ADCS-006: ESC4 - ACL vulnerables en plantillas de certificado
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
ESC4 se produce cuando los usuarios de bajo privilegio tienen permisos de escritura sobre los objetos de plantilla de certificado en AD, lo que les permite modificar los atributos de la plantilla para crear una condición ESC1, ESC2 o ESC3. Un atacante con acceso de escritura puede añadir CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT, cambiar el EKU, modificar los permisos de inscripción o alterar otros atributos relevantes para la seguridad a fin de habilitar la escalada de privilegios basada en certificados
Por qué importa
A certificate template is a forest-wide object: its ACL controls who can change the security-critical fields that gate the entire ESC1 / ESC2 / ESC3 attack surface. An attacker who can rewrite a template can flip CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT on, add the Client Authentication EKU (1.3.6.1.5.5.7.3.2) to pKIExtendedKeyUsage, set msPKI-RA-Signature to 0, clear msPKI-Enrollment-Flag bits that require manager approval, and grant Enroll to Authenticated Users, all in a few seconds. The next certificate request against that template, with a Subject Alternative Name of administrator@domain, produces a PKINIT-capable certificate that authenticates as a Domain Admin. ESC4 therefore collapses to full domain compromise in one or two LDAP writes and one HTTP or DCOM enrollment, with no patch dependency and no payload on disk. Because the attack lives entirely in the Configuration partition it replicates to every DC in the forest, and because certificates remain valid through password rotation it survives standard incident response. ESC4 is routinely chained by ransomware affiliates and red teams as a low-noise Tier-0 path, and BloodHound has shipped a dedicated edge (ADCSESC4) since 2023 to surface it.
Ruta de ataque
1. Reconnaissance. The attacker runs Certipy find -u user@domain.local -p Pass -dc-ip 10.0.0.1 -vulnerable, or BloodHound with the ADCS collection, and looks for templates where [+] User ACL Principals includes a controlled identity with FullControl, WriteDacl, WriteOwner, or WriteProperty rights. The output line of interest is "[!] Vulnerabilities ESC4 : User has dangerous permissions". 2. Target selection. The attacker picks a published template (returned by an Enterprise CA in pKIEnrollmentService.certificateTemplates) so the rewritten template is immediately enrollable. 3. Template rewrite. Certipy template -u attacker -p Pass -template TargetTemplate -write-default-configuration patches the template object in one operation: - msPKI-Certificate-Name-Flag gains CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x00000001). - pKIExtendedKeyUsage gains 1.3.6.1.5.5.7.3.2 (Client Authentication). - msPKI-RA-Signature is set to 0 (no co-sign required). - msPKI-Enrollment-Flag clears CT_FLAG_PEND_ALL_REQUESTS so manager approval is dropped. - nTSecurityDescriptor is rewritten so Authenticated Users gain Enroll and FullControl. The original configuration is dumped to a JSON file for post-exploitation rollback. 4. Enrollment with SAN injection. The attacker calls certipy req -u attacker -ca CORP-CA -template TargetTemplate -upn administrator@domain.local -sid S-1-5-21-...-500. The Enterprise CA issues a certificate whose Subject Alternative Name is the Domain Administrator UPN. 5. PKINIT authentication. certipy auth -pfx administrator.pfx -dc-ip 10.0.0.1 performs PKINIT pre-authentication against the KDC and returns the NT hash and a TGT for the Domain Administrator account. 6. Cleanup. The attacker restores the original template with certipy template -write-configuration TargetTemplate.json. The audit trail is limited to two LDAP modifies on the template object and one certificate issuance entry on the CA, both of which are routinely under-collected.
Cómo lo evalúa Guerrilla
Guerrilla binds to a writable DC, builds the Configuration NC DN (CN=Configuration,DC=domain,DC=tld), and enumerates child objects of CN=Certificate Templates,CN=Public Key Services,CN=Services with an LDAP filter of (objectClass=pKICertificateTemplate). For each template it retrieves nTSecurityDescriptor with security descriptor control flags set to OWNER + GROUP + DACL, parses the DACL via System.DirectoryServices.ActiveDirectorySecurity, and inspects every ACE. Trustee SIDs are translated through the local DC LookupAccountSid path so foreign-domain principals surface as SID strings rather than being silently dropped. Each ACE is scored: WriteDacl, WriteOwner, GenericAll, and GenericWrite always trigger; WriteProperty triggers only when the ObjectType GUID maps to one of the ESC-relevant attributes (msPKI-Certificate-Name-Flag e48d0154-bcf8-11d1-8702-00c04fb96050, msPKI-Enrollment-Flag d15ef7d8-f226-46db-ae79-b577e2049b13, pKIExtendedKeyUsage 38ec7b6f-6ac1-4216-a230-b9cba3e9bcab, msPKI-RA-Signature fe17e04b-937d-4f7e-8e0e-9292c8d5683e, msPKI-Certificate-Application-Policy dbd90548-aa37-4202-9966-8c537ba5ce32) or the zero GUID (all properties). The check also resolves which Enterprise CAs publish each template by reading certificateTemplates on every pKIEnrollmentService object under CN=Enrollment Services. Findings are emitted with the template DN, trustee, ActiveDirectoryRights, AccessControlType, IsInherited, ObjectType GUID, and the list of publishing CAs.
Valor recomendado
Ningún permiso de escritura sobre los objetos de plantilla de certificado para principales no administrativos
Remediación
Enumere las ACL de todos los objetos de plantilla de certificado en CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration. Elimine las ACE de WriteDACL, WriteOwner, WriteProperty y GenericAll/GenericWrite para los principales no administrativos. Solo Enterprise Admins y los administradores de PKI designados deben tener acceso de escritura a los objetos de plantilla. Supervise los cambios de ACL en los objetos de plantilla de certificado.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3, IA-5(2)
- ANSSI
- vuln_adcs_esc4
- MITRE ATT&CK
- T1649, T1222.001