ADCS-019: Enumeración de plantillas de certificado
- Plataforma
- Active Directory
- Categoría
- AD Certificate Services
- Severidad
- Info
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Una enumeración exhaustiva de todas las plantillas de certificado con sus atributos relevantes para la seguridad proporciona la línea de base para la evaluación de vulnerabilidades ESC. Incluye la versión de esquema de la plantilla, los permisos de inscripción, la configuración de EKU, los indicadores de nombre, los indicadores de inscripción, el requisito de firmas autorizadas y el periodo de validez. Esta información alimenta todas las comprobaciones específicas de ESC
Por qué importa
Every ADCS escalation path published in Certified Pre-Owned and the subsequent ESC9 through ESC16 follow-ups is fundamentally a misconfigured template plus an enrollment grant. ESC1 is ENROLLEE_SUPPLIES_SUBJECT plus a client-auth EKU plus Authenticated Users Enroll. ESC2 is the Any Purpose EKU on a template Authenticated Users can enroll. ESC3 is the Certificate Request Agent EKU plus a downstream enrollment-agent-restricted template. ESC4 is WriteDacl, WriteOwner, or WriteProperty on the template object itself. ESC9 is CT_FLAG_NO_SECURITY_EXTENSION. ESC15 is schema v1 with a client-auth-capable application policy that lets the requester inject arbitrary EKUs at request time. The inventory ADCS-019 produces is the lookup table every other ADCS check joins against, defenders who run the recon series without ADCS-019 have no shared ground truth and cannot reproduce findings across runs. Beyond the ESC chain, the inventory is also the audit trail for least-privilege review: a template that grants Enroll to Authenticated Users or Domain Users but issues a certificate with the Smart Card Logon EKU is a domain-wide authentication risk regardless of which ESC label fits, and a template with WriteDacl granted to a non-Tier-0 principal is a latent ESC4.
Ruta de ataque
1. Enumeration: an attacker with any authenticated user context runs certipy find -u user@domain.tld -p pass -dc-ip 10.0.0.1 -vulnerable, which queries CN=Certificate Templates and CN=Enrollment Services in one pass and returns every template with its EKU list, name flags, enrollment flags, RA signature count, and enrollment ACL. Certify.exe find /vulnerable and PSPKIAudit Get-CertificateTemplate produce the same data via different APIs. 2. Triage: the attacker filters the template list for the ESC preconditions: ENROLLEE_SUPPLIES_SUBJECT plus client auth plus permissive enroll (ESC1), Any Purpose EKU plus permissive enroll (ESC2), Certificate Request Agent EKU (ESC3), permissive ACL on the template object (ESC4), CT_FLAG_NO_SECURITY_EXTENSION (ESC9), schema v1 with client auth (ESC15). 3. Publication check: the attacker confirms which CA publishes the candidate template by intersecting against the Enrollment Services certificateTemplates attribute; an unpublished template is enumerable but not enrollable. 4. Exploitation: certipy req -u user@domain.tld -p pass -ca CORP-ISSUING-CA -template VulnerableTemplate -upn Administrator@domain.tld issues a certificate that, on a typical ESC1, authenticates as Domain Administrator via PKINIT. 5. Persistence: the resulting certificate is bound to the attackers private key and survives the principals password reset. Without revocation of the issuing CA or the specific certificate, the attacker can re-authenticate indefinitely. Steps 1 through 3 are passive LDAP reads against the Configuration NC and are invisible to host-based EDR. They are only visible to defenders who enable LDAP diagnostic event logging (Event ID 1644 with the field engineering thresholds).
Cómo lo evalúa Guerrilla
Guerrilla calls Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,$((Get-ADRootDSE).configurationNamingContext)" -LDAPFilter "(objectClass=pKICertificateTemplate)" -Properties name, displayName, msPKI-Template-Schema-Version, pKIExtendedKeyUsage, msPKI-Certificate-Application-Policy, msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag, msPKI-RA-Signature, pKIExpirationPeriod, pKIOverlapPeriod, nTSecurityDescriptor. The result is normalized in memory: bit flags are decoded against the MS-CRTD enums, EKU OIDs are resolved to friendly names where known, the nTSecurityDescriptor is parsed into Enroll, AutoEnroll, WriteDacl, WriteOwner, WriteProperty, and GenericAll ACE lists, and pKIExpirationPeriod is converted from the eight-byte little-endian FILETIME representation to days. The per-CA publication list is computed by reading certificateTemplates from each pKIEnrollmentService object surfaced by ADCS-001. The check always reports PASS at this stage; ADCS-002 through ADCS-018 read the same inventory and flag the specific ESC1 through ESC16 conditions.
Valor recomendado
Inventario completo de plantillas con los atributos de seguridad documentados; todas las plantillas revisadas para inscripción de mínimo privilegio y EKU apropiado
Remediación
Enumere todas las plantillas de certificado de CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration con certutil -template o PowerShell. Para cada plantilla, documente: nombre para mostrar, versión de esquema, permisos de inscripción, EKU, indicadores de nombre (ENROLLEE_SUPPLIES_SUBJECT), indicadores de inscripción, requisito de firmas autorizadas, periodo de validez y periodo de renovación. Correlacione las plantillas publicadas en cada CA.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-8, CM-8(1), IA-5(2)
- MITRE ATT&CK
- T1649