ADCS-017: EKEUwu - Abuso del uso de clave extendido
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El ataque EKEUwu tiene como objetivo las plantillas de certificado en las que el campo Uso de clave extendido puede ser influido por el solicitante a través de la solicitud de certificado. Esto ocurre con determinadas configuraciones de plantilla en las que la plantilla no impone estrictamente el EKU, lo que permite a un atacante añadir EKU de autenticación a certificados que no estaban destinados a fines de autenticación
Por qué importa
Schema version 1 certificate templates predate the modern EKU enforcement model. When a CA issues a certificate from a V1 template, it accepts Application Policies extensions supplied in the CSR and writes them into the issued certificate alongside whatever EKUs the template declares. Application Policies is a Microsoft-specific extension (1.3.6.1.4.1.311.21.10) that Windows treats as functionally equivalent to EKU during chain validation for PKINIT and Schannel. The consequence is that an attacker who can enroll in any V1 template that lets the enrollee supply the subject (the default WebServer template is the canonical example, but any cloned-from-V1 template that retains the schema version 1 marker is in scope) can request a certificate whose Application Policies list contains Client Authentication (1.3.6.1.5.5.7.3.2) or Smart Card Logon (1.3.6.1.4.1.311.20.2.2), then use that certificate to PKINIT as any account whose UPN they can supply. Because the manager approval and signature requirements that protect more privileged templates do not apply to a default-published V1 template like WebServer, the primitive is reachable by any authenticated domain user. Microsoft assigned CVE-2024-49019 (CVSS 7.8) and patched the issuance behavior so that EKUs from Application Policies are no longer trusted from V1 templates, but unpatched CAs and re-introduced V1 templates remain exposed.
Ruta de ataque
1. Enumerate vulnerable templates with certipy find -u user@corp.example.com -p Pass -dc-ip <ip> -vulnerable -enabled. The output lists ESC15-eligible templates with the [!] Vulnerabilities key set to ESC15 and indicates schema version 1 plus enrollee-supplies-subject. 2. Pick a template. The built-in WebServer template is the highest-signal target because it is published by default on most Enterprise CAs and is V1. Any cloned V1 template that retains msPKI-Template-Schema-Version = 1 is equivalent. 3. Craft a request that injects Application Policies. With Certipy: certipy req -u low@corp.example.com -p Pass -ca CORP-CA -template WebServer -application-policies "Client Authentication" -upn administrator@corp.example.com. The Application Policies extension is added to the CSR and, on an unpatched CA, the issued certificate carries Client Authentication as an effective EKU. 4. Authenticate as the impersonated principal. certipy auth -pfx administrator.pfx performs PKINIT against the KDC and returns a TGT for the Domain Administrator. If the target is configured for Smart Card Logon, request -application-policies "Smart Card Logon" instead and the same auth flow works. 5. Achieve domain dominance. Use the resulting TGT for DCSync, krbtgt extraction, or normal Kerberos service access. The certificate has its own lifetime (typically the CA default, often a year) and survives password resets unless explicitly revoked. 6. Optionally pivot to other identities. Because the attacker controls the SAN/UPN in the CSR (the enrollee supplies subject), each issuance can target a different privileged principal: DCs, gMSAs, krbtgt does not work but Tier 0 service accounts often do.
Cómo lo evalúa Guerrilla
Guerrilla performs an LDAP search against the forest configuration NC for objectClass=pKICertificateTemplate and projects the schema version, certificate name flags, enrollment flags, pKIExtendedKeyUsage, and ntSecurityDescriptor. The ntSecurityDescriptor is parsed for ACEs whose ObjectType GUID matches the Certificate-Enrollment extended right (0e10c968-78fb-11d2-90d4-00c04f79dc55) or the Certificate-AutoEnrollment right (a05b8cc2-17bc-4802-a710-e7c15ab866a2). Trustees are resolved against well-known SIDs (S-1-5-11 Authenticated Users, S-1-5-21-...-513 Domain Users, S-1-5-21-...-515 Domain Computers) and the recursively expanded membership of any custom group granted Enroll. The check then evaluates the EKUwu predicate: schema version equals 1 AND a broad principal has Enroll AND manager approval is not required AND the template is published on at least one CA. Templates matching the predicate are reported with the DN, displayName, schemaVersion, enrollment principals, publishing CAs, and the OS patch state of those CAs (the KB5046612 / November 2024 cumulative update remediation is correlated where available via the LastBootTime and installed updates inventory).
Valor recomendado
Todas las plantillas de certificado imponen estrictamente el EKU de la definición de la plantilla; ningún EKU controlable por el solicitante
Remediación
Revise todas las plantillas de certificado en cuanto a la imposición del EKU. Asegúrese de que las plantillas sean de esquema v2 o posterior, donde la imposición del EKU es más robusta. Elimine las plantillas innecesarias que no definan e impongan estrictamente los EKU. Pruebe las solicitudes de certificado para verificar que el EKU del certificado emitido coincide con la definición de la plantilla. Implemente módulos de directiva de emisión de la CA que validen el EKU en las solicitudes.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(2), CM-6
- MITRE ATT&CK
- T1649