ADCS - ESC1

Misconfigured Certificate Template – ESC1

In order to exploit this attack, the following pre-requisite is required:

Pre-Requisite:

  • Manager approval is disabled –> mspki-enrollment-flag attribute needs to be set to 0x00000000

  • No authorized signature is required –> msPKI-RA-Signature attribute needs to be set to 0x00000000

  • Certificate Template allows a requestor to specify a SAN in the Certificate Signing Request –> msPKI-Certificate-Name-Flag attribute needs to be set to 0x00000001. This flag instructs the client to supply subject information in the certificate request.

  • Certificate Template defines Extended Key Usage (EKU) that enables Client Authentication –> mspki-certificate-application-policy attribute needs to contain at least one of the following: Client Authentication (1.3.6.1.5.5.7.3.2), PKINIT Client Authentication (1.3.6.1.5.2.3.4), Smart Card Logon (OID 1.3.6.1.4.1.311.20.2.2), Any Purpose (OID 2.5.29.37.0) or no EKU (SubCA).

  • Certificate Template needs to be published in Active Directory

  • Non-Privileged user can enroll to the Certificate Template

Enumerate

sudo certipy find -u joaquin.Pereida@maryland.local -p 'horse' -dc-ip 192.168.56.12

  • authentication with the pfx we request before

Attack Attack and Dump Dump!

PreviousESC8 - with certipyNextADCS - ESC2 & ESC3

Last updated