ADCS-009: ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 Flag
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For every Enterprise CA registered under CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration in the forest, the check connects to the CAs hosting computer and reads the policy module EditFlags registry value at: HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditFlags This mirrors the output of certutil -config "<CA-Name>" -getreg policy\EditFlags. The value is a bitmask of EDITF_* constants documented in MS-WCCE. The check evaluates whether EDITF_ATTRIBUTESUBJECTALTNAME2 (0x00040000) is set. It also captures EDITF_ENABLEREQUESTEXTENSIONLIST (0x00000020) and EDITF_ATTRIBUTESUBJECTALTNAME (0x00000001, the legacy single-SAN variant from Windows 2000 era CAs) for context. Any CA where bit 0x00040000 is asserted is reported as an ESC6 finding with the CA DNS name, sanitized name, and the full hex EditFlags value.
Por qué importa
On a CA without this flag, the SAN of an issued certificate is derived from the authenticated AD account of the requester (built from userPrincipalName / sAMAccountName / dNSHostName according to the template configuration). With EDITF_ATTRIBUTESUBJECTALTNAME2 set, the SAN is taken from a user-supplied request attribute (san:upn=...) and the CA does not validate that the requester has any relationship to the principal named in the SAN. Any low-privileged domain user who can enroll in any client-auth-capable template (the default User template qualifies in most environments) can request a certificate whose SAN is administrator@corp.example.com or a DC computer account, then authenticate to LDAP, SMB, or Kerberos as that principal using PKINIT. The blast radius is total forest compromise. ESC6 also bypasses the manager-approval and authorized-signature controls that exist on more locked-down templates, because the attack does not require enrolling in a privileged template, only in any template that has Client Authentication EKU. Microsoft explicitly warns against this flag in KB and recommends it remain disabled.
Ruta de ataque
1. Enumerate CAs and their EditFlags. The attacker runs certipy find -u user@corp.example.com -p Pass -dc-ip <ip> -enabled or Certify.exe find /vulnerable. The output includes a User Specified SAN: Enabled field for each CA, which corresponds to EDITF_ATTRIBUTESUBJECTALTNAME2. 2. Identify a usable template. Any published template that allows Domain Users or Authenticated Users to enroll and that has the Client Authentication, Smart Card Logon, PKINIT Client Authentication, or Any Purpose EKU is sufficient. The built-in User template typically qualifies. 3. Request a certificate with a forged SAN: certipy req -u low@corp.example.com -p Pass -ca CORP-CA -template User -upn administrator@corp.example.com. The attribute san:upn=administrator@corp.example.com is sent in the request, and because EDITF_ATTRIBUTESUBJECTALTNAME2 is set, the CA stamps that UPN into the certificate. 4. Authenticate using the certificate. certipy auth -pfx administrator.pfx performs PKINIT and returns a TGT for the Domain Administrator, along with the NT hash if UnPAC-the-hash is supported, granting full Domain Admin rights. 5. Lateral movement and persistence. The attacker uses the recovered TGT or hash for DCSync, krbtgt extraction, or Golden Ticket forging. Because the issued certificate has its own lifetime (often a year), it survives password resets unless explicitly revoked. 6. Cleanup is rarely performed because the original CA misconfiguration leaves a trivial path to re-establish access; defenders may not notice an ESC6 issuance in the CA database without targeted hunting.
Cómo lo evalúa Guerrilla
Guerrilla discovers CAs by querying the forest configuration NC (LDAP filter (objectClass=pKIEnrollmentService) under CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=...). For each CA it extracts the dNSHostName and the CN. It then queries the policy EditFlags via: - certutil.exe -config "<dNSHostName>\<CA-Name>" -getreg policy\EditFlags (preferred, runs from any domain-joined host that can reach the CA over RPC / DCOM), or - direct registry read against HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\PolicyModules\<ModuleId>\EditFlags using Get-ItemProperty with Invoke-Command when remoting is available. The returned DWORD is bit-tested against 0x00040000. The check reports the offending CAs with the resolved EditFlags hex value, the policy module identifier, and the last time the CA service was restarted (because EditFlags changes do not take effect until CertSvc restarts). The check does not require the AD CS Remote Server Administration Tools and works over standard MS-RRP / MS-WCCE channels exposed by the CA.
Valor recomendado
EDITF_ATTRIBUTESUBJECTALTNAME2 flag disabled on all CA servers
Remediación
Check the CA configuration using certutil -getreg policy\EditFlags on each CA server. If the EDITF_ATTRIBUTESUBJECTALTNAME2 flag (0x00040000) is set, remove it using certutil -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2. Restart the CertSvc service after the change. Review all recently issued certificates for unexpected SANs that may indicate prior exploitation.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| limitation | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, IA-5(2), AC-6
- ANSSI
- vuln_adcs_esc6
- MITRE ATT&CK
- T1649, T1556