ADCS-004: ESC3 - Abuso de plantilla de agente de inscripción, condición 1
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La condición 1 de ESC3 identifica las plantillas de certificado que tienen el EKU Agente de solicitud de certificados (OID 1.3.6.1.4.1.311.20.2.1) y permiten la inscripción por parte de usuarios de bajo privilegio. Un certificado de agente de inscripción permite a su titular inscribirse en otras plantillas en nombre de cualquier usuario, incluidas potencialmente plantillas con EKU de autenticación que normalmente requieren la aprobación del administrador de la CA
Por qué importa
The Enrollment Agent role is a delegated trust primitive: a holder can sign a CMC request that names a different subject, and the CA will issue a certificate to that subject without the target user ever authenticating. Microsoft designed this for smart-card enrollment stations, but the role is forest-wide unless restricted at the CA. If a low-privileged user can enroll in a Certificate Request Agent template, that user can mint an Enrollment Agent certificate, then chain it against any authentication template that allows Domain Users to enroll (ESC3 Condition 2) and request a certificate as Administrator, krbtgt, or any Tier 0 account. The resulting certificate is valid for PKINIT, producing a TGT for the impersonated principal. This bypasses the CA Manager approval gate, ignores the Subject is built from this Active Directory information flag, and leaves only a single Certificate Services event 4886 / 4887 entry per issuance. The blast radius is the entire forest: any enrollee who has line of sight to an issuing CA over RPC, DCOM, or the HTTP enrollment endpoint can execute the chain.
Ruta de ataque
Step 1: Reconnaissance. The attacker runs Certipy find -u user@domain -p Password -dc-ip <ip> -vulnerable or Guerrilla invoke-adaudit and looks for templates flagged ESC3. The output identifies templates publishing OID 1.3.6.1.4.1.311.20.2.1 with Domain Users or Authenticated Users in the enrollment ACL. Step 2: Enroll the Enrollment Agent certificate. The attacker requests the vulnerable template: certipy req -u user@domain -p Password -ca <CA> -template <EnrollmentAgentTemplate>. The CA issues a certificate whose EKU includes Certificate Request Agent. Step 3: Identify a chainable authentication template (ESC3 Condition 2). Any template with Client Authentication, Smart Card Logon, or Any Purpose EKU that allows Domain Users to enroll is a candidate. The default User template is the canonical example when its ACL has been broadened. Step 4: Request on behalf of a privileged user. The attacker uses the Enrollment Agent certificate to sign a CMC request: certipy req -u user@domain -p Password -ca <CA> -template User -on-behalf-of "domain\administrator" -pfx agent.pfx. The CA validates the agent EKU and issues a certificate whose subject is Administrator. Step 5: Authenticate as the target. certipy auth -pfx administrator.pfx -dc-ip <ip>. The tool performs PKINIT against the KDC and returns a TGT plus the NT hash for Administrator. The attacker now has Domain Admin. Step 6: Persistence. Because the chain produces a certificate rather than a credential, the foothold survives password rotation and persists until the issued certificate expires or is revoked. Rotating the krbtgt password does not revoke an issued client-auth certificate.
Cómo lo evalúa Guerrilla
Guerrilla performs an authenticated LDAP query against CN=Certificate Templates with the filter (&(objectClass=pKICertificateTemplate)(pKIExtendedKeyUsage=1.3.6.1.4.1.311.20.2.1)). For each match it reads pKIExtendedKeyUsage, msPKI-Certificate-Application-Policy, msPKI-Enrollment-Flag, msPKI-RA-Signature, and nTSecurityDescriptor. The DACL is parsed ACE by ACE: ActiveDirectoryRights is masked against ExtendedRight, GenericAll, GenericWrite, and WriteDacl, and ObjectType is compared to the Certificate-Enrollment and Certificate-AutoEnrollment right GUIDs. Trustees are resolved to SIDs and tested for membership outside Domain Admins, Enterprise Admins, SYSTEM, Cert Publishers, and any organization-defined enrollment-agent group. Templates with msPKI-RA-Signature greater than zero (manager approval) are noted but still reported because RA-Signature does not block the Enrollment Agent role itself. The check also reads each issuing CA host via remote registry to determine whether the EnrollmentAgentRights value is configured to constrain agents to specific templates and target subjects; an unconfigured value (the default) is reported as an aggravating factor. Findings include template displayName, template OID, the EKU list, the offending trustee, the issuing CAs, and whether enrollment-agent restrictions are configured.
Valor recomendado
Plantillas de Agente de solicitud de certificados restringidas únicamente a los agentes de inscripción autorizados; no inscribibles por usuarios de bajo privilegio
Remediación
Identifique las plantillas con el EKU Agente de solicitud de certificados que permiten la inscripción por parte de usuarios no administrativos. Restrinja los permisos de inscripción de estas plantillas a un grupo de seguridad dedicado de agentes de inscripción. Configure las restricciones de agente de inscripción en la CA para limitar para qué plantillas y usuarios pueden inscribirse los agentes. Supervise la emisión de certificados de Agente de solicitud de certificados.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5(2), CM-6
- ANSSI
- vuln_adcs_esc3
- MITRE ATT&CK
- T1649