๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ฒ ๐๐ถ๐๐ ๐ก
๐๐ฆ๐ ๐๐๐น๐ป๐ฒ๐ฟ๐ฎ๐ฏ๐ถ๐น๐ถ๐๐ถ๐ฒ๐: ๐๐ฒ๐โ๐ ๐น๐ผ๐ผ๐ธ ๐ฎ๐ ๐๐ฆ๐๐ฎ
Last time we covered ESC1. Today, another dangerousย ๐๐ฐ๐๐ถ๐๐ฒ ๐๐ถ๐ฟ๐ฒ๐ฐ๐๐ผ๐ฟ๐ ๐๐ฒ๐ฟ๐๐ถ๐ณ๐ถ๐ฐ๐ฎ๐๐ฒ ๐ฆ๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ๐ (๐๐ ๐๐ฆ)misconfiguration.
๐ฏ ๐ช๐ต๐ฎ๐ ๐ถ๐ ๐๐ฆ๐๐ฎ?
ESC2 involves certificate templates with overly broad usage, specifically templates where theย Extended Key Usage (EKU) is set to Any Purpose or no EKU is specified.
A template is vulnerable when these conditions come together:
๐งจ Low-privileged users have enrollment permissions
๐งจ Manager approval is not required
๐งจ No authorized signatures are required
๐งจ EKU isย Any Purposeย orย not specified
A certificate issued from such a template can potentially be used for many purposes, including authentication.
โ ๏ธ ๐ง๐ต๐ฒ๐ฟ๐ฒ ๐ถ๐ ๐ฎ๐ป ๐ถ๐บ๐ฝ๐ผ๐ฟ๐๐ฎ๐ป๐ ๐น๐ถ๐บ๐ถ๐๐ฎ๐๐ถ๐ผ๐ป.
Unlike ESC1, ESC2 does not simply let the requester specify another userโs identity and immediately authenticate as them. But ESC2 can become much more dangerous when combined with other AD CS configurations, for example when the certificate can be abused as anย enrollment agentย to request a certificate on behalf of another user.
๐ ๏ธ ๐๐ผ๐ ๐๐ผ ๐ฐ๐ต๐ฒ๐ฐ๐ธ ๐๐ผ๐๐ฟ ๐ฒ๐ป๐๐ถ๐ฟ๐ผ๐ป๐บ๐ฒ๐ป๐?
Just like with ESC1, run ๐๐ผ๐ฐ๐ธ๐๐บ๐ถ๐๐ต ๐ฎ by Jake Hildreth. Quick and straightforward.
๐ https://github.com/jakehildreth/locksmith2
Next time,ย ๐๐ฆ๐๐ฏ.
๐ฃ๐ฆ: And yes, that AD CS course might be coming sooner or laterโฆ ๐
