Domain Escalation (ESC)
ADCS Domain Escalation Techniques
ESC1 - Misconfigured Certificate Templates
Domain Users can enroll in the VulnTemplate template, which can be used for client authentication and has ENROLLEE_SUPPLIES_SUBJECT set. This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a DA). Allows additional identities to be bound to a certificate beyond the Subject.
Requirements
Exploitation
Certify.exe find /vulnerable
Certify.exe find /vulnerable /currentuser
certipy find -username john@corp.local -password Passw0rd -dc-ip 172.16.126.128
(&(objectclass=pkicertificatetemplate)(!(mspki-enrollmentflag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-rasignature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2)(pkiextendedkeyusage=1.3.6.1.5.2.3.4)(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*)))(mspkicertificate-name-flag:1.2.840.113556.1.4.804:=1))Note: If you get the error The NETBIOS connection with the remote host timed out. please rerun the command.
WARNING! These certificates will still be usable even if the user or computer resets their password!
ESC2 - Misconfigured Certificate Templates
Requirements
Allows requesters to specify a Subject Alternative Name (SAN) in the CSR as well as allows Any Purpose EKU (2.5.29.37.0)
Exploitation
ESC3 - Misconfigured Enrollment Agent Templates
ESC3 is when a certificate template specifies the Certificate Request Agent EKU (Enrollment Agent). This EKU can be used to request certificates on behalf of other users
Exploitation
ESC4 - Access Control Vulnerabilities
Enabling the mspki-certificate-name-flag flag for a template that allows for domain authentication, allow attackers to "push a misconfiguration to a template leading to ESC1 vulnerability
ESC4 is when a user has write privileges over a certificate template. This can for instance be abused to overwrite the configuration of the certificate template to make the template vulnerable to ESC1.
Exploitation
Using Certipy
ESC5 - Vulnerable PKI Object Access Control
The extensive web of interconnected ACL-based relationships, which includes several objects beyond certificate templates and the certificate authority, can impact the security of the entire AD CS system. These objects, which can significantly affect security, encompass:
The security of the PKI system can be compromised if a low-privileged attacker manages to gain control over any of these critical components.
ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2
If this flag is set on the CA, any request (including when the subject is built from Active Directory) can have user defined values in the subject alternative name.
Exploitation
Mitigation
Remove the flag
ESC7 - Vulnerable Certificate Authority Access Control
Exploitation
Alternate Method: Certify and PSPKI
Alternate Method: From ManageCA to RCE on ADCS server
ESC8 - AD CS Relay Attack
An attacker can trigger a Domain Controller using PetitPotam to NTLM relay credentials to a host of choice. The Domain Controller’s NTLM Credentials can then be relayed to the Active Directory Certificate Services (AD CS) Web Enrollment pages, and a DC certificate can be enrolled. This certificate can then be used to request a TGT (Ticket Granting Ticket) and compromise the entire domain through Pass-The-Ticket.
Exploitation
OR
ESC9 - No Security Extension
The new value CT_FLAG_NO_SECURITY_EXTENSION (0x80000) for msPKI-Enrollment-Flag, referred to as ESC9, prevents the embedding of the new szOID_NTDS_CA_SECURITY_EXT security extension in a certificate. This flag becomes relevant when StrongCertificateBindingEnforcement is set to 1 (the default setting), which contrasts with a setting of 2. Its relevance is heightened in scenarios where a weaker certificate mapping for Kerberos or Schannel might be exploited (as in ESC10), given that the absence of ESC9 would not alter the requirements.
Requirements:
Exploitation Scenario
Suppose John@corp.local holds GenericWrite permissions over Jane@corp.local, with the goal to compromise Administrator@corp.local. The ESC9 certificate template, which Jane@corp.local is permitted to enroll in, is configured with the CT_FLAG_NO_SECURITY_EXTENSION flag in its msPKI-Enrollment-Flag setting.
Initially, Jane's hash is acquired using Shadow Credentials, thanks to John's GenericWrite:
Subsequently, Jane's userPrincipalName is modified to Administrator, purposely omitting the @corp.local domain part:
This modification does not violate constraints, given that Administrator@corp.local remains distinct as Administrator's userPrincipalName.
Following this, the ESC9 certificate template, marked vulnerable, is requested as Jane:
It's noted that the certificate's userPrincipalName reflects Administrator, devoid of any “object SID”.
Jane's userPrincipalName is then reverted to her original, Jane@corp.local:
Attempting authentication with the issued certificate now yields the NT hash of Administrator@corp.local. The command must include -domain DOMAIN due to the certificate's lack of domain specification:
ESC10 - Weak Certificate Mappings
Two registry key values on the domain controller are referred to by ESC10:
Cases:
CASE 1
With StrongCertificateBindingEnforcement configured as 0, an account A with GenericWrite permissions can be exploited to compromise any account B.
For instance, having GenericWrite permissions over Jane@corp.local, an attacker aims to compromise Administrator@corp.local. The procedure mirrors ESC9, allowing any certificate template to be utilized.
Initially, Jane's hash is retrieved using Shadow Credentials, exploiting the GenericWrite.
Subsequently, Jane's userPrincipalName is altered to Administrator, deliberately omitting the @corp.local portion to avoid a constraint violation.
Following this, a certificate enabling client authentication is requested as Jane, using the default User template.
Jane's userPrincipalName is then reverted to its original, Jane@corp.local.
Authenticating with the obtained certificate will yield the NT hash of Administrator@corp.local, necessitating the specification of the domain in the command due to the absence of domain details in the certificate.
CASE 2
With the CertificateMappingMethods containing the UPN bit flag (0x4), an account A with GenericWrite permissions can compromise any account B lacking a userPrincipalName property, including machine accounts and the built-in domain administrator Administrator.
Here, the goal is to compromise DC$@corp.local, starting with obtaining Jane's hash through Shadow Credentials, leveraging the GenericWrite.
Jane's userPrincipalName is then set to DC$@corp.local.
A certificate for client authentication is requested as Jane using the default User template.
Jane's userPrincipalName is reverted to its original after this process.
To authenticate via Schannel, Certipy’s -ldap-shell option is utilized, indicating authentication success as u:CORP\DC$.
Through the LDAP shell, commands such as set_rbcd enable Resource-Based Constrained Delegation (RBCD) attacks, potentially compromising the domain controller.
This vulnerability also extends to any user account lacking a userPrincipalName or where it does not match the sAMAccountName, with the default Administrator@corp.local being a prime target due to its elevated LDAP privileges and the absence of a userPrincipalName by default.
ESC11 - Relaying NTLM to ICPR
If CA Server Do not configured with IF_ENFORCEENCRYPTICERTREQUEST, it can be makes NTLM relay attacks without signing via RPC service.
You can use certipy to enumerate if Enforce Encryption for Requests is Disabled and certipy will show ESC11 Vulnerabilities.
Note: For domain controllers, we must specify -template in DomainController.
ESC12 - Shell access to ADCS CA with YubiHSM
Administrators can set up the Certificate Authority to store it on an external device like the "Yubico YubiHSM2".
If USB device connected to the CA server via a USB port, or a USB device server in case of the CA server is a virtual machine, an authentication key (sometimes referred to as a "password") is required for the Key Storage Provider to generate and utilize keys in the YubiHSM.
This key/password is stored in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword in cleartext.
Exploitation
If the CA's private key stored on a physical USB device when you got a shell access, it is possible to recover the key.
ESC13 - OID Group Link Abuse
The msPKI-Certificate-Policy attribute allows the issuance policy to be added to the certificate template. The msPKI-Enterprise-Oid objects that are responsible for issuing policies can be discovered in the Configuration Naming Context (CN=OID,CN=Public Key Services,CN=Services) of the PKI OID container. A policy can be linked to an AD group using this object's msDS-OIDToGroupLink attribute, enabling a system to authorize a user who presents the certificate as though he were a member of the group.
In other words, when a user has permission to enroll a certificate and the certificate is link to an OID group, the user can inherit the privileges of this group.
Use Check-ADCSESC13.ps1 to find OIDToGroupLink: https://github.com/JonasBK/Powershell/blob/master/Check-ADCSESC13.ps1
Exploitation
Find a user permission it can use certipy find or Certify.exe find /showAllPermissions.
If John have have permission to enroll VulnerableTemplate, the user can inherit the privileges of VulnerableGroup group.
All it need to do just specify the template, it will get a certificate with OIDToGroupLink rights.
Last updated