ADCS-002: ESC1 - Enrollee Supplies Subject Alternative Name
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla enumerates every pKICertificateTemplate object in CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=tld and evaluates four conditions on each template: 1. msPKI-Certificate-Name-Flag has bit CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x00000001) set. This is the flag that lets the requester populate Subject and SAN values directly in the CSR instead of having the CA build them from AD. 2. The template carries an EKU usable for client authentication. The pKIExtendedKeyUsage attribute contains one of: Client Authentication (1.3.6.1.5.5.7.3.2), Smart Card Logon (1.3.6.1.4.1.311.20.2.2), PKINIT Client Authentication (1.3.6.1.5.2.3.4), or the Any Purpose OID (2.5.29.37.0), or the template has no EKU at all (which is equivalent to Any Purpose). 3. msPKI-RA-Signature equals 0 (no enrollment agent countersignature required) and msPKI-Enrollment-Flag does not have CT_FLAG_PEND_ALL_REQUESTS (0x00000002) set, meaning the CA does not require CA manager approval before issuance. 4. The DACL on the template grants Enroll or AutoEnroll to a principal that is not a member of the protected Tier-0 set. The check walks nTSecurityDescriptor and resolves the certificate-enrollment extended right GUID 0e10c968-78fb-11d2-90d4-00c04f79dc55 and the autoenrollment GUID a05b8cc2-17bc-4802-a710-e7c15ab866a2. A template that satisfies all four conditions is reported as ESC1. The check also reports which published CA hosts the template (the certificateTemplates attribute on the pKIEnrollmentService object under CN=Enrollment Services), because an unpublished template cannot be requested.
Por qué importa
ESC1 collapses the gap between any-domain-user and Domain Admin to a single certificate request. The attacker does not need to crack a password, relay NTLM, or compromise a privileged session. They need only LDAP read access to discover the template (which is granted to Authenticated Users by default on the Configuration partition) and the right to enroll, which on a vulnerable template is granted to Domain Users or Authenticated Users. The blast radius is the entire forest if the offending template is published on an Enterprise CA whose certificate chains to an issuer in the NTAuth store, because PKINIT authentication on a domain controller will accept the forged SAN as the requesters identity. The attacker can request one certificate for a Domain Admin and one for the krbtgt account holder (rare but possible) and pivot to Golden Ticket forgery. Issued certificates remain valid for the lifetime configured on the template, typically one or two years, and rotating the victims password does not invalidate them. Revocation requires identifying the rogue certificate, revoking it on the CA, and publishing a new CRL or OCSP response that every relying party fetches, which in practice means defenders often cannot fully evict the attacker without rebuilding the PKI.
Ruta de ataque
1. Discovery: the attacker runs Certipy find -u user@domain.tld -p password -dc-ip 10.0.0.1 -vulnerable, or Invoke-Certify.ps1 from any domain-joined host. Certipy queries the Configuration NC over LDAP, parses every template, and labels ESC1 candidates automatically. SpecterOps Certify (Certify.exe find /vulnerable) produces equivalent output. 2. Target selection: from the ESC1 list, the attacker picks a template published on an Enterprise CA. Common offenders are templates cloned from the built-in User or WebServer templates where an administrator enabled CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT to support a legacy web enrollment workflow. 3. Certificate request: the attacker requests a certificate, supplying a SAN for the targeted principal. With Certipy: certipy req -u user@domain.tld -p password -ca CORP-CA -template VulnTemplate -upn administrator@domain.tld. With Certify: Certify.exe request /ca:dc01.corp.local\CORP-CA /template:VulnTemplate /altname:administrator. The CA returns a PFX containing the private key and a certificate whose Subject Alternative Name is the attackers chosen UPN. 4. Authentication, PKINIT path: the attacker uses the PFX to obtain a TGT for the impersonated account. Certipy auth -pfx administrator.pfx exchanges the certificate for a TGT and dumps the NT hash via the PAC (UnPAC-the-hash) so the attacker now holds both a Kerberos ticket and the NTLM hash of Domain Administrator. 5. Authentication, Schannel path: against an LDAP server that accepts certificate-bound TLS, the attacker can bind as the impersonated principal directly without going through Kerberos, which sidesteps some PKINIT mitigations. 6. Persistence: the certificate is valid until it expires or is revoked. The attacker stores the PFX and reuses it after password resets, after enabling MFA on the account, and across most credential hygiene controls.
Cómo lo evalúa Guerrilla
Guerrilla binds to a Configuration NC LDAP server (typically the forest root DC) and queries (objectClass=pKICertificateTemplate) under CN=Certificate Templates,CN=Public Key Services,CN=Services. For each returned template it pulls msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag, msPKI-RA-Signature, pKIExtendedKeyUsage, pKIExpirationPeriod, and nTSecurityDescriptor. The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT bit test is a bitwise AND against 0x1. EKU evaluation matches the OID list against a known authentication-enabling set. ACL evaluation walks the DACL, resolves the certificate-enrollment extended right by GUID, and filters out the default trusted trustees (Domain Admins, Enterprise Admins, Cert Publishers, SYSTEM, BUILTIN\Administrators). The check then cross-references the template name against the certificateTemplates attribute of every CN=*,CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=tld pKIEnrollmentService object, so an ESC1 template that is not published anywhere is reported with reduced severity (Medium) while a published one is reported Critical. No code is executed on the CA host. The detection works without RSAT and without CA admin rights.
Valor recomendado
No certificate templates with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT that allow low-privileged enrollment and have authentication EKUs
Remediación
Identify templates where msPKI-Certificate-Name-Flag includes CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x1), the template has Client Authentication or Smart Card Logon EKU, and enrollment is permitted for non-admin users. Remove the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag, restrict enrollment permissions to privileged groups, or remove the authentication EKU. If SAN specification is operationally required, implement CA Manager approval.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5(2), CM-6
- ANSSI
- vuln_adcs_esc1
- MITRE ATT&CK
- T1649, T1556