Active Directory Certificate Services ESC3

๐Ÿ”’ Secure Bits ๐Ÿ’ก
Weโ€™re back with the next post in the ๐—˜๐—ฆ๐—– ๐˜ƒ๐˜‚๐—น๐—ป๐—ฒ๐—ฟ๐—ฎ๐—ฏ๐—ถ๐—น๐—ถ๐˜๐˜† series.

Today, weโ€™re diving into ๐—˜๐—ฆ๐—–๐Ÿฏ โ€” one of the more overlooked but equally dangerous AD CS misconfigs. If you missed the previous ones, ๐—ฐ๐—ต๐—ฒ๐—ฐ๐—ธ ๐—ผ๐˜‚๐˜ ๐—˜๐—ฆ๐—–๐Ÿญ ๐—ฎ๐—ป๐—ฑ ๐—˜๐—ฆ๐—–๐Ÿฎ for context.

๐—Ÿ๐—ฒ๐˜โ€™๐˜€ ๐—ท๐˜‚๐—บ๐—ฝ ๐—ถ๐—ป๐˜๐—ผ ๐—˜๐—ฆ๐—–๐Ÿฏย ๐Ÿ‘‡

๐—˜๐—ฆ๐—–๐Ÿฏ = ๐—˜๐—ป๐—ฟ๐—ผ๐—น๐—น๐—บ๐—ฒ๐—ป๐˜ ๐—”๐—ด๐—ฒ๐—ป๐˜ ๐—”๐—ฏ๐˜‚๐˜€๐—ฒ๐—ฑ
This oneโ€™s a big deal โ€” it allows a non-privileged user to act as a certificate authority in disguise. If ESC3 exists in your environment, an attacker can issue certificates on behalf of any identity, including Domain Admins.

๐—›๐—ผ๐˜„ ๐—ฑ๐—ผ๐—ฒ๐˜€ ๐—˜๐—ฆ๐—–๐Ÿฏ ๐—ต๐—ฎ๐—ฝ๐—ฝ๐—ฒ๐—ป?
โœ… Non-privileged users can enroll in the template
โœ… Manager approval is not required
โœ… No authorized signature is required
โœ… Template contains the Certificate Request Agent EKU
โŒ No restrictions placed on who can use Enrollment Agent templates

๐—ช๐—ต๐—ฎ๐˜ ๐—ฑ๐—ผ๐—ฒ๐˜€ ๐˜๐—ต๐—ฒ ๐—ฎ๐˜๐˜๐—ฎ๐—ฐ๐—ธ๐—ฒ๐—ฟ ๐—ฑ๐—ผ?
1๏ธโƒฃ Enrolls in the vulnerable Enrollment Agent template
2๏ธโƒฃ Uses the resulting cert to request a new certificate for any other user (e.g., Domain Admin)
โžก๏ธ There must be another interesting template so you have what to request for (for example some Authentication EKU for impersonation)
3๏ธโƒฃ Authenticates as that user โ€” game over.

๐—ช๐—ฎ๐—ป๐˜ ๐˜๐—ผ ๐˜๐—ฒ๐˜€๐˜ ๐˜†๐—ผ๐˜‚๐—ฟ ๐—ฒ๐—ป๐˜ƒ๐—ถ๐—ฟ๐—ผ๐—ป๐—บ๐—ฒ๐—ป๐˜?
Check out tools like:
๐Ÿ”น ADProbe (my security auditing tool)
๐Ÿ”น Locksmith by Jake Hildreth
๐Ÿ”น Certipy
๐Ÿ”น …

Did you already know about ESC3? Or is this a blind spot for your org?