ADCS-007: ESC4 - Vulnerable Certificate Template Ownership
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For every pKICertificateTemplate object under CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=forestRoot, the check reads the nTSecurityDescriptor attribute via LDAP and inspects the Owner field of the security descriptor. The Owner is resolved to an NTAccount and compared against an allowlist of accepted Tier 0 / PKI principals: - Enterprise Admins (S-1-5-21-<forestRoot>-519) - Domain Admins of the forest root (S-1-5-21-<forestRoot>-512) - BUILTIN\Administrators (S-1-5-32-544) - SYSTEM (S-1-5-18) - A configurable PKI administration group passed via -PkiAdminGroup Any template whose Owner SID falls outside that set is reported as a finding. The check also captures the OID, displayName, msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag, pKIExtendedKeyUsage, and the list of CAs that currently publish the template (read from the certificateTemplates attribute on each CN=<CA>,CN=Enrollment Services object) so triage can assess whether the template is published and therefore live-exploitable.
Por qué importa
In Active Directory, the Owner of an object can modify its DACL at any time via the implicit WriteDacl + WriteOwner rights granted to owners. That means template ownership is functionally equivalent to GenericAll on the template. A non-admin owner can, in a single session, add an Allow-FullControl ACE for themselves, flip the template to mark CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT, add the Client Authentication EKU, lower the enrollment requirement so that Authenticated Users or a low-privileged group can enroll, and remove the manager-approval flag. The template is now an ESC1 primitive: the attacker requests a certificate, supplies an arbitrary Subject Alternative Name such as the UPN of a Domain Admin, and uses the resulting certificate to obtain a Kerberos TGT for that account via PKINIT. Because the rogue template is published forest-wide through the Configuration NC, the primitive works against every domain in the forest, not just the domain where the attacker started. Ownership drift on a single template is therefore a forest-takeover primitive that survives password resets of the compromised principal.
Ruta de ataque
1. Discovery: the attacker runs certipy find -u user@corp.local -p Pass -dc-ip 10.0.0.10 -vulnerable, or Certify.exe find /vulnerable, which enumerates every template, resolves the Owner SID, and reports ESC4 candidates where the current principal owns a template. 2. ACL pivot: with ownership, the attacker grants themselves FullControl on the template object: certipy template -u user@corp.local -p Pass -template VulnTemplate -save-old (Certipy serializes the original config so it can restore it later). 3. Template weaponization: certipy template -template VulnTemplate -write-default-configuration. This rewrites the template to a known ESC1 shape: msPKI-Certificate-Name-Flag includes CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x1), msPKI-Enrollment-Flag clears CT_FLAG_PEND_ALL_REQUESTS, pKIExtendedKeyUsage includes 1.3.6.1.5.5.7.3.2 (Client Authentication), and the template DACL grants Enroll to Authenticated Users. 4. Enrollment: certipy req -u user@corp.local -p Pass -ca CORP-CA -template VulnTemplate -upn administrator@corp.local. The CA issues a certificate whose SAN claims administrator@corp.local. 5. Authentication: certipy auth -pfx administrator.pfx -domain corp.local. The attacker performs PKINIT, receives a TGT for administrator, and dumps the NTLM hash from the PAC (PKINIT returns the NT hash in the PAC_CREDENTIAL_INFO buffer on patched DCs that did not receive the May 2022 / KB5014754 hardening configuration). 6. Persistence and cleanup: certipy template -template VulnTemplate -configuration old-config.json restores the original template definition so a casual diff against a baseline shows no change. The attacker retains the issued certificate, which remains valid for the template lifetime (typically one year) regardless of the password the targeted account uses.
Cómo lo evalúa Guerrilla
Guerrilla binds to the forest RootDSE, resolves the configurationNamingContext, and enumerates pKICertificateTemplate objects under CN=Certificate Templates,CN=Public Key Services,CN=Services,<configNC>. For each template it requests the nTSecurityDescriptor with the OWNER_SECURITY_INFORMATION control bit set, then reads the OwnerSid from the resulting RawSecurityDescriptor. The SID is translated to an NTAccount via the local DC, and templates whose owner is not in the Tier 0 allowlist are reported. The check also walks the DACL for any ACE granting WriteDacl, WriteOwner, WriteProperty, or GenericAll / GenericWrite to non-Tier 0 principals (the ACL surface of ESC4 is broader than ownership alone), and cross-references the template name against the certificateTemplates multi-valued attribute on each CN=<CA>,CN=Enrollment Services,CN=Public Key Services,CN=Services,<configNC> object so the report indicates whether the template is currently published.
Valor recomendado
All certificate template objects owned by Enterprise Admins or designated PKI administrators
Remediación
Check the Owner field on every certificate template object in CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration. Transfer ownership of any incorrectly owned templates to Enterprise Admins using Set-Acl or the Security tab in adsiedit.msc. Investigate how non-admin accounts became owners to prevent recurrence.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3
- ANSSI
- vuln_adcs_esc4
- MITRE ATT&CK
- T1649, T1222.001