ADCS-013: ESC11 - RPC Relay Without Encryption
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For each enterprise CA discovered under CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=<forest root>, the check resolves the CA host (dNSHostName) and queries the registry value HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA name>\InterfaceFlags. This DWORD is a bitmask of CERTSRV_INTERFACE_* flags. The check tests whether IF_ENFORCEENCRYPTICERTREQUEST (0x00000200) is set. When that bit is clear, the ICertPassage RPC interface (UUID 91ae6020-9e3c-11cf-8d7c-00aa00c091be) accepts inbound bindings at RPC_C_AUTHN_LEVEL_PKT_INTEGRITY or lower, which is the precondition for an ntlmrelayx-style relay over TCP/135 plus an ephemeral RPC endpoint. The check also reads the CA flags (CAType, EnrollmentInterface, and the published certificateTemplates list) to scope which templates an attacker could request once relayed, and it cross-references ADCS-012 (ESC8) and ADCS-006 (vulnerable templates) to identify chained exploitation paths. CAs unreachable over remote registry are flagged as inconclusive rather than passing.
Por qué importa
The RPC enrollment surface is enabled by default on every Microsoft Enterprise CA and cannot be disabled without breaking certutil, certreq, MMC enrollment, and autoenrollment for downlevel clients. When IF_ENFORCEENCRYPTICERTREQUEST is off, that surface accepts relayed NTLM. An attacker who can coerce SYSTEM-context authentication out of any domain-joined host (every domain controller is in scope via MS-EFSRPC, MS-RPRN, MS-DFSNM, MS-FSRVP) can relay that authentication to the CA over RPC and request a certificate as the coerced machine account. If a template that allows machine enrollment publishes Client Authentication EKU (the default DomainController and Machine templates qualify), the attacker receives a certificate usable for PKINIT, which yields a TGT and the NT hash for the coerced principal. Relaying a DC machine account produces an Administrator-equivalent foothold without ever touching a password, without triggering Kerberoasting heuristics, and without leaving event 4624 logon records on the DC. The blast radius is the entire forest, and the attack is unauthenticated from the perspective of the CA: an unauthenticated network attacker who can reach TCP/135 on the CA and coerce one machine can become Domain Admin.
Ruta de ataque
Step 1: Reconnaissance. The attacker enumerates CAs and their interface flags. certipy find -u user@domain -p Password -dc-ip <ip> -vulnerable reports ESC11 when IF_ENFORCEENCRYPTICERTREQUEST is unset. The output lists each vulnerable CA and the templates published on it. Step 2: Stand up the relay. The attacker starts a modified ntlmrelayx targeting the CA RPC endpoint: ntlmrelayx.py -t rpc://<CA-host> -smb2support --adcs --template DomainController. The fork understands ICPR mode and proxies the relayed NTLM session into an ICertRequest::Request call. Step 3: Coerce authentication from a high-value principal. PetitPotam (MS-EFSRPC), PrinterBug (MS-RPRN), DFSCoerce (MS-DFSNM), or ShadowCoerce (MS-FSRVP) is used to force a domain controller or other Tier 0 host to authenticate to the relay. Example: python3 PetitPotam.py -u user -p Password <relay-ip> <DC-ip>. Step 4: Relay and issue. The relay binds to the ICertPassage interface on the CA at RPC_C_AUTHN_LEVEL_CONNECT or PKT_INTEGRITY (anything below PKT_PRIVACY), submits a certificate request whose subject is built from the relayed identity, and returns the issued PFX. Step 5: PKINIT. certipy auth -pfx <victim>.pfx -dc-ip <ip> performs PKINIT against the KDC and returns a TGT plus the NT hash for the coerced principal (the DC machine account in the canonical scenario). Step 6: DCSync. With the DC machine account hash, the attacker runs secretsdump or DCSync via mimikatz lsadump::dcsync /user:krbtgt to extract the krbtgt hash and forge golden tickets. Total time from coercion to Domain Admin: under two minutes against a vulnerable CA.
Cómo lo evalúa Guerrilla
Guerrilla discovers every enterprise CA via LDAP query (objectClass=pKIEnrollmentService) under CN=Enrollment Services and reads dNSHostName plus cACertificateDN. For each CA host it opens a remote registry connection (RemoteRegistry service, falling back to WinRM Get-ItemProperty when remote registry is denied) and reads HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA name>\InterfaceFlags. The returned DWORD is bitwise-ANDed against 0x00000200 (IF_ENFORCEENCRYPTICERTREQUEST). When the result is zero, the check records the CA as ESC11-vulnerable. The check also reads the same key for IF_ENFORCEENCRYPTION (0x00000040) and EditFlags for cross-validation with ADCS-005 (ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2) and emits a chained-finding severity uplift when the CA has both ESC8 (web enrollment without EPA) and ESC11 enabled, since a single attacker can pivot between the two transports. Findings include CA name, CA host, current InterfaceFlags hex value, the missing bit, and the list of published templates that allow machine or user authentication.
Valor recomendado
IF_ENFORCEENCRYPTICERTREQUEST flag enabled on all CA servers to require RPC encryption
Remediación
Check CA interface flags using certutil -getreg CA\InterfaceFlags. Enable the IF_ENFORCEENCRYPTICERTREQUEST flag using certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST. Restart the CertSvc service. Verify that certificate enrollment still functions correctly from domain-joined clients after enabling encryption enforcement.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| limitation | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8, SC-8(1), IA-5(2)
- ANSSI
- vuln_adcs_esc11
- MITRE ATT&CK
- T1649, T1557