AD CS

ko-fi

PKI ?

nxc ldap <ip> -u user -p pass -M adcs
LogoExploit ESC8 (ADCS) | NetExecwww.netexec.wiki

Or run PingCastle or Certify

ESC

LogoActive Directory Certificate Services (AD CS) - A Beautifully Vulnerable and Mis-configurable MessLogan Goins
Escalation
Definition

ESC1

Enrolee can request cert for ANY user

ESC2

Any purpose or no EKU (potentially dangerous)

ESC3

Request an enrollement agent certificate and use it to request cert on behalf of ANY user

ESC4

Overly permissive ACLs on templates

ESC5

Poor access control on CA server, CA server computer object, etc.

ESC6

EDITF_ATTRIBUTESUBJECTNAME2 setting on CA - Request certs for ANY user

ESC7

Poor access control on roles on CA authority like "CA Administrator" and "Certificate Manager"

ESC8

NTLM relay to HTTP enrollement endpoints

NXC

Vulnerable Template

Masky

If you have admin privilege, the module will impersonate all users connected -> ask a certificate (ADCS) -> retrieve the NT hash using PKINIT

Source: https://x.com/mpgn_x64/status/1584863925744521216

Tools

Locksmith

LogoGitHub - jakehildreth/Locksmith: A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.GitHub

Certify

LogoGitHub - GhostPack/Certify: Active Directory certificate abuse.GitHub
https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/refs/heads/master/Certify.exegithub.com
LogoADCS Attacks with Certipyserioton

Enumeration

AD CS in the target forest

Templates

Vulnerable templates

Certi

LogoGitHub - zer1t0/certi: ADCS abuserGitHub

Certipy

LogoGitHub - ly4k/Certipy: Tool for Active Directory Certificate Services enumeration and abuseGitHub
LogoThe Future of Certipy and the Release of v5 & ESC16 · ly4k Certipy · Discussion #270GitHub

Vulnerable template

PSPKIAudit

Only ESC1 to ESC8

LogoGitHub - GhostPack/PSPKIAudit: PowerShell toolkit for AD CS auditing based on the PSPKI toolkit.GitHub

Metasploit

LogoAttacking AD CS ESC Vulnerabilities Using MetasploitMetasploit Documentation Penetration Testing Software, Pen Testing Security

ADCSKiller

LogoGitHub - grimlockx/ADCSKiller: An ADCS Exploitation Automation Tool Weaponizing Certipy and CoercerGitHub

Practice and explanation

LogoGitHub - arth0sz/Practice-AD-CS-Domain-Escalation: Introductory guide on the configuration and subsequent exploitation of Active Directory Certificate Services with Certipy. Based on the white paper Certified Pre-Owned.GitHub
LogoGOAD - part 6 - ADCSMayfly

ESC1

This attack consists of adding an arbitrary subject to a certificate.

LogoAbusing Active Directory Certificate Services (Part 1) - Black Hills Information Security, Inc.Black Hills Information Security, Inc.
LogoPenetration Testing & Cybersecurity Experts | RBT SecurityRBT Security | Reinventing The Security

"VulnTemplate" has ENROLLEE_SUPPLIES_SUBJECT value for msPKI-Certificates-Name-Flag

"VulnTemplate" allows enrollment to RDPUsers group.

  1. Request a certificate for DA (or EA) as a user1 (member of RDP group)

  1. Convert cert.pem to pfx and use it to request a TGT for DA (or EA)

Linux - Certipy

If Got error while trying to request certificate: code: 0x80094811 - CERTSRV_E_KEY_LENGTH - The public key does not meet the minimum size required by the specified certificate template, Go back to the certipy find result and get the RSA Key Length. Append it to the command: -key-size

Logovulnlab-retroPuckieStyle

Kerberos error : « Object SID mismatch between certificate and user »

To fix this, you can specify an alternative subject SID using the -SID option.

ESC2

LogoAbusing Active Directory Certificate Services (Part 4) - Black Hills Information Security, Inc.Black Hills Information Security, Inc.

Find vulnerable templates

Exploit

ESC3

Request an enrollement agent certificate and use it to request cert on behalf of ANY user

LogoActive Directory Certificate Services (ADCS – ESC3) | RBT SecurityRBT Security | Reinventing The Security
LogoAbusing Active Directory Certificate Services (Part 4) - Black Hills Information Security, Inc.Black Hills Information Security, Inc.

"VulnTemplateEnrollement-Agent" allows Domain users to enroll and has 'Certificate Request Agent' EKU

"VulnTemplateEnrollement-Users" has an Application Policy Issuance Requirement of Certificate Request Agent and has an EKU that allows for domain authentication

Escalation to DA

child.parent.local: child domain

parent.local: parent domain

  1. Request a certif for Certificate Request Agent from "VulnTemplateEnrollement-Agent" template

  1. Convert cert.pem to pfx and use it to request a cert on behalf on DA using "VulnTemplateEnrollement-Users"

  1. Convert from cert.pem to pfx, request DA TGT and inject it

Escalation to EA

  1. Request a certif for Certificate Request Agent from "VulnTemplateEnrollement-Agent" template - see Escalation to DA

  2. Convert cert.pem to pfx and use it to request a cert on behalf on EA using "VulnTemplateEnrollement-Users

  1. Request EA TGT and inject it

ESC4

LogoAbusing Active Directory Certificate Services (Part 2) - Black Hills Information Security, Inc.Black Hills Information Security, Inc.

Clean up

ESC6

EDITF_ATTRIBUTESUBJECTNAME2 setting on CA - Request certs for ANY user from a template that allow enrollment to low-priv user

LogoActive Directory Certificate Attack (ADCS – ESC6) | RBT SecurityRBT Security | Reinventing The Security

"Vuln-Integration" grants enrollment to RDPUsers group.

  1. Request a certificate for DA (or EA) as a user1 (member of RDP group)

  1. Convert cert.pem to pfx and use it to request a TGT for DA (or EA)

ESC8 - PetitPotam

LogoAbusing Active Directory Certificate Services (Part 3) - Black Hills Information Security, Inc.Black Hills Information Security, Inc.

NTLM relay to HTTP enrollement endpoints

LogoRelease PetitPotato · wh0amitz/PetitPotatoGitHub
LogoDomain Escalation: PetitPotam NTLM Relay to ADCS EndpointsHacking Articles
Windows Exploit

ESC9

LogoCertificate templates | The Hacker Recipeswww.thehacker.recipes
https://adminions.ca/books/abusing-active-directory-certificate-services/page/esc9adminions.ca

Certifried - CVE-2022-26923

LogoExploiting Certifried (CVE-2022-26923) | CravateRouge LtdCravateRouge Ltd
LogoCertifried: Active Directory Domain Privilege Escalation (CVE-2022–26923)Medium

ADCSCoercePotato

LogoGitHub - decoder-it/ADCSCoercePotatoGitHub
LogoHello: I’m your ADCS server and I want to authenticate against youDecoder's Blog

On the attacker system:

On a domain-joined system:

Relay with ntlmrelayx.py to the ADCS Web enrollment Endpoint:

Logor-tec Blog | Windows is and always will be a Potatolandwww.r-tec.net

RemoteKrbRelay

LogoGitHub - CICADA8-Research/RemoteKrbRelay: Remote Kerberos Relay made easy! Advanced Kerberos Relay FrameworkGitHub

CertPotato

LogoSensePost | Certpotato – using adcs to privesc from virtual and network service accounts to local systemsensepost.com

KrbRelay-SMBServer

LogoGitHub - decoder-it/KrbRelay-SMBServerGitHub
Network Attacks

ESC14

LogoGitHub - logangoins/Stifle: .NET Post-Exploitation Utility for Abusing Strong Explicit Certificate Mappings in ADCSGitHub

ADCS ESC15 (EKUwu) - CVE-2024-49019

The TrustedSec team tested the CVE-2024-49019 vulnerability across multiple clients, finding that 10 out of 15 environments were at risk

LogoZero-Day in Active Directory Certificate Services: Researcher Exposes CVE-2024-49019 with PoCDaily CyberSecurity

Detection: Bloodhound query

Credit: @SpecterOps

Exploitation

LogoEKUwu: Not just another AD CS ESCTrustedSec
LogoCurious case of AD CS ESC15 vulnerable instance and its manual exploitationwww.mannulinux.org

From Child to Forest

LogoGitHub - MWR-CyberSec/AD-CS-Forest-Exploiter: Exploit AD CS misconfiguration allowing privilege escalation and persistence from any child domain to full forest compromiseGitHub

Relay Attack on WinReg RPC Client

LogoCall and Register — Relay Attack on WinReg RPC Client | AkamaiAkamai
Logoakamai-security-research/PoCs/cve-2024-43532 at main · akamai/akamai-security-researchGitHub

Remediation

LogoDefending Your Directory: An Expert Guide to Fortifying Active Directory Certificate Services (ADCS) Against Exploitationwww.nccgroup.com
LogoGitHub - Sleepw4lker/TameMyCerts: Policy Module for Microsoft Active Directory Certificate ServicesGitHub
LogoSecuring AD CS: Microsoft Defender for Identity's Sensor Unveiled | Microsoft Community HubTECHCOMMUNITY.MICROSOFT.COM

The following security controls should be implemented to mitigate an ESC1 AD CS compromise:

  • Remove the Enrolee Supplies Subject flag. Do not allow users to provide their own SAN in the certificate signing request for templates configured for client authentication. Templates configured with the Enrolee Supplies Subject flag allow a user to provide their own SAN.

  • Restrict standard user object permissions on certificate templates. Standard user objects should not have write permissions on certificate templates. User objects with write permissions may be able to change enrolment permissions or configure additional settings to make the certificate template vulnerable.

  • Remove vulnerable AD CS CA configurations. Ensure that the CA is not configured with the EDITF_ATTRIBUTESUBJECTALTNAME2 flag. When configured, this allows a SAN to be provided on any certificate template.

  • Require CA Certificate Manager approval for certificate templates that allow the SAN to be supplied. This ensures certificate templates that require CA certificate manager approval are not issued automatically when requested; instead, they must be approved using certificate manager before the certificate is issued.

  • Remove EKUs that enable user authentication. This prevents malicious actors from exploiting the certificate to authenticate as other users.

  • Limit access to AD CS CA servers to only privileged users that require access. This may be a smaller subset of privileged users than the Domain Admins security group and reduces the number of opportunities for malicious actors to gain access to CA servers.

  • Restrict privileged access pathways to AD CS CA servers to jump servers and secure admin workstations using only the ports and services that are required for administration. AD CS servers are classified as ‘Tier 0’ assets within Microsoft’s ‘Enterprise Access Model’.

  • Only use AD CS CA servers for AD CS and do not install any non-security-related services or applications. This reduces the attack surface of AD CS CA servers as there are fewer services, ports and applications that may be vulnerable and used to compromise an AD CS CA server.

  • Encrypt and securely store backups of AD CS CA servers and limit access to only Backup Administrators. Backups of AD CS CA servers need to be afforded the same security as the actual AD CS CA servers. Malicious actors may target backup systems to gain access to critical and sensitive computer objects, such as AD CS CA servers.

  • Centrally log and analyse AD CS CA server logs in a timely manner to identify malicious activity. If malicious actors gain privileged access to a CA server, this activity should be identified as soon as possible to respond and limit the impact.

https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/detecting-and-mitigating-active-directory-compromises?s=03

Detection

ADCS Honeypot

Detection
LogoGitHub - srlabs/Certiception: An ADCS honeypot to catch attackers in your internal network.GitHub

Resources

LogoCertified Pre-Owned - SpecterOpsSpecterOps
PreviousLSASS secretsNextDPAPI

Last updated