ADCS-013: ESC11 - Retransmisión RPC sin cifrado
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
ESC11 tiene como objetivo la interfaz de inscripción RPC de AD CS (ICertPassage) cuando la CA no impone el cifrado en la conexión RPC. De forma similar a ESC8 para HTTP, un atacante puede retransmitir la autenticación NTLM al extremo RPC sin cifrar para solicitar certificados con la identidad retransmitida. Esto afecta a la interfaz de inscripción predeterminada basada en DCOM
Por qué importa
The RPC enrollment surface is enabled by default on every Microsoft Enterprise CA and cannot be disabled without breaking certutil, certreq, MMC enrollment, and autoenrollment for downlevel clients. When IF_ENFORCEENCRYPTICERTREQUEST is off, that surface accepts relayed NTLM. An attacker who can coerce SYSTEM-context authentication out of any domain-joined host (every domain controller is in scope via MS-EFSRPC, MS-RPRN, MS-DFSNM, MS-FSRVP) can relay that authentication to the CA over RPC and request a certificate as the coerced machine account. If a template that allows machine enrollment publishes Client Authentication EKU (the default DomainController and Machine templates qualify), the attacker receives a certificate usable for PKINIT, which yields a TGT and the NT hash for the coerced principal. Relaying a DC machine account produces an Administrator-equivalent foothold without ever touching a password, without triggering Kerberoasting heuristics, and without leaving event 4624 logon records on the DC. The blast radius is the entire forest, and the attack is unauthenticated from the perspective of the CA: an unauthenticated network attacker who can reach TCP/135 on the CA and coerce one machine can become Domain Admin.
Ruta de ataque
Step 1: Reconnaissance. The attacker enumerates CAs and their interface flags. certipy find -u user@domain -p Password -dc-ip <ip> -vulnerable reports ESC11 when IF_ENFORCEENCRYPTICERTREQUEST is unset. The output lists each vulnerable CA and the templates published on it. Step 2: Stand up the relay. The attacker starts a modified ntlmrelayx targeting the CA RPC endpoint: ntlmrelayx.py -t rpc://<CA-host> -smb2support --adcs --template DomainController. The fork understands ICPR mode and proxies the relayed NTLM session into an ICertRequest::Request call. Step 3: Coerce authentication from a high-value principal. PetitPotam (MS-EFSRPC), PrinterBug (MS-RPRN), DFSCoerce (MS-DFSNM), or ShadowCoerce (MS-FSRVP) is used to force a domain controller or other Tier 0 host to authenticate to the relay. Example: python3 PetitPotam.py -u user -p Password <relay-ip> <DC-ip>. Step 4: Relay and issue. The relay binds to the ICertPassage interface on the CA at RPC_C_AUTHN_LEVEL_CONNECT or PKT_INTEGRITY (anything below PKT_PRIVACY), submits a certificate request whose subject is built from the relayed identity, and returns the issued PFX. Step 5: PKINIT. certipy auth -pfx <victim>.pfx -dc-ip <ip> performs PKINIT against the KDC and returns a TGT plus the NT hash for the coerced principal (the DC machine account in the canonical scenario). Step 6: DCSync. With the DC machine account hash, the attacker runs secretsdump or DCSync via mimikatz lsadump::dcsync /user:krbtgt to extract the krbtgt hash and forge golden tickets. Total time from coercion to Domain Admin: under two minutes against a vulnerable CA.
Cómo lo evalúa Guerrilla
Guerrilla discovers every enterprise CA via LDAP query (objectClass=pKIEnrollmentService) under CN=Enrollment Services and reads dNSHostName plus cACertificateDN. For each CA host it opens a remote registry connection (RemoteRegistry service, falling back to WinRM Get-ItemProperty when remote registry is denied) and reads HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA name>\InterfaceFlags. The returned DWORD is bitwise-ANDed against 0x00000200 (IF_ENFORCEENCRYPTICERTREQUEST). When the result is zero, the check records the CA as ESC11-vulnerable. The check also reads the same key for IF_ENFORCEENCRYPTION (0x00000040) and EditFlags for cross-validation with ADCS-005 (ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2) and emits a chained-finding severity uplift when the CA has both ESC8 (web enrollment without EPA) and ESC11 enabled, since a single attacker can pivot between the two transports. Findings include CA name, CA host, current InterfaceFlags hex value, the missing bit, and the list of published templates that allow machine or user authentication.
Valor recomendado
Indicador IF_ENFORCEENCRYPTICERTREQUEST habilitado en todos los servidores de CA para exigir el cifrado RPC
Remediación
Compruebe los indicadores de interfaz de la CA con certutil -getreg CA\InterfaceFlags. Habilite el indicador IF_ENFORCEENCRYPTICERTREQUEST con certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST. Reinicie el servicio CertSvc. Verifique que la inscripción de certificados sigue funcionando correctamente desde los clientes unidos al dominio tras habilitar la imposición del cifrado.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| limitation | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8, SC-8(1), IA-5(2)
- ANSSI
- vuln_adcs_esc11
- MITRE ATT&CK
- T1649, T1557