ADCS-006: ESC4 - Vulnerable Certificate Template ACLs
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For each pKICertificateTemplate object under CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=tld the check reads the nTSecurityDescriptor attribute via LDAP and walks every ACE in the DACL. It evaluates: - ActiveDirectoryRights: GenericAll, GenericWrite, WriteDacl, WriteOwner, WriteProperty (especially on msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag, pKIExtendedKeyUsage, msPKI-RA-Signature, msPKI-Certificate-Application-Policy, and nTSecurityDescriptor itself), and AllExtendedRights. - IdentityReference: trustee SID / NTAccount, resolved across the forest. - IsInherited: explicit ACEs are weighted more heavily than inherited ones. - ObjectType / InheritedObjectType GUIDs: a WriteProperty ACE constrained to a non-sensitive attribute is downgraded; a WriteProperty ACE on msPKI-Certificate-Name-Flag is treated as full ESC4. The baseline of expected trustees is Enterprise Admins, Domain Admins, SYSTEM, and any explicitly registered PKI administration group. Authenticated Users, Domain Users, Domain Computers, low-tier helpdesk groups, and individual user or computer accounts holding any of the modification rights above are reported as findings. The check also records whether the template is published on at least one Enterprise CA (pKIEnrollmentService certificateTemplates attribute), because an unpublished template is not directly enrollable and ranks lower in triage.
Por qué importa
A certificate template is a forest-wide object: its ACL controls who can change the security-critical fields that gate the entire ESC1 / ESC2 / ESC3 attack surface. An attacker who can rewrite a template can flip CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT on, add the Client Authentication EKU (1.3.6.1.5.5.7.3.2) to pKIExtendedKeyUsage, set msPKI-RA-Signature to 0, clear msPKI-Enrollment-Flag bits that require manager approval, and grant Enroll to Authenticated Users, all in a few seconds. The next certificate request against that template, with a Subject Alternative Name of administrator@domain, produces a PKINIT-capable certificate that authenticates as a Domain Admin. ESC4 therefore collapses to full domain compromise in one or two LDAP writes and one HTTP or DCOM enrollment, with no patch dependency and no payload on disk. Because the attack lives entirely in the Configuration partition it replicates to every DC in the forest, and because certificates remain valid through password rotation it survives standard incident response. ESC4 is routinely chained by ransomware affiliates and red teams as a low-noise Tier-0 path, and BloodHound has shipped a dedicated edge (ADCSESC4) since 2023 to surface it.
Ruta de ataque
1. Reconnaissance. The attacker runs Certipy find -u user@domain.local -p Pass -dc-ip 10.0.0.1 -vulnerable, or BloodHound with the ADCS collection, and looks for templates where [+] User ACL Principals includes a controlled identity with FullControl, WriteDacl, WriteOwner, or WriteProperty rights. The output line of interest is "[!] Vulnerabilities ESC4 : User has dangerous permissions". 2. Target selection. The attacker picks a published template (returned by an Enterprise CA in pKIEnrollmentService.certificateTemplates) so the rewritten template is immediately enrollable. 3. Template rewrite. Certipy template -u attacker -p Pass -template TargetTemplate -write-default-configuration patches the template object in one operation: - msPKI-Certificate-Name-Flag gains CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x00000001). - pKIExtendedKeyUsage gains 1.3.6.1.5.5.7.3.2 (Client Authentication). - msPKI-RA-Signature is set to 0 (no co-sign required). - msPKI-Enrollment-Flag clears CT_FLAG_PEND_ALL_REQUESTS so manager approval is dropped. - nTSecurityDescriptor is rewritten so Authenticated Users gain Enroll and FullControl. The original configuration is dumped to a JSON file for post-exploitation rollback. 4. Enrollment with SAN injection. The attacker calls certipy req -u attacker -ca CORP-CA -template TargetTemplate -upn administrator@domain.local -sid S-1-5-21-...-500. The Enterprise CA issues a certificate whose Subject Alternative Name is the Domain Administrator UPN. 5. PKINIT authentication. certipy auth -pfx administrator.pfx -dc-ip 10.0.0.1 performs PKINIT pre-authentication against the KDC and returns the NT hash and a TGT for the Domain Administrator account. 6. Cleanup. The attacker restores the original template with certipy template -write-configuration TargetTemplate.json. The audit trail is limited to two LDAP modifies on the template object and one certificate issuance entry on the CA, both of which are routinely under-collected.
Cómo lo evalúa Guerrilla
Guerrilla binds to a writable DC, builds the Configuration NC DN (CN=Configuration,DC=domain,DC=tld), and enumerates child objects of CN=Certificate Templates,CN=Public Key Services,CN=Services with an LDAP filter of (objectClass=pKICertificateTemplate). For each template it retrieves nTSecurityDescriptor with security descriptor control flags set to OWNER + GROUP + DACL, parses the DACL via System.DirectoryServices.ActiveDirectorySecurity, and inspects every ACE. Trustee SIDs are translated through the local DC LookupAccountSid path so foreign-domain principals surface as SID strings rather than being silently dropped. Each ACE is scored: WriteDacl, WriteOwner, GenericAll, and GenericWrite always trigger; WriteProperty triggers only when the ObjectType GUID maps to one of the ESC-relevant attributes (msPKI-Certificate-Name-Flag e48d0154-bcf8-11d1-8702-00c04fb96050, msPKI-Enrollment-Flag d15ef7d8-f226-46db-ae79-b577e2049b13, pKIExtendedKeyUsage 38ec7b6f-6ac1-4216-a230-b9cba3e9bcab, msPKI-RA-Signature fe17e04b-937d-4f7e-8e0e-9292c8d5683e, msPKI-Certificate-Application-Policy dbd90548-aa37-4202-9966-8c537ba5ce32) or the zero GUID (all properties). The check also resolves which Enterprise CAs publish each template by reading certificateTemplates on every pKIEnrollmentService object under CN=Enrollment Services. Findings are emitted with the template DN, trustee, ActiveDirectoryRights, AccessControlType, IsInherited, ObjectType GUID, and the list of publishing CAs.
Valor recomendado
No write permissions on certificate template objects for non-administrative principals
Remediación
Enumerate ACLs on all certificate template objects in CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration. Remove WriteDACL, WriteOwner, WriteProperty, and GenericAll/GenericWrite ACEs for non-administrative principals. Only Enterprise Admins and designated PKI administrators should have write access to template objects. Monitor for ACL changes on certificate template objects.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3, IA-5(2)
- ANSSI
- vuln_adcs_esc4
- MITRE ATT&CK
- T1649, T1222.001