ADCS-001: Inventario de servidores de CA
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Info
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Un inventario de todos los servidores de entidad de certificación del entorno proporciona la base para la evaluación de seguridad de AD CS. Incluye las CA empresariales, las CA independientes, sus roles (raíz frente a subordinada), las versiones del sistema operativo y las plantillas de certificado publicadas. Comprender la jerarquía de la PKI es esencial para identificar la superficie de ataque
Por qué importa
Every published ADCS attack surface (ESC1 SAN spoofing, ESC2 Any Purpose EKU, ESC3 enrollment agent, ESC4 template ACL, ESC5 PKI object ACL, ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2, ESC7 CA role abuse, ESC8 HTTP enrollment relay, ESC9 no security extension, ESC10 weak certificate mapping, ESC11 RPC encryption, ESC13 OID group link, ESC14 explicit mapping, ESC15 schema v1, ESC16 security extension disabled) requires the attacker to know which CA to target. Defenders need the same inventory in reverse: an undocumented CA is a candidate for a rogue CA implant (NTAuthCertificates write turns any attacker key into a forest-trusted issuer), and a CA running an unsupported OS (Windows Server 2012 R2 and earlier reached end-of-support) cannot receive patches for ADCS RCE and elevation-of-privilege fixes. A complete inventory is also a prerequisite for tier-0 scoping: every Enterprise CA is by definition Tier-0 because compromise of certsvc yields the ability to mint authentication certificates for any principal in the forest.
Ruta de ataque
1. Enumeration: an attacker with any authenticated user context queries the Enrollment Services container with certipy find -u user@domain -p pass -dc-ip 10.0.0.1, Certify.exe find, or LDAP (Get-ADObject -SearchBase "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=tld" -Filter *). The container is readable by Authenticated Users by default. 2. Triage: the attacker pivots from the CA list to per-CA enumeration: certipy find dumps each CAs flags, web enrollment endpoints, and the published template ACLs in one pass. 3. Target selection: the attacker picks the CA that publishes the most permissive template (ESC1 to ESC16) or the CA with EDITF_ATTRIBUTESUBJECTALTNAME2 set (ESC6, single-flag domain takeover). 4. Exploitation: certipy req issues a certificate against the chosen CA and template. Depending on the misconfiguration the resulting certificate authenticates as Domain Admin, a Domain Controller, or any chosen principal. 5. Persistence: with a Domain Admin authentication certificate, the attacker can re-authenticate via PKINIT indefinitely. The certificate survives password resets because it is bound to the public key, not the password. The inventory step is fast and noisy on the network but quiet on the host. Defenders who do not monitor LDAP reads of the Configuration NC will not see step 1.
Cómo lo evalúa Guerrilla
Guerrilla calls Get-ADObject -SearchBase (Get-ADRootDSE).configurationNamingContext -LDAPFilter "(objectClass=pKIEnrollmentService)" -Properties name, dNSHostName, distinguishedName, flags, certificateTemplates, cACertificate. The result is parsed in memory: certificateTemplates is a multi-valued string array of template CN values; flags is decoded against the pKIEnrollmentService flag enum (the EDITF_ATTRIBUTESUBJECTALTNAME2 bit 0x00040000 surfaces here for cross-reference by ADCS-007 / ESC6). For each CA the check resolves the dNSHostName to an FQDN, optionally queries the host for OS version via Get-ADComputer when the AD object is reachable, and counts published templates. The finding always reports PASS at this stage; downstream ADCS-002 through ADCS-019 walk the same inventory to flag specific ESC conditions.
Valor recomendado
Inventario completo de CA documentado con el tipo de CA, el rol, la versión del sistema operativo y las plantillas publicadas para cada servidor de CA
Remediación
Enumere todos los servidores de CA consultando el contenedor de servicios de inscripción de la PKI en AD (CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration). Documente el tipo de cada CA (empresarial/independiente), el rol (raíz/subordinada), el nombre de host, la versión del sistema operativo y las plantillas de certificado publicadas. Verifique que todos los servidores de CA ejecutan versiones de sistema operativo compatibles y disponen de las actualizaciones vigentes.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-8, CM-8(1), IA-5(2)
- MITRE ATT&CK
- T1649