ADCS Questions Flashcards
What is ESC1
A vulnerability where attackers exploit certificate templates allowing requesters to specify a SAN and enroll without approval, leading to domain admin impersonation.
How does ESC1 enable privilege escalation?
By requesting a certificate with a SAN set to a privileged account (e.g., domain admin UPN) and using it for Kerberos authentication (PKINIT).
What is ESC4?
Exploiting write permissions on certificate templates to modify them (e.g., enabling SAN, Client Authentication) and enroll as a privileged user.
What permissions enable ESC4?
Write, WriteDacl, or Owner rights on a template, allowing attackers to reconfigure it maliciously.
What is ESC8?
Relaying NTLM authentication to AD CS HTTP endpoints to enroll in certificates and impersonate victims (e.g., Domain Admins).
SAN
Subject Alternative Name
What is SAN?
A field in certificates that allows authentication for multiple identities (e.g., admin@domain.com). Exploited in ESC1/ESC4.
EKU
Extended Key Usage
What is EKU?
Defines a certificate’s purpose (e.g., Client Authentication for Kerberos). Enabling this in templates allows domain escalation.
PKINIT
Kerberos extension using certificates (instead of passwords) for authentication. Used to exploit AD CS certificates.
NTLM Relay
Forwarding captured NTLM authentication to another service (e.g., AD CS HTTP) to gain unauthorized access.
WriteDacl
Permission to modify an object’s security settings (e.g., altering a certificate template’s ACL for ESC4).
Certify
Tool to enumerate AD CS templates, request certificates, and exploit misconfigurations (ESC1/ESC4).
ntlmrelayx
Relays NTLM authentication to services like AD CS HTTP endpoints (used in ESC8).
BloodHound
Maps AD permissions to find vulnerable templates (e.g., WriteDacl for ESC4).
SharpCerti
C# tool to request certificates and exploit AD CS vulnerabilities (alternative to Certify).
How to mitigate ESC1?
Disable SAN editing in templates.
Require manager approval for enrollment.
How to mitigate ESC4?
Restrict Write/WriteDacl permissions on templates.
Monitor template changes (Event ID 5136).
How to mitigate ESC8?
Disable HTTP enrollment.
Enforce SMB signing/EPA.
General AD CS hardening steps.
Audit template permissions.
Restrict Client Authentication EKUs.
Use LDAPS/SMB instead of HTTP.
What is a UPN?
A UPN (User Principal Name) isa user’s login name formatted like an email address (e.g., john.doe@example.com) in a Microsoft Active Directory.It’s used for logging into domain resources.
