Active Directory Certificate Services ESC1

🔒 Secure Bits 💡
Have you ever heard of 𝗘𝗦𝗖 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀? I guess you have.

If you’re running 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 (𝗔𝗗 𝗖𝗦) and haven’t audited it for ESC misconfigurations — you may be sitting on a 𝘁𝗶𝗰𝗸𝗶𝗻𝗴 𝘁𝗶𝗺𝗲 𝗯𝗼𝗺𝗯. 💣

🎯 ESC vulnerabilities (Enterprise PKI Escalation Paths) are incredibly 𝗰𝗼𝗺𝗺𝗼𝗻 and highly 𝗱𝗮𝗻𝗴𝗲𝗿𝗼𝘂𝘀. Yet… most environments I assess treat AD CS like a black box — “It’s working, so let’s not touch it.”

But attackers love AD CS — it often lets them 𝗲𝘀𝗰𝗮𝗹𝗮𝘁𝗲 𝘁𝗼 𝗗𝗼𝗺𝗮𝗶𝗻 𝗔𝗱𝗺𝗶𝗻 using just a basic user account. No exploits. Just misconfigurations.

𝗟𝗲𝘁’𝘀 𝗯𝗿𝗲𝗮𝗸 𝗱𝗼𝘄𝗻 𝗘𝗦𝗖𝟭 👇
ESC1 = Certificate Template Misconfig
It lets a regular user request a certificate that can later be used to authenticate as someone else — including privileged users.

𝗧𝗼 𝗯𝗲 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗹𝗲, 𝗮𝗹𝗹 𝗼𝗳 𝘁𝗵𝗲𝘀𝗲 𝗮𝗿𝗲 𝘁𝗿𝘂𝗲:
✅ Non-privileged users can enroll in a certificate template
✅ Manager approval is not required
✅ No authorized signature is required
✅ The template supports client authentication (PKINIT, Smart Card, etc.)
✅ The requester can define the Subject Alternative Name (SAN)

𝗘𝗻𝗱 𝗿𝗲𝘀𝘂𝗹𝘁?
A low-privileged user can impersonate anyone — including a Domain Admin — using the certificate.

🛠️ 𝗛𝗼𝘄 𝘁𝗼 𝗰𝗵𝗲𝗰𝗸 𝘆𝗼𝘂𝗿 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁:
There are free tools for this:
🔹 ADProbe — My AD vulnerability scanner
🔹 Locksmith by Jake Hildreth — covers almost all ESC vulnerabilities
🔹 …

🎯 There are 𝟭𝟲 𝗘𝗦𝗖𝘀 𝗶𝗻 𝘁𝗼𝘁𝗮𝗹.

I’ll be covering them in upcoming Secure Bits posts.

👉 Did you already know what ESC1 was about?