Active Directory Certificate Services – ESC1

🔒 Secure Bits 💡

Have you ever heard of 𝗘𝗦𝗖 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀? I guess you have.

If you’re running 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 (𝗔𝗗 𝗖𝗦) and haven’t audited it for ESC misconfigurations – you may be sitting on a 𝘁𝗶𝗰𝗸𝗶𝗻𝗴 𝘁𝗶𝗺𝗲 𝗯𝗼𝗺𝗯. 💣

🎯 ESC vulnerabilities (Enterprise PKI Escalation Paths) are incredibly 𝗰𝗼𝗺𝗺𝗼𝗻 and highly 𝗱𝗮𝗻𝗴𝗲𝗿𝗼𝘂𝘀. Yet… most environments I assess treat AD CS like a black box – “It’s working, so let’s not touch it.”

But attackers love AD CS – it often lets them 𝗲𝘀𝗰𝗮𝗹𝗮𝘁𝗲 𝘁𝗼 𝗗𝗼𝗺𝗮𝗶𝗻 𝗔𝗱𝗺𝗶𝗻 using just a basic user account. No exploits. Just misconfigurations.

𝗟𝗲𝘁’𝘀 𝗯𝗿𝗲𝗮𝗸 𝗱𝗼𝘄𝗻 𝗘𝗦𝗖𝟭 👇

ESC1 = Certificate Template Misconfig

It lets a regular user request a certificate that can later be used to authenticate as someone else – including privileged users.

𝗧𝗼 𝗯𝗲 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗹𝗲, 𝗮𝗹𝗹 𝗼𝗳 𝘁𝗵𝗲𝘀𝗲 𝗮𝗿𝗲 𝘁𝗿𝘂𝗲:

✅ Non-privileged users can enroll in a certificate template

✅ Manager approval is not required

✅ No authorized signature is required

✅ The template supports client authentication (PKINIT, Smart Card, etc.)

✅ The requester can define the Subject Alternative Name (SAN)

𝗘𝗻𝗱 𝗿𝗲𝘀𝘂𝗹𝘁?

A low-privileged user can impersonate anyone – including a Domain Admin – using the certificate.

🛠️ 𝗛𝗼𝘄 𝘁𝗼 𝗰𝗵𝗲𝗰𝗸 𝘆𝗼𝘂𝗿 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁?

The simplest thing to do is running 𝗟𝗼𝗰𝗸𝘀𝗺𝗶𝘁𝗵 𝟮 by Jake Hildreth. Quick and straightforward – the screenshot is from the tool.

(🔗 https://github.com/jakehildreth/locksmith2).

🎯 I got lost in them, but I believe 𝗶𝗻 𝘁𝗼𝘁𝗮𝗹 𝘁𝗵𝗲𝗿𝗲 𝗶𝘀 𝟭𝟲+ 𝗘𝗦𝗖𝘀, right? I’ll be covering them in upcoming Secure Bits posts.

𝗣𝗦: There might be a course focused on AD CS sooner or later…