string outPutDirectory, string CertPath, string pass, SmsClientId clientId) @@ -237,7 +229,7 @@ public static void GetPolicy(string CMServerName, string ClientName, string Doma userPolicyMessage.Settings.Security.EncryptMessage = encryption; userPolicyMessage.Settings.ReplyCompression = (true == replyCompression) ? MessageCompression.Zlib : MessageCompression.None; userPolicyMessage.Settings.Compression = (true == compression) ? MessageCompression.Zlib : MessageCompression.None; - userPolicyMessage.SendMessage(Sender); + //userPolicyMessage.SendMessage(Sender); ConfigMgrPolicyAssignmentRequest machinePolicyMessage = new ConfigMgrPolicyAssignmentRequest(); machinePolicyMessage.Settings.HostName = CMServerName; @@ -249,11 +241,71 @@ public static void GetPolicy(string CMServerName, string ClientName, string Doma machinePolicyMessage.SmsId = clientId; machinePolicyMessage.SiteCode = SiteCode; machinePolicyMessage.Discover(); - machinePolicyMessage.SendMessage(Sender); + //machinePolicyMessage.SendMessage(Sender); } } - + public static X509Certificate2 CreateSelfSignedCertificate(string subjectName) + { + // create DN for subject and issuer + var dn = new CX500DistinguishedName(); + dn.Encode("CN=" + subjectName, X500NameFlags.XCN_CERT_NAME_STR_NONE); + // create a new private key for the certificate + CX509PrivateKey privateKey = new CX509PrivateKey + { + ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider", + MachineContext = false, + Length = 2048, + KeySpec = X509KeySpec.XCN_AT_SIGNATURE, // use is not limited + ExportPolicy = X509PrivateKeyExportFlags.XCN_NCRYPT_ALLOW_PLAINTEXT_EXPORT_FLAG + }; + privateKey.Create(); + + // Use the stronger SHA512 hashing algorithm + var hashobj = new CObjectId(); + hashobj.InitializeFromAlgorithmName(ObjectIdGroupId.XCN_CRYPT_HASH_ALG_OID_GROUP_ID, + ObjectIdPublicKeyFlags.XCN_CRYPT_OID_INFO_PUBKEY_ANY, + AlgorithmFlags.AlgorithmFlagsNone, "SHA256"); + + // add extended key usage if you want - look at MSDN for a list of possible OIDs + var oid = new CObjectId(); + oid.InitializeFromValue("1.3.6.1.5.5.7.3.1"); // SSL server + var oidlist = new CObjectIds(); + oidlist.Add(oid); + var eku = new CX509ExtensionEnhancedKeyUsage(); + eku.InitializeEncode(oidlist); + + // Create the self signing request + var cert = new CX509CertificateRequestCertificate(); + cert.InitializeFromPrivateKey(X509CertificateEnrollmentContext.ContextUser, privateKey, ""); + cert.Subject = dn; + cert.Issuer = dn; // the issuer and the subject are the same + cert.NotBefore = DateTime.Now; + // this cert expires immediately. Change to whatever makes sense for you + cert.NotAfter = DateTime.Now.AddYears(1); + cert.X509Extensions.Add((CX509Extension)eku); // add the EKU + cert.HashAlgorithm = hashobj; // Specify the hashing algorithm + cert.Encode(); // encode the certificate + + // Do the final enrollment process + var enroll = new CX509Enrollment(); + enroll.InitializeFromRequest(cert); // load the certificate + enroll.CertificateFriendlyName = subjectName; // Optional: add a friendly name + string csr = enroll.CreateRequest(); // Output the request in base64 + // and install it back as the response + enroll.InstallResponse(InstallResponseRestrictionFlags.AllowUntrustedCertificate, + csr, EncodingType.XCN_CRYPT_STRING_BASE64, ""); // no password + // output a base64 encoded PKCS#12 so we can import it back to the .Net security classes + var base64encoded = enroll.CreatePFX("", // no password, this is for internal consumption + PFXExportOptions.PFXExportChainWithRoot); + + // instantiate the target class with the PKCS#12 data (and the empty password) + return new System.Security.Cryptography.X509Certificates.X509Certificate2( + System.Convert.FromBase64String(base64encoded), "", + // mark the private key as exportable (this is usually what you want to do) + System.Security.Cryptography.X509Certificates.X509KeyStorageFlags.Exportable + ); + } } } diff --git a/ClientFaux/MainWindow.xaml b/ClientFaux/MainWindow.xaml index 7dbc805..b0e11bf 100644 --- a/ClientFaux/MainWindow.xaml +++ b/ClientFaux/MainWindow.xaml @@ -29,19 +29,20 @@ - + + + When both are checked off, we're ready to go!