ESC11: Vulnerable Certificate Issuance Policy

High

ESC11 exploits misconfigured certificate issuance policies, allowing attackers to obtain certificates that should be restricted, potentially leading to unauthorized access or privilege escalation.

Warning: The information provided here is for educational purposes only. Always ensure you have proper authorization before testing these attacks in any environment.

Diagram illustrating ESC11 attack vector with vulnerable certificate issuance policy

Attack Details

ESC11 targets misconfigured certificate issuance policies in AD CS. When these policies are not properly set or enforced, attackers can request and obtain certificates that should be restricted to specific users or groups. This can lead to unauthorized access to sensitive resources or even privilege escalation within the domain.

Learn more about AD CS defense strategies to protect against this and other attacks.

Impact

Issuance of certificates with elevated privileges
Bypass of intended security controls
Potential for lateral movement and privilege escalation
Undermining of the entire certificate-based security model

Exploitation Steps

Identify vulnerabilities in certificate issuance policies
Request certificates that should be restricted
Use obtained certificates for unauthorized access or privilege escalation
Exploit weak policy enforcement to obtain high-privilege certificates

Penetration Testing Considerations

When conducting AD CS penetration testing, consider the following aspects specific to ESC11: Vulnerable Certificate Issuance Policy:

Identify vulnerable certificate templates and misconfigurations
Assess the potential impact on the overall AD CS security
Evaluate the effectiveness of existing security controls
Test for the ability to exploit this vulnerability in the target environment
Document findings and provide actionable remediation steps

Command Examples

Enumerate certificate templates and their issuance policies

certutil -v -template | findstr /i "msPKI-Certificate-Name-Flag" | findstr /i "ENROLLEE_SUPPLIES_SUBJECT"

Get-CertificateTemplate | Where-Object {$_.CertificateNameFlag -band 1} | Select-Object Name, CertificateNameFlag

Request a certificate using a vulnerable template

certreq -submit -attrib "CertificateTemplate:VulnerableTemplate" -attrib "SAN:[email protected]" request.inf

Use Certify to find and exploit vulnerable templates

.\Certify.exe find /vulnerable /template:*

.\Certify.exe request /ca:dc.domain.com\CA-NAME /template:VulnerableTemplate /altname:administrator

Detection

Implement comprehensive logging for all certificate issuance activities
Use security information and event management (SIEM) tools to monitor certificate requests
Regularly audit certificate issuance logs for anomalies
Implement alerting for unusual certificate issuance patterns
Conduct periodic reviews of certificate issuance policies

Event IDs

4886: Certificate Services approved a certificate request
4887: Certificate Services denied a certificate request
4890: The certificate manager settings for Certificate Services changed
5136: A directory service object was modified (for monitoring policy changes)

Mitigation and AD CS Security Best Practices

To mitigate ESC11: Vulnerable Certificate Issuance Policy and enhance overall AD CS security, consider implementing the following measures:

Implement and regularly review certificate issuance policies
Use role-based access control for certificate requests
Implement automated policy enforcement mechanisms
Regularly audit certificate issuance logs
Implement strong authentication for certificate requests
Regularly conduct AD CS penetration testing to identify and address vulnerabilities
Implement the principle of least privilege across your AD CS infrastructure
Maintain up-to-date documentation of your AD CS configuration and security policies

References

Related AD CS Attacks

Explore other attack vectors that target Active Directory Certificate Services:

Diagram illustrating ESC8 attack vector with NTLM relay to ADCS HTTP endpoints

ESC8: NTLM Relay to ADCS HTTP Endpoints

Critical

ESC8 exploits the ability to relay NTLM authentication to ADCS HTTP endpoints, potentially allowing an attacker to obtain certificates for other users, including domain administrators.

Learn More

ESC1: Misconfigured Certificate Templates

Critical

ESC1 exploits overly permissive enrollment rights in certificate templates, allowing low-privileged users to enroll in certificates that can be used for authentication, potentially leading to privilege escalation.

Learn More

Diagram illustrating ESC6 attack vector with ADCS backup extraction

ESC6: ADCS Backup Extraction

Critical

ESC6 involves extracting and abusing ADCS backups to gain unauthorized access to the CA's private keys, potentially allowing an attacker to issue any certificate or decrypt intercepted communications.

Learn More

View All AD CS Attacks