ADCS-015: ESC15 - Directivas de aplicación en plantillas de esquema v1
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
ESC15 (también conocido como EKUwu) explota las plantillas de certificado de esquema versión 1 en las que la extensión Directivas de aplicación puede ser especificada por el solicitante en la solicitud de certificado. Dado que las plantillas de esquema v1 no imponen las directivas de aplicación de la plantilla, un atacante puede añadir Autenticación de cliente o cualquier otro EKU al certificado emitido, independientemente de la configuración de la plantilla
Por qué importa
Microsoft application policies (OID 1.3.6.1.4.1.311.21.10) override Extended Key Usage when both are present in a certificate. Schema v1 templates predate the modern enforcement model and do not propagate template-defined Application Policies into the issued certificate, so the CA accepts whatever application policy extension the requester places in the CSR. An attacker with enrollment rights on a vulnerable v1 template (the default WebServer template is a common example) can request a certificate that asserts Client Authentication, Smart Card Logon, or Certificate Request Agent without those EKUs ever being listed on the template. Combined with enrollee-supplied subject, this produces a certificate usable for LDAP Schannel authentication as any chosen principal, or for issuing further on-behalf-of certificates via an ESC3 chain. Blast radius is domain compromise when the resulting certificate authenticates a Tier 0 account.
Ruta de ataque
Step 1: Enumerate vulnerable templates. The attacker runs Certipy find -vulnerable or Certify.exe enum-templates --filter-vulnerable and looks for templates flagged ESC15 (Schema Version 1 with enrollee-supplied subject and broad enrollment rights). Step 2: Request a certificate with an injected application policy. Using Certipy req with the -application-policies flag set to Client Authentication (1.3.6.1.5.5.7.3.2) or Certificate Request Agent (1.3.6.1.4.1.311.20.2.1), the attacker submits a CSR against a v1 template such as WebServer and specifies an arbitrary subject (UPN or SID of a target account). Step 3: The CA issues the certificate without removing or overriding the Application Policies extension because Schema v1 logic does not enforce template application policies. Step 4: Authenticate. Kerberos PKINIT rejects the certificate because Application Policies is a Microsoft extension not consulted during KDC validation, but LDAP Schannel does evaluate Application Policies. The attacker performs LDAPS bind using PassTheCert or Certipy auth-ldap-shell against a Domain Controller and acts as the target principal. Step 5: For a Certificate Request Agent OID injection, the attacker chains into ESC3 by requesting an Enrollment Agent style on-behalf-of certificate for a Domain Admin and authenticating via PKINIT with the second certificate.
Cómo lo evalúa Guerrilla
Guerrilla queries the Configuration naming context under CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=forest for every pKICertificateTemplate object. It filters where msPKI-Template-Schema-Version=1, then cross-references CN=Enrollment Services to determine which templates are published on an Enterprise CA. For each published v1 template, the check reads msPKI-Certificate-Name-Flag for the ENROLLEE_SUPPLIES_SUBJECT bit and walks the nTSecurityDescriptor DACL to identify principals granted the Certificate-Enrollment or Certificate-AutoEnrollment extended rights. The finding fires when a published v1 template grants enrollment to a non-Tier-0 principal. The check does not require a writable connection; standard read access to the Configuration partition is sufficient.
Valor recomendado
Ninguna plantilla de esquema v1 publicada que permita la inscripción de bajo privilegio; migre todas las plantillas requeridas a esquema v2 o posterior
Remediación
Identifique todas las plantillas de esquema v1 (msPKI-Template-Schema-Version = 1) que estén publicadas en las CA empresariales. Migre las plantillas de esquema v1 a esquema v2 o posterior creando nuevas plantillas basadas en la plantilla v1 con imposición explícita de EKU. Restrinja la inscripción en cualquier plantilla v1 restante únicamente a cuentas administrativas. Deje de publicar las plantillas v1 que ya no sean necesarias.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, IA-5(2)
- MITRE ATT&CK
- T1649