ESC4: Vulnerable Certificate Template Access Control

Critical

ESC4 exploits vulnerable access controls on certificate templates, allowing attackers to modify high-privileged templates and create malicious certificates for privilege escalation.

Diagram illustrating ESC4 attack vector with vulnerable certificate template access control
ADCS Security Tools - Special Offer
Attack Details

ESC4 targets the access controls on certificate templates, particularly those used for high-privileged accounts. If an attacker can modify these templates, they can create certificates that grant elevated privileges, potentially leading to complete domain compromise.

Learn more about AD CS defense strategies to protect against this and other attacks.

Impact
  • Unauthorized modification of certificate templates
  • Creation of malicious high-privileged certificates
  • Complete domain compromise
  • Persistent backdoor access to the AD infrastructure
Exploitation Steps
  1. Identify certificate templates with weak access controls
  2. Modify the template to enable dangerous settings (e.g., client authentication, enrollee supplies subject)
  3. Enroll in the modified template to obtain a high-privileged certificate
  4. Use the certificate for authentication and privilege escalation
Penetration Testing Considerations

When conducting AD CS penetration testing, consider the following aspects specific to ESC4: Vulnerable Certificate Template Access Control:

  • Identify vulnerable certificate templates and misconfigurations
  • Assess the potential impact on the overall AD CS security
  • Evaluate the effectiveness of existing security controls
  • Test for the ability to exploit this vulnerability in the target environment
  • Document findings and provide actionable remediation steps
Command Examples

Enumerate Certificate Templates with Weak Access Controls

certutil -v -template | findstr /i "pKIExtendedKeyUsage" | findstr /i "1.3.6.1.5.5.7.3.2"
.\Certify.exe find /vulnerable /template:*

Modify Certificate Template

dsacls "CN=VulnerableTemplate,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=com" /G "DOMAIN\User:WDAC;;FULL"

Request Certificate Using Modified Template

certreq -submit -attrib "CertificateTemplate:VulnerableTemplate" request.inf
.\Certify.exe request /ca:dc.domain.com\CA-NAME /template:VulnerableTemplate
Detection
  • Monitor and alert on changes to certificate templates, especially those used for privileged accounts
  • Implement auditing for all certificate template modifications
  • Regularly review access control lists (ACLs) on certificate templates
  • Use automated tools to check for misconfigurations in template settings
Event IDs
  • 5136: A directory service object was modified (for monitoring template changes)
  • 4662: An operation was performed on an object (for monitoring template access)
  • 4670: Permissions on an object were changed (for monitoring template permission changes)
Mitigation and AD CS Security Best Practices

To mitigate ESC4: Vulnerable Certificate Template Access Control and enhance overall AD CS security, consider implementing the following measures:

  • Implement strict access controls on certificate templates
  • Regular audit of template modifications
  • Use of Protected Groups for high-privileged certificate templates
  • Implement change management processes for template modifications
  • Use security descriptors to limit who can enroll in sensitive templates
  • Regularly conduct AD CS penetration testing to identify and address vulnerabilities
  • Implement the principle of least privilege across your AD CS infrastructure
  • Maintain up-to-date documentation of your AD CS configuration and security policies
References
Sponsored Content
Advertisement

Related AD CS Attacks

Explore other attack vectors that target Active Directory Certificate Services:

Diagram illustrating ESC12 attack vector with vulnerable certificate revocation configuration
ESC12: Vulnerable Certificate Revocation Configuration
Critical
ESC12 targets misconfigured or absent certificate revocation mechanisms, allowing attackers to continue using compromised or expired certificates for malicious purposes.
Learn More
Diagram illustrating ESC15 attack vector with vulnerable certificate request handling
ESC15: Vulnerable Certificate Request Handling
Critical
ESC15 targets vulnerabilities in how certificate requests are processed and validated, potentially allowing attackers to manipulate request data and obtain unauthorized certificates.
Learn More
Diagram illustrating ESC7 attack vector with vulnerable Certificate Authority access control
ESC7: Vulnerable Certificate Authority Access Control
Critical
ESC7 exploits weak access controls on the Certificate Authority itself, allowing attackers to directly manipulate CA operations and potentially compromise the entire PKI infrastructure.
Learn More
View All AD CS Attacks