Merge pull request #20882 from karanabe/icpr_cert-rsa-keysize

Add RSAKeySize option to satisfy AD CS template minimums

Author: bwatters-r7

lib/msf/core/exploit/remote/ms_icpr.rb

@@ -54,7 +54,8 @@ def initialize(info = {})
     ], Msf::Exploit::Remote::MsIcpr)
 
     register_advanced_options([
-      OptEnum.new('DigestAlgorithm', [ true, 'The digest algorithm to use', 'SHA256', %w[SHA1 SHA256] ])
+      OptEnum.new('DigestAlgorithm', [ true, 'The digest algorithm to use', 'SHA256', %w[SHA1 SHA256] ]),
+      OptEnum.new('RSAKeySize', [ true, 'RSA key size in bits for CSR generation', '2048', %w[1024 2048 3072 4096 8192] ])
     ])
   end
 
@@ -133,7 +134,9 @@ def connect_icpr(tree)
   end
 
   def do_request_cert(icpr, opts)
-    private_key = OpenSSL::PKey::RSA.new(2048)
+    rsa_key_size = (opts[:rsa_key_size] || datastore['RSAKeySize']).to_i
+    private_key = OpenSSL::PKey::RSA.new(rsa_key_size)
+    vprint_status("RSA key size: #{rsa_key_size}")
     user = opts[:username] || datastore['SMBUser']
     status_msg = "Requesting a certificate for user #{user}"
     alt_dns = opts[:alt_dns] || (datastore['ALT_DNS'].blank? ? nil : datastore['ALT_DNS'])