ADCS-009: ESC6 - Indicador EDITF_ATTRIBUTESUBJECTALTNAME2
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Cuando el indicador EDITF_ATTRIBUTESUBJECTALTNAME2 está habilitado en una CA, cualquier solicitud de certificado puede incluir un nombre alternativo del firmante definido por el usuario, independientemente de la configuración de la plantilla. Esto hace que, en la práctica, todas las plantillas de la CA sean vulnerables a ataques de estilo ESC1 en los que un atacante especifica un SAN para un usuario privilegiado
Por qué importa
On a CA without this flag, the SAN of an issued certificate is derived from the authenticated AD account of the requester (built from userPrincipalName / sAMAccountName / dNSHostName according to the template configuration). With EDITF_ATTRIBUTESUBJECTALTNAME2 set, the SAN is taken from a user-supplied request attribute (san:upn=...) and the CA does not validate that the requester has any relationship to the principal named in the SAN. Any low-privileged domain user who can enroll in any client-auth-capable template (the default User template qualifies in most environments) can request a certificate whose SAN is administrator@corp.example.com or a DC computer account, then authenticate to LDAP, SMB, or Kerberos as that principal using PKINIT. The blast radius is total forest compromise. ESC6 also bypasses the manager-approval and authorized-signature controls that exist on more locked-down templates, because the attack does not require enrolling in a privileged template, only in any template that has Client Authentication EKU. Microsoft explicitly warns against this flag in KB and recommends it remain disabled.
Ruta de ataque
1. Enumerate CAs and their EditFlags. The attacker runs certipy find -u user@corp.example.com -p Pass -dc-ip <ip> -enabled or Certify.exe find /vulnerable. The output includes a User Specified SAN: Enabled field for each CA, which corresponds to EDITF_ATTRIBUTESUBJECTALTNAME2. 2. Identify a usable template. Any published template that allows Domain Users or Authenticated Users to enroll and that has the Client Authentication, Smart Card Logon, PKINIT Client Authentication, or Any Purpose EKU is sufficient. The built-in User template typically qualifies. 3. Request a certificate with a forged SAN: certipy req -u low@corp.example.com -p Pass -ca CORP-CA -template User -upn administrator@corp.example.com. The attribute san:upn=administrator@corp.example.com is sent in the request, and because EDITF_ATTRIBUTESUBJECTALTNAME2 is set, the CA stamps that UPN into the certificate. 4. Authenticate using the certificate. certipy auth -pfx administrator.pfx performs PKINIT and returns a TGT for the Domain Administrator, along with the NT hash if UnPAC-the-hash is supported, granting full Domain Admin rights. 5. Lateral movement and persistence. The attacker uses the recovered TGT or hash for DCSync, krbtgt extraction, or Golden Ticket forging. Because the issued certificate has its own lifetime (often a year), it survives password resets unless explicitly revoked. 6. Cleanup is rarely performed because the original CA misconfiguration leaves a trivial path to re-establish access; defenders may not notice an ESC6 issuance in the CA database without targeted hunting.
Cómo lo evalúa Guerrilla
Guerrilla discovers CAs by querying the forest configuration NC (LDAP filter (objectClass=pKIEnrollmentService) under CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=...). For each CA it extracts the dNSHostName and the CN. It then queries the policy EditFlags via: - certutil.exe -config "<dNSHostName>\<CA-Name>" -getreg policy\EditFlags (preferred, runs from any domain-joined host that can reach the CA over RPC / DCOM), or - direct registry read against HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\PolicyModules\<ModuleId>\EditFlags using Get-ItemProperty with Invoke-Command when remoting is available. The returned DWORD is bit-tested against 0x00040000. The check reports the offending CAs with the resolved EditFlags hex value, the policy module identifier, and the last time the CA service was restarted (because EditFlags changes do not take effect until CertSvc restarts). The check does not require the AD CS Remote Server Administration Tools and works over standard MS-RRP / MS-WCCE channels exposed by the CA.
Valor recomendado
Indicador EDITF_ATTRIBUTESUBJECTALTNAME2 deshabilitado en todos los servidores de CA
Remediación
Compruebe la configuración de la CA con certutil -getreg policy\EditFlags en cada servidor de CA. Si el indicador EDITF_ATTRIBUTESUBJECTALTNAME2 (0x00040000) está establecido, elimínelo con certutil -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2. Reinicie el servicio CertSvc tras el cambio. Revise todos los certificados emitidos recientemente en busca de SAN inesperados que puedan indicar una explotación previa.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| limitation | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, IA-5(2), AC-6
- ANSSI
- vuln_adcs_esc6
- MITRE ATT&CK
- T1649, T1556