ADCS-007: ESC4 - Propiedad vulnerable de plantilla de certificado
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Si un objeto de plantilla de certificado es propiedad de un principal no administrativo, dicho principal puede modificar la DACL de la plantilla para concederse acceso de escritura y luego modificar la plantilla para crear condiciones explotables. La propiedad de la plantilla debe restringirse a Enterprise Admins o al grupo de administración de PKI del dominio
Por qué importa
In Active Directory, the Owner of an object can modify its DACL at any time via the implicit WriteDacl + WriteOwner rights granted to owners. That means template ownership is functionally equivalent to GenericAll on the template. A non-admin owner can, in a single session, add an Allow-FullControl ACE for themselves, flip the template to mark CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT, add the Client Authentication EKU, lower the enrollment requirement so that Authenticated Users or a low-privileged group can enroll, and remove the manager-approval flag. The template is now an ESC1 primitive: the attacker requests a certificate, supplies an arbitrary Subject Alternative Name such as the UPN of a Domain Admin, and uses the resulting certificate to obtain a Kerberos TGT for that account via PKINIT. Because the rogue template is published forest-wide through the Configuration NC, the primitive works against every domain in the forest, not just the domain where the attacker started. Ownership drift on a single template is therefore a forest-takeover primitive that survives password resets of the compromised principal.
Ruta de ataque
1. Discovery: the attacker runs certipy find -u user@corp.local -p Pass -dc-ip 10.0.0.10 -vulnerable, or Certify.exe find /vulnerable, which enumerates every template, resolves the Owner SID, and reports ESC4 candidates where the current principal owns a template. 2. ACL pivot: with ownership, the attacker grants themselves FullControl on the template object: certipy template -u user@corp.local -p Pass -template VulnTemplate -save-old (Certipy serializes the original config so it can restore it later). 3. Template weaponization: certipy template -template VulnTemplate -write-default-configuration. This rewrites the template to a known ESC1 shape: msPKI-Certificate-Name-Flag includes CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x1), msPKI-Enrollment-Flag clears CT_FLAG_PEND_ALL_REQUESTS, pKIExtendedKeyUsage includes 1.3.6.1.5.5.7.3.2 (Client Authentication), and the template DACL grants Enroll to Authenticated Users. 4. Enrollment: certipy req -u user@corp.local -p Pass -ca CORP-CA -template VulnTemplate -upn administrator@corp.local. The CA issues a certificate whose SAN claims administrator@corp.local. 5. Authentication: certipy auth -pfx administrator.pfx -domain corp.local. The attacker performs PKINIT, receives a TGT for administrator, and dumps the NTLM hash from the PAC (PKINIT returns the NT hash in the PAC_CREDENTIAL_INFO buffer on patched DCs that did not receive the May 2022 / KB5014754 hardening configuration). 6. Persistence and cleanup: certipy template -template VulnTemplate -configuration old-config.json restores the original template definition so a casual diff against a baseline shows no change. The attacker retains the issued certificate, which remains valid for the template lifetime (typically one year) regardless of the password the targeted account uses.
Cómo lo evalúa Guerrilla
Guerrilla binds to the forest RootDSE, resolves the configurationNamingContext, and enumerates pKICertificateTemplate objects under CN=Certificate Templates,CN=Public Key Services,CN=Services,<configNC>. For each template it requests the nTSecurityDescriptor with the OWNER_SECURITY_INFORMATION control bit set, then reads the OwnerSid from the resulting RawSecurityDescriptor. The SID is translated to an NTAccount via the local DC, and templates whose owner is not in the Tier 0 allowlist are reported. The check also walks the DACL for any ACE granting WriteDacl, WriteOwner, WriteProperty, or GenericAll / GenericWrite to non-Tier 0 principals (the ACL surface of ESC4 is broader than ownership alone), and cross-references the template name against the certificateTemplates multi-valued attribute on each CN=<CA>,CN=Enrollment Services,CN=Public Key Services,CN=Services,<configNC> object so the report indicates whether the template is currently published.
Valor recomendado
Todos los objetos de plantilla de certificado propiedad de Enterprise Admins o de los administradores de PKI designados
Remediación
Compruebe el campo Propietario de cada objeto de plantilla de certificado en CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration. Transfiera la propiedad de cualquier plantilla con propietario incorrecto a Enterprise Admins con Set-Acl o la pestaña Seguridad en adsiedit.msc. Investigue cómo las cuentas no administrativas llegaron a ser propietarias para evitar que se repita.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3
- ANSSI
- vuln_adcs_esc4
- MITRE ATT&CK
- T1649, T1222.001