ADCS-010: ESC7 - ACL vulnerables en la CA
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
ESC7 se produce cuando un principal no administrativo tiene permisos ManageCA o ManageCertificates sobre la CA. ManageCA permite modificar la configuración de la CA, incluida la habilitación de EDITF_ATTRIBUTESUBJECTALTNAME2 (creando una condición ESC6). ManageCertificates permite aprobar solicitudes de certificado pendientes, eludiendo los requisitos de aprobación del administrador de la CA en plantillas sensibles
Por qué importa
ManageCA is the single most powerful right inside Active Directory Certificate Services. A principal holding ManageCA can: enable EDITF_ATTRIBUTESUBJECTALTNAME2 (creating an ESC6 universal SAN-injection condition across every template the CA issues), grant itself ManageCertificates so it can approve its own pending requests, publish or republish certificate templates, change officer rights to bypass enrollment agent restrictions, and modify CA policy modules. ManageCertificates alone is enough to neutralize the Manager Approval (msPKI-Enrollment-Flag CT_FLAG_PEND_ALL_REQUESTS) control that defenders rely on to keep dangerous templates from being silently issued. The combination of the two rights yields an unauthenticated path to a Domain Admin or Domain Controller certificate that is fully signed by an Enterprise CA trusted by every machine in the forest. Unlike many ADCS misconfigurations, ESC7 is a delegation problem rather than a template problem, so it survives template hardening: an attacker with ManageCA can re-create the vulnerable condition on demand.
Ruta de ataque
Step 1: Discovery. The attacker runs Certipy find -u user@domain -p pass -dc-ip <DC> -vulnerable, or BloodHound with the Certipy collector, and identifies an Enterprise CA where a controlled principal (a help desk group, a PKI operations team, a stale delegation) holds ManageCA or ManageCertificates. Step 2a (ManageCA path): The attacker uses Certipy ca -ca <CA> -add-officer <controlled-user> -u user@domain -p pass to grant itself ManageCertificates, then Certipy ca -ca <CA> -enable-template SubCA (or any disabled template) to republish a template that allows client authentication and arbitrary SAN. Alternatively the attacker runs Certipy ca -ca <CA> -enable-edit-flag EDITF_ATTRIBUTESUBJECTALTNAME2 to convert the entire CA into an ESC6 condition where any User template can be requested with a san:upn=Administrator@domain attribute. Step 2b (ManageCertificates path): The attacker submits a request against a template that normally requires CA Manager approval (commonly an Enrollment Agent or a high-value client-auth template). The request goes pending. The attacker then runs Certipy ca -ca <CA> -issue-request <RequestId> to approve and issue the certificate without any other approver involvement. Step 3: PKINIT or Schannel authentication. The attacker uses Certipy auth -pfx admin.pfx -domain <domain> to obtain a TGT for the high-value account via PKINIT, or extracts the NTLM hash via the U2U + UnPAC-the-Hash flow. From here the attacker has domain-level credentials usable for DCSync, lateral movement, or persistence. Step 4: Cleanup. The attacker uses Certipy ca to roll back the EditFlags or remove the added officer rights, leaving behind only an issued certificate that can be reused until the CA CRL is updated or the certificate is explicitly revoked.
Cómo lo evalúa Guerrilla
Guerrilla locates each enterprise CA via the pKIEnrollmentService objects in the configuration partition. For each CA it issues a DCOM call to ICertAdmin2::GetCASecurity (the same RPC interface used by certutil -getacl -config "<config string>") and parses the returned SECURITY_DESCRIPTOR. ACE rights are decoded against the certsrv.h flag set: CA_ACCESS_ADMIN, CA_ACCESS_OFFICER, CA_ACCESS_READ, CA_ACCESS_ENROLL. Trustee SIDs are resolved through the global catalog. Any ACE granting ADMIN or OFFICER to a SID outside the approved tier-zero allowlist (configurable via the Guerrilla policy file, default: BUILTIN\Administrators, Domain Admins, Enterprise Admins, NT AUTHORITY\SYSTEM, the CA gMSA or service account) produces a finding. The check also queries the CA EditFlags via the same RPC channel to record whether EDITF_ATTRIBUTESUBJECTALTNAME2 is already set, and inspects published templates so that the report ties ESC7 exposure to concrete downstream ESC1, ESC2, and ESC6 conditions on the same CA. Fallback path: if RPC to the CA is blocked, the check enumerates the cACertificate and certificateTemplates attributes on the pKIEnrollmentService object and reports that CA ACL detail is unavailable, which itself is a finding.
Valor recomendado
Permisos ManageCA y ManageCertificates restringidos únicamente a los administradores de CA designados
Remediación
Revise los permisos de seguridad de la CA con certsrv.msc > Propiedades > pestaña Seguridad o certutil -getacl. Elimine los permisos ManageCA de los principales no administrativos. Elimine ManageCertificates de cualquier principal que no sea un administrador de certificados autorizado. Documente todos los principales con permisos de administración de la CA. Implemente la separación de funciones entre los administradores de la CA y los administradores de certificados.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-5
- ANSSI
- vuln_adcs_esc7
- MITRE ATT&CK
- T1649