ADCS-002: ESC1 - El solicitante suministra el nombre alternativo del firmante
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
ESC1 se produce cuando una plantilla de certificado permite al solicitante especificar un nombre alternativo del firmante (SAN) en la solicitud de certificado, tiene un EKU de autenticación de cliente o cualquier EKU que permita la autenticación, y permite la inscripción por parte de usuarios de bajo privilegio. Un atacante puede solicitar un certificado con un SAN para cualquier usuario del dominio, incluidos los Domain Admins, y luego usar el certificado para autenticarse como ese usuario
Por qué importa
ESC1 collapses the gap between any-domain-user and Domain Admin to a single certificate request. The attacker does not need to crack a password, relay NTLM, or compromise a privileged session. They need only LDAP read access to discover the template (which is granted to Authenticated Users by default on the Configuration partition) and the right to enroll, which on a vulnerable template is granted to Domain Users or Authenticated Users. The blast radius is the entire forest if the offending template is published on an Enterprise CA whose certificate chains to an issuer in the NTAuth store, because PKINIT authentication on a domain controller will accept the forged SAN as the requesters identity. The attacker can request one certificate for a Domain Admin and one for the krbtgt account holder (rare but possible) and pivot to Golden Ticket forgery. Issued certificates remain valid for the lifetime configured on the template, typically one or two years, and rotating the victims password does not invalidate them. Revocation requires identifying the rogue certificate, revoking it on the CA, and publishing a new CRL or OCSP response that every relying party fetches, which in practice means defenders often cannot fully evict the attacker without rebuilding the PKI.
Ruta de ataque
1. Discovery: the attacker runs Certipy find -u user@domain.tld -p password -dc-ip 10.0.0.1 -vulnerable, or Invoke-Certify.ps1 from any domain-joined host. Certipy queries the Configuration NC over LDAP, parses every template, and labels ESC1 candidates automatically. SpecterOps Certify (Certify.exe find /vulnerable) produces equivalent output. 2. Target selection: from the ESC1 list, the attacker picks a template published on an Enterprise CA. Common offenders are templates cloned from the built-in User or WebServer templates where an administrator enabled CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT to support a legacy web enrollment workflow. 3. Certificate request: the attacker requests a certificate, supplying a SAN for the targeted principal. With Certipy: certipy req -u user@domain.tld -p password -ca CORP-CA -template VulnTemplate -upn administrator@domain.tld. With Certify: Certify.exe request /ca:dc01.corp.local\CORP-CA /template:VulnTemplate /altname:administrator. The CA returns a PFX containing the private key and a certificate whose Subject Alternative Name is the attackers chosen UPN. 4. Authentication, PKINIT path: the attacker uses the PFX to obtain a TGT for the impersonated account. Certipy auth -pfx administrator.pfx exchanges the certificate for a TGT and dumps the NT hash via the PAC (UnPAC-the-hash) so the attacker now holds both a Kerberos ticket and the NTLM hash of Domain Administrator. 5. Authentication, Schannel path: against an LDAP server that accepts certificate-bound TLS, the attacker can bind as the impersonated principal directly without going through Kerberos, which sidesteps some PKINIT mitigations. 6. Persistence: the certificate is valid until it expires or is revoked. The attacker stores the PFX and reuses it after password resets, after enabling MFA on the account, and across most credential hygiene controls.
Cómo lo evalúa Guerrilla
Guerrilla binds to a Configuration NC LDAP server (typically the forest root DC) and queries (objectClass=pKICertificateTemplate) under CN=Certificate Templates,CN=Public Key Services,CN=Services. For each returned template it pulls msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag, msPKI-RA-Signature, pKIExtendedKeyUsage, pKIExpirationPeriod, and nTSecurityDescriptor. The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT bit test is a bitwise AND against 0x1. EKU evaluation matches the OID list against a known authentication-enabling set. ACL evaluation walks the DACL, resolves the certificate-enrollment extended right by GUID, and filters out the default trusted trustees (Domain Admins, Enterprise Admins, Cert Publishers, SYSTEM, BUILTIN\Administrators). The check then cross-references the template name against the certificateTemplates attribute of every CN=*,CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=tld pKIEnrollmentService object, so an ESC1 template that is not published anywhere is reported with reduced severity (Medium) while a published one is reported Critical. No code is executed on the CA host. The detection works without RSAT and without CA admin rights.
Valor recomendado
Ninguna plantilla de certificado con CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT que permita la inscripción de bajo privilegio y tenga EKU de autenticación
Remediación
Identifique las plantillas donde msPKI-Certificate-Name-Flag incluye CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x1), la plantilla tiene EKU de Autenticación de cliente o Inicio de sesión con tarjeta inteligente, y la inscripción está permitida para usuarios no administradores. Elimine el indicador CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT, restrinja los permisos de inscripción a grupos privilegiados o elimine el EKU de autenticación. Si la especificación del SAN es operativamente necesaria, implemente la aprobación del administrador de la CA.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5(2), CM-6
- ANSSI
- vuln_adcs_esc1
- MITRE ATT&CK
- T1649, T1556