ESC9: No Security Extension

High

ESC9 takes advantage of certificate templates that don't specify the Extended Key Usage extension, potentially allowing certificates to be used for any purpose, including authentication.

Diagram illustrating ESC9 attack vector with missing Extended Key Usage
ADCS Security Tools - Special Offer
Attack Details

ESC9 exploits certificate templates that lack the Extended Key Usage (EKU) extension. Without this extension, certificates can potentially be used for any purpose, including authentication, even if that wasn't the original intent. This can lead to misuse of certificates and potential security breaches.

Learn more about AD CS defense strategies to protect against this and other attacks.

Impact
  • Misuse of certificates for unintended purposes
  • Potential for authentication bypass
  • Increased attack surface for lateral movement
  • Difficulty in enforcing proper certificate usage
Exploitation Steps
  1. Identify certificate templates without specified EKU
  2. Enroll in these templates to obtain versatile certificates
  3. Use the obtained certificates for unintended purposes (e.g., authentication)
  4. Exploit the lack of restrictions to gain unauthorized access
Penetration Testing Considerations

When conducting AD CS penetration testing, consider the following aspects specific to ESC9: No Security Extension:

  • Identify vulnerable certificate templates and misconfigurations
  • Assess the potential impact on the overall AD CS security
  • Evaluate the effectiveness of existing security controls
  • Test for the ability to exploit this vulnerability in the target environment
  • Document findings and provide actionable remediation steps
Command Examples

Enumerate certificate templates without EKU

certutil -v -template | findstr /i "pKIExtendedKeyUsage" | findstr /v /i "1.3.6.1.5.5.7.3"
Get-CertificateTemplate | Where-Object {$_.ExtendedKeyUsage -eq $null} | Select-Object Name

Request a certificate from a template without EKU

certreq -submit -attrib "CertificateTemplate:VulnerableTemplate" request.inf
Get-Certificate -Template VulnerableTemplate -CertStoreLocation Cert:\CurrentUser\My

Use Certify to find and exploit vulnerable templates

.\Certify.exe find /vulnerable /template:*
.\Certify.exe request /ca:dc.domain.com\CA-NAME /template:VulnerableTemplate
Detection
  • Regularly audit certificate templates for missing or misconfigured EKU
  • Monitor for unusual certificate usage patterns
  • Implement logging and alerting for certificate enrollments in sensitive templates
  • Use security information and event management (SIEM) tools to correlate certificate-related events
  • Conduct periodic security assessments of the PKI infrastructure
Event IDs
  • 4886: Certificate Services approved a certificate request
  • 4887: Certificate Services denied a certificate request
  • 5136: A directory service object was modified (for monitoring template changes)
Mitigation and AD CS Security Best Practices

To mitigate ESC9: No Security Extension and enhance overall AD CS security, consider implementing the following measures:

  • Ensure all certificate templates specify appropriate Extended Key Usage
  • Regular audit of certificate template configurations
  • Implement strict certificate usage policies
  • Use security descriptors to limit who can enroll in sensitive templates
  • Implement certificate path validation in applications
  • Regularly conduct AD CS penetration testing to identify and address vulnerabilities
  • Implement the principle of least privilege across your AD CS infrastructure
  • Maintain up-to-date documentation of your AD CS configuration and security policies
References
Sponsored Content
Advertisement

Related AD CS Attacks

Explore other attack vectors that target Active Directory Certificate Services:

Diagram illustrating ESC8 attack vector with NTLM relay to ADCS HTTP endpoints
ESC8: NTLM Relay to ADCS HTTP Endpoints
Critical
ESC8 exploits the ability to relay NTLM authentication to ADCS HTTP endpoints, potentially allowing an attacker to obtain certificates for other users, including domain administrators.
Learn More
Diagram illustrating ESC1 attack vector
ESC1: Misconfigured Certificate Templates
Critical
ESC1 exploits overly permissive enrollment rights in certificate templates, allowing low-privileged users to enroll in certificates that can be used for authentication, potentially leading to privilege escalation.
Learn More
Diagram illustrating ESC2 attack vector with Enrollment Agent abuse
ESC2: Misconfigured Enrollment Agent Templates
High
ESC2 abuses misconfigured Enrollment Agent templates, allowing an attacker to request certificates on behalf of other users, potentially leading to privilege escalation and unauthorized access.
Learn More
View All AD CS Attacks