ADCS-005: ESC3 - Abuso de plantilla de agente de inscripción, condición 2
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La condición 2 de ESC3 identifica las plantillas de certificado que aceptan la inscripción en nombre de otros usuarios (requieren la firma de un agente de inscripción) y tienen un EKU de autenticación. Cuando se combina con la condición 1 de ESC3, un atacante que obtenga un certificado de agente de inscripción puede inscribirse para obtener certificados de autenticación en nombre de cualquier usuario, incluidos los Domain Admins
Por qué importa
ESC3 collapses Enrollment Agent capability into Domain Admin in a single chained step. Condition 1 templates (the Enrollment Agent template itself, by default published with low-privileged Enroll rights in many environments) hand the attacker a Certificate Request Agent certificate. Condition 2 templates accept that certificate as a signature on a CMC request whose subject is any user in the forest. The CA, by default, has no Enrollment Agent restrictions configured, which means it will trust any holder of a Certificate Request Agent cert to enroll on behalf of any principal. The resulting certificate is a valid PKINIT client cert for the target, so the attacker uses Rubeus or certipy to perform a Kerberos AS-REQ with PKINIT, retrieve a TGT for the target principal, and immediately use it for DCSync, ticket forging, or interactive logon. Because no password change or interactive logon by the victim is required, this path is silent, persists across credential rotations, and survives MFA on the target account. It is the documented initial-access-to-Tier-0 primitive that drove Microsoft to ship CVE-2022-26923 strong mapping and the StrongCertificateBindingEnforcement registry hardening.
Ruta de ataque
1. Reconnaissance: the attacker runs certipy find -u user@domain -p pass -dc-ip x.x.x.x -vulnerable, or Certify.exe find /vulnerable, which marks templates as ESC3 when both conditions hold. BloodHound CE imports the same data via the Collected -CollectionMethod CertServices path. 2. Obtain an Enrollment Agent certificate (ESC3 Condition 1, see ADCS-004). The default Enrollment Agent template often allows Domain Users to Enroll. The attacker requests it: certipy req -u user@domain -p pass -ca CORP-CA -template EnrollmentAgent. 3. Identify a Condition 2 template that low-privileged users can enroll for. Default candidates include any modified copy of User, SmartcardUser, or custom templates created for smart-card rollout that retained Domain Users Enroll rights and the Enrollment Agent signature requirement. 4. Forge the on-behalf-of request: certipy req -u user@domain -p pass -ca CORP-CA -template SmartcardUser -on-behalf-of CORP\Administrator -pfx user_enrollmentagent.pfx. Certipy builds a CMC request, signs it with the Enrollment Agent cert, and submits it with the Administrator as the subject. The CA, lacking Enrollment Agent restrictions, issues the certificate. 5. Authenticate as the target: certipy auth -pfx administrator.pfx. The tool performs PKINIT, retrieves a TGT for Administrator, and returns the NT hash via the U2U + Kerberos-PA-PK-AS-REP encrypted key extraction path. 6. Privilege escalation and persistence: with the Administrator TGT (or NT hash) the attacker runs DCSync (secretsdump, mimikatz lsadump::dcsync) to pull the krbtgt hash, forges Golden Tickets, and is now persistent across password resets. Because the captured cert is valid for its full lifetime (default 1 year on most user templates), the attacker can re-authenticate without re-exploiting until the certificate expires or is revoked.
Cómo lo evalúa Guerrilla
Guerrilla queries the Configuration partition over LDAP for objectClass=pKICertificateTemplate. For each template returned it reads msPKI-RA-Signature, msPKI-RA-Application-Policies, pKIExtendedKeyUsage, msPKI-Certificate-Application-Policy, msPKI-Enrollment-Flag, msPKI-Certificate-Name-Flag, and the nTSecurityDescriptor. It correlates each vulnerable template against the pKIEnrollmentService objects (CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration) to confirm the template is currently published on a live CA, since an unpublished template is not exploitable. Enroll and AutoEnroll DACL entries are resolved through Translate(NTAccount) and compared against a high-privilege baseline (Domain Admins, Enterprise Admins, Cert Publishers, BUILTIN\Administrators, SYSTEM); any principal outside that baseline holding Enroll on a vulnerable template is flagged. The check does not require local RSAT or the CA to be online: everything is read from the AD Configuration NC, which any authenticated user can read by default. Where the optional CA-side audit is enabled, Guerrilla also calls certutil -getreg CA\EnrollmentAgentRights on each CA host to confirm whether Enrollment Agent restrictions are configured (empty or wildcard equals unrestricted).
Valor recomendado
Plantillas que requieren firmas de agente de inscripción restringidas a usuarios de destino específicos mediante las restricciones de agente de inscripción en la CA
Remediación
Identifique las plantillas que requieren una firma autorizada con la directiva de aplicación Agente de solicitud de certificados y tienen EKU de Autenticación de cliente o Inicio de sesión con tarjeta inteligente. Configure las restricciones de agente de inscripción en la CA para limitar para qué plantillas pueden inscribirse estos agentes y en nombre de qué usuarios. Esto se configura en las propiedades de la CA, en las restricciones de agentes de inscripción.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5(2), CM-6
- ANSSI
- vuln_adcs_esc3
- MITRE ATT&CK
- T1649