ESC12: Vulnerable Certificate Revocation Configuration

Critical

ESC12 targets misconfigured or absent certificate revocation mechanisms, allowing attackers to continue using compromised or expired certificates for malicious purposes.

Warning: The information provided here is for educational purposes only. Always ensure you have proper authorization before testing these attacks in any environment.

Diagram illustrating ESC12 attack vector with vulnerable certificate revocation configuration

Attack Details

ESC12 exploits weaknesses in certificate revocation configurations within AD CS. When revocation mechanisms are not properly implemented or maintained, compromised or expired certificates can continue to be accepted as valid. This allows attackers to maintain unauthorized access even after a breach has been detected.

Learn more about AD CS defense strategies to protect against this and other attacks.

Impact

Continued use of compromised certificates
Inability to effectively respond to security incidents
Potential for long-term unauthorized access
Undermining of the entire PKI trust model

Exploitation Steps

Identify weaknesses in certificate revocation mechanisms
Obtain a valid certificate through legitimate or illegitimate means
Continue using the certificate even after it should have been revoked
Exploit gaps in revocation checking to maintain unauthorized access

Penetration Testing Considerations

When conducting AD CS penetration testing, consider the following aspects specific to ESC12: Vulnerable Certificate Revocation Configuration:

Identify vulnerable certificate templates and misconfigurations
Assess the potential impact on the overall AD CS security
Evaluate the effectiveness of existing security controls
Test for the ability to exploit this vulnerability in the target environment
Document findings and provide actionable remediation steps

Command Examples

Check CRL distribution points for a certificate

certutil -url cert.cer

Verify CRL configuration on the CA

certutil -config "CA_SERVER\CA_NAME" -getreg CA\CRLPublicationURLs

Manually publish a CRL

certutil -CRL

Check OCSP configuration

certutil -config "CA_SERVER\CA_NAME" -getreg CA\OCSPURLs

Test certificate revocation status

certutil -verify -urlfetch cert.cer

Detection

Implement comprehensive logging for all certificate usage
Regularly audit and test certificate revocation processes
Monitor for usage of certificates that should have been revoked
Implement real-time alerting for failed revocation checks
Conduct periodic assessments of the entire PKI infrastructure

Event IDs

4886: Certificate Services approved a certificate request
4887: Certificate Services denied a certificate request
4870: Certificate Services revoked a certificate
4884: Certificate Services retrieved an archived key

Mitigation and AD CS Security Best Practices

To mitigate ESC12: Vulnerable Certificate Revocation Configuration and enhance overall AD CS security, consider implementing the following measures:

Implement and maintain robust certificate revocation mechanisms (CRL, OCSP)
Regular testing and validation of revocation processes
Implement short-lived certificates where possible
Ensure timely distribution and updating of Certificate Revocation Lists (CRLs)
Use Online Certificate Status Protocol (OCSP) for real-time certificate validation
Regularly conduct AD CS penetration testing to identify and address vulnerabilities
Implement the principle of least privilege across your AD CS infrastructure
Maintain up-to-date documentation of your AD CS configuration and security policies

References

Related AD CS Attacks

Explore other attack vectors that target Active Directory Certificate Services:

Diagram illustrating ESC3 attack vector with misconfigured Enrollment Agent restrictions

ESC3: Misconfigured Enrollment Agent Restrictions

High

ESC3 takes advantage of misconfigured Enrollment Agent restrictions, allowing an attacker with Enrollment Agent privileges to request certificates for accounts they shouldn't have access to.

Learn More

Diagram illustrating ESC8 attack vector with NTLM relay to ADCS HTTP endpoints

ESC8: NTLM Relay to ADCS HTTP Endpoints

Critical

ESC8 exploits the ability to relay NTLM authentication to ADCS HTTP endpoints, potentially allowing an attacker to obtain certificates for other users, including domain administrators.

Learn More

Diagram illustrating ESC7 attack vector with vulnerable Certificate Authority access control

ESC7: Vulnerable Certificate Authority Access Control

Critical

ESC7 exploits weak access controls on the Certificate Authority itself, allowing attackers to directly manipulate CA operations and potentially compromise the entire PKI infrastructure.

Learn More

View All AD CS Attacks