๐ Secure Bits ๐ก
๐๐ฟ๐ผ๐บ ๐ฉ๐ฒ๐ป๐ฑ๐ผ๐ฟ ๐๐ป๐๐ฒ๐ด๐ฟ๐ฎ๐๐ถ๐ผ๐ป ๐๐ผ ๐๐ผ๐บ๐ฎ๐ถ๐ป ๐๐ฑ๐บ๐ถ๐ปย โ ESC1, ESC3 & ESC4 in the Wild
Vendors love certificate templates.
Unfortunately, ๐บ๐ฎ๐ป๐ ๐ผ๐ณ ๐๐ต๐ฒ๐บ ๐๐ป๐ธ๐ป๐ผ๐๐ถ๐ป๐ด๐น๐ love ESC1, ESC3, and ESC4 paths just as much.
In this must-read two-part series, @DebugPrivilege (on X) analyzed over a ๐ฑ๐ผ๐๐ฒ๐ป ๐๐ฒ๐ป๐ฑ๐ผ๐ฟ ๐๐ฒ๐๐๐ฝ๐ (Citrix, Cisco, Microsoft Intune, Oracle, Kandji, Netskope, Veridium, Delinea, and others) โ all guiding you ๐๐ผ ๐ฐ๐ฟ๐ฒ๐ฎ๐๐ฒ ๐ฑ๐ฎ๐ป๐ด๐ฒ๐ฟ๐ผ๐๐ AD CS template configurations that open real attack paths in your environment.
๐๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐:
โ ๏ธ Templates duplicated from User, Computer, or Enrollment Agent
โ ๏ธ Supply in request enabled
โ ๏ธ Enroll or even Write permissions given to Authenticated Users
โ ๏ธ Some grant Full Control on templates (!)
๐ ๐ง๐ต๐ฒ ๐ฟ๐ฒ๐๐๐น๐?
Attackers (or low-privileged users) can request certificates ๐ถ๐บ๐ฝ๐ฒ๐ฟ๐๐ผ๐ป๐ฎ๐๐ถ๐ป๐ด ๐๐ผ๐บ๐ฎ๐ถ๐ป ๐๐ฑ๐บ๐ถ๐ป๐, or modify safe templates to make them exploitable.
๐ ๐ง๐ต๐ถ๐ ๐ถ๐๐ปโ๐ ๐๐ฒ๐ป๐ฑ๐ผ๐ฟ ๐ฏ๐ฎ๐๐ต๐ถ๐ป๐ด โ itโs about real-world risk and what to audit in your environment.
๐ย ๐๐๐น๐น ๐ฟ๐ฒ๐ฎ๐ฑ (๐ฃ๐ฎ๐ฟ๐ ๐ญ & ๐ฎ):
https://medium.com/@Debugger/from-vendor-to-esc1-ed32281b7ea7
https://medium.com/@Debugger/from-vendor-to-esc3-esc4-3f7d2d9fbde7
๐ฌ Are you checking certificate templates from vendor integrations during your audits?
