ADCS-017: EKEUwu - Extended Key Usage Abuse
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For every pKICertificateTemplate object under CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration in the forest, the check reads the following attributes: - msPKI-Template-Schema-Version (the integer schema version; 1 is the historic NT5 schema, 2 and above are modern schemas) - msPKI-Certificate-Name-Flag (bitmask; CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0x00000001 and the related _ALT_NAME flag are decoded) - msPKI-Enrollment-Flag (bitmask; PEND_ALL_REQUESTS / manager approval is decoded) - pKIExtendedKeyUsage (the EKU OIDs the template asserts) - ntSecurityDescriptor (the DACL; the check enumerates which principals hold the Enroll and AutoEnroll extended rights) - msPKI-Template-Cert-Template-OID and displayName for reporting A template is reported as an EKUwu candidate when all of the following are true: msPKI-Template-Schema-Version equals 1, the Enroll right is granted to a broad principal (Domain Users, Authenticated Users, Domain Computers, or any group containing the same), and the manager approval flag (CT_FLAG_PEND_ALL_REQUESTS, 0x00000002) is not set. The check also reports whether the template is currently published on at least one Enterprise CA by checking the certificateTemplates multi-valued attribute on each pKIEnrollmentService object; an unpublished template cannot be enrolled and is reported informationally.
Por qué importa
Schema version 1 certificate templates predate the modern EKU enforcement model. When a CA issues a certificate from a V1 template, it accepts Application Policies extensions supplied in the CSR and writes them into the issued certificate alongside whatever EKUs the template declares. Application Policies is a Microsoft-specific extension (1.3.6.1.4.1.311.21.10) that Windows treats as functionally equivalent to EKU during chain validation for PKINIT and Schannel. The consequence is that an attacker who can enroll in any V1 template that lets the enrollee supply the subject (the default WebServer template is the canonical example, but any cloned-from-V1 template that retains the schema version 1 marker is in scope) can request a certificate whose Application Policies list contains Client Authentication (1.3.6.1.5.5.7.3.2) or Smart Card Logon (1.3.6.1.4.1.311.20.2.2), then use that certificate to PKINIT as any account whose UPN they can supply. Because the manager approval and signature requirements that protect more privileged templates do not apply to a default-published V1 template like WebServer, the primitive is reachable by any authenticated domain user. Microsoft assigned CVE-2024-49019 (CVSS 7.8) and patched the issuance behavior so that EKUs from Application Policies are no longer trusted from V1 templates, but unpatched CAs and re-introduced V1 templates remain exposed.
Ruta de ataque
1. Enumerate vulnerable templates with certipy find -u user@corp.example.com -p Pass -dc-ip <ip> -vulnerable -enabled. The output lists ESC15-eligible templates with the [!] Vulnerabilities key set to ESC15 and indicates schema version 1 plus enrollee-supplies-subject. 2. Pick a template. The built-in WebServer template is the highest-signal target because it is published by default on most Enterprise CAs and is V1. Any cloned V1 template that retains msPKI-Template-Schema-Version = 1 is equivalent. 3. Craft a request that injects Application Policies. With Certipy: certipy req -u low@corp.example.com -p Pass -ca CORP-CA -template WebServer -application-policies "Client Authentication" -upn administrator@corp.example.com. The Application Policies extension is added to the CSR and, on an unpatched CA, the issued certificate carries Client Authentication as an effective EKU. 4. Authenticate as the impersonated principal. certipy auth -pfx administrator.pfx performs PKINIT against the KDC and returns a TGT for the Domain Administrator. If the target is configured for Smart Card Logon, request -application-policies "Smart Card Logon" instead and the same auth flow works. 5. Achieve domain dominance. Use the resulting TGT for DCSync, krbtgt extraction, or normal Kerberos service access. The certificate has its own lifetime (typically the CA default, often a year) and survives password resets unless explicitly revoked. 6. Optionally pivot to other identities. Because the attacker controls the SAN/UPN in the CSR (the enrollee supplies subject), each issuance can target a different privileged principal: DCs, gMSAs, krbtgt does not work but Tier 0 service accounts often do.
Cómo lo evalúa Guerrilla
Guerrilla performs an LDAP search against the forest configuration NC for objectClass=pKICertificateTemplate and projects the schema version, certificate name flags, enrollment flags, pKIExtendedKeyUsage, and ntSecurityDescriptor. The ntSecurityDescriptor is parsed for ACEs whose ObjectType GUID matches the Certificate-Enrollment extended right (0e10c968-78fb-11d2-90d4-00c04f79dc55) or the Certificate-AutoEnrollment right (a05b8cc2-17bc-4802-a710-e7c15ab866a2). Trustees are resolved against well-known SIDs (S-1-5-11 Authenticated Users, S-1-5-21-...-513 Domain Users, S-1-5-21-...-515 Domain Computers) and the recursively expanded membership of any custom group granted Enroll. The check then evaluates the EKUwu predicate: schema version equals 1 AND a broad principal has Enroll AND manager approval is not required AND the template is published on at least one CA. Templates matching the predicate are reported with the DN, displayName, schemaVersion, enrollment principals, publishing CAs, and the OS patch state of those CAs (the KB5046612 / November 2024 cumulative update remediation is correlated where available via the LastBootTime and installed updates inventory).
Valor recomendado
All certificate templates strictly enforce EKU from the template definition; no enrollee-controllable EKUs
Remediación
Review all certificate templates for EKU enforcement. Ensure templates are Schema v2 or later where EKU enforcement is more robust. Remove unnecessary templates that do not strictly define and enforce EKUs. Test certificate requests to verify that the issued certificate EKU matches the template definition. Implement CA issuance policy modules that validate EKU in requests.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(2), CM-6
- MITRE ATT&CK
- T1649