ADCS-004: ESC3 - Enrollment Agent Template Abuse Condition 1
- Platform
- Active Directory
- Category
- AD Certificate Services
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check binds to the configuration partition over LDAP and enumerates every pKICertificateTemplate object under CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=<forest root>. For each template object it reads pKIExtendedKeyUsage and msPKI-Certificate-Application-Policy and searches for the Certificate Request Agent OID 1.3.6.1.4.1.311.20.2.1. When the EKU is present, the check parses the nTSecurityDescriptor attribute and inspects every ACE for the Certificate-Enrollment extended right (GUID 0e10c968-78fb-11d2-90d4-00c04f79dc55) and the Certificate-AutoEnrollment extended right (GUID a05b8cc2-17bc-4802-a710-e7c15ab866a2). Any ACE granting either right to a principal outside the default privileged set (Domain Admins, Enterprise Admins, SYSTEM, Cert Publishers, or a dedicated enrollment-agent group) produces a finding. The check then queries every issuing CA (pKIEnrollmentService under CN=Enrollment Services) to determine whether the template is published (certificateTemplates attribute) and whether the CA enforces enrollment-agent restrictions (EnrollmentAgentRights registry value under HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA name>). Templates that are vulnerable but unpublished are reported at lower severity.
Why it matters
The Enrollment Agent role is a delegated trust primitive: a holder can sign a CMC request that names a different subject, and the CA will issue a certificate to that subject without the target user ever authenticating. Microsoft designed this for smart-card enrollment stations, but the role is forest-wide unless restricted at the CA. If a low-privileged user can enroll in a Certificate Request Agent template, that user can mint an Enrollment Agent certificate, then chain it against any authentication template that allows Domain Users to enroll (ESC3 Condition 2) and request a certificate as Administrator, krbtgt, or any Tier 0 account. The resulting certificate is valid for PKINIT, producing a TGT for the impersonated principal. This bypasses the CA Manager approval gate, ignores the Subject is built from this Active Directory information flag, and leaves only a single Certificate Services event 4886 / 4887 entry per issuance. The blast radius is the entire forest: any enrollee who has line of sight to an issuing CA over RPC, DCOM, or the HTTP enrollment endpoint can execute the chain.
Attack path
Step 1: Reconnaissance. The attacker runs Certipy find -u user@domain -p Password -dc-ip <ip> -vulnerable or Guerrilla invoke-adaudit and looks for templates flagged ESC3. The output identifies templates publishing OID 1.3.6.1.4.1.311.20.2.1 with Domain Users or Authenticated Users in the enrollment ACL. Step 2: Enroll the Enrollment Agent certificate. The attacker requests the vulnerable template: certipy req -u user@domain -p Password -ca <CA> -template <EnrollmentAgentTemplate>. The CA issues a certificate whose EKU includes Certificate Request Agent. Step 3: Identify a chainable authentication template (ESC3 Condition 2). Any template with Client Authentication, Smart Card Logon, or Any Purpose EKU that allows Domain Users to enroll is a candidate. The default User template is the canonical example when its ACL has been broadened. Step 4: Request on behalf of a privileged user. The attacker uses the Enrollment Agent certificate to sign a CMC request: certipy req -u user@domain -p Password -ca <CA> -template User -on-behalf-of "domain\administrator" -pfx agent.pfx. The CA validates the agent EKU and issues a certificate whose subject is Administrator. Step 5: Authenticate as the target. certipy auth -pfx administrator.pfx -dc-ip <ip>. The tool performs PKINIT against the KDC and returns a TGT plus the NT hash for Administrator. The attacker now has Domain Admin. Step 6: Persistence. Because the chain produces a certificate rather than a credential, the foothold survives password rotation and persists until the issued certificate expires or is revoked. Rotating the krbtgt password does not revoke an issued client-auth certificate.
How Guerrilla assesses it
Guerrilla performs an authenticated LDAP query against CN=Certificate Templates with the filter (&(objectClass=pKICertificateTemplate)(pKIExtendedKeyUsage=1.3.6.1.4.1.311.20.2.1)). For each match it reads pKIExtendedKeyUsage, msPKI-Certificate-Application-Policy, msPKI-Enrollment-Flag, msPKI-RA-Signature, and nTSecurityDescriptor. The DACL is parsed ACE by ACE: ActiveDirectoryRights is masked against ExtendedRight, GenericAll, GenericWrite, and WriteDacl, and ObjectType is compared to the Certificate-Enrollment and Certificate-AutoEnrollment right GUIDs. Trustees are resolved to SIDs and tested for membership outside Domain Admins, Enterprise Admins, SYSTEM, Cert Publishers, and any organization-defined enrollment-agent group. Templates with msPKI-RA-Signature greater than zero (manager approval) are noted but still reported because RA-Signature does not block the Enrollment Agent role itself. The check also reads each issuing CA host via remote registry to determine whether the EnrollmentAgentRights value is configured to constrain agents to specific templates and target subjects; an unconfigured value (the default) is reported as an aggravating factor. Findings include template displayName, template OID, the EKU list, the offending trustee, the issuing CAs, and whether enrollment-agent restrictions are configured.
Recommended value
Certificate Request Agent templates restricted to authorized enrollment agents only; not enrollable by low-privileged users
Remediation
Identify templates with the Certificate Request Agent EKU that allow enrollment by non-administrative users. Restrict enrollment permissions on these templates to a dedicated Enrollment Agent security group. Configure Enrollment Agent restrictions on the CA to limit which templates and users enrollment agents can enroll for. Monitor Certificate Request Agent certificate issuance.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, IA-5(2), CM-6
- ANSSI
- vuln_adcs_esc3
- MITRE ATT&CK
- T1649