{"id":15940,"date":"2021-06-14T10:20:24","date_gmt":"2021-06-14T09:20:24","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=15940"},"modified":"2021-09-14T11:51:05","modified_gmt":"2021-09-14T10:51:05","slug":"microsoft-adcs-abusing-pki-in-active-directory-environment","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2021\/06\/microsoft-adcs-abusing-pki-in-active-directory-environment\/","title":{"rendered":"Microsoft ADCS \u2013 Abusing PKI in Active Directory Environment"},"content":{"rendered":"

Due to the ever-growing use of certificates in modern applications, a large number of Active Directory infrastructures make use of Public Key Infrastructures (PKI) features. These features are provided by Certification Authorities (CA) which are either external to Active Directory or deeply coupled with it.<\/p>\n

Similar intricate systems, such as Microsoft Exchange, have highlighted a significant number of ways<\/a> that someone with a user account on Active Directory and malicious intent can benefit from to take over Active Directory.<\/p>\n

Active Directory Certificate Services (ADCS) have never really been under security scrutiny until a few years ago (by C. Falta<\/a> and later Q&D Security<\/a>). We will therefore focus today on how similar techniques can be used to gain Domain Admins privileges.<\/p>\n

Note: <\/strong>this article assumes that the reader has a correct understanding of Active Directory<\/a> and\/or PKI<\/a> operation; some sections may be skipped depending on the reader experience and level of expertise.<\/p>\n

Table of contents<\/h2>\n
    \n
  1. Active Directory pentest: mission briefing<\/a>\n
      \n
    1. Context and objectives<\/a><\/li>\n
    2. Elevating privileges in an AD environment<\/a>\n
        \n
      1. From lateral movement…<\/a><\/li>\n
      2. … to compromise graphs<\/a><\/li>\n
      3. Drafting the domain compromise graph<\/a><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n
      4. Deep dive into Microsoft ADCS<\/a>\n
          \n
        1. What is ADCS?<\/a><\/li>\n
        2. How does ADCS operate?<\/a>\n
            \n
          1. Active Directory: Public Key Services<\/a><\/li>\n
          2. ADCS server: local configuration<\/a><\/li>\n
          3. Mixing it all together!<\/a><\/li>\n<\/ol>\n<\/li>\n
          4. Kerberos, smartcard logon and certificate authentication<\/a>\n
              \n
            1. Kerberos 101<\/a><\/li>\n
            2. Introducing PKINIT<\/a><\/li>\n
            3. Using PKINIT in real life<\/a><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n
            4. Elevating privileges with ADCS<\/a>\n
                \n
              1. Exploiting an existing ADCS misconfiguration<\/a><\/li>\n
              2. The insidious case of EDITF_ATTRIBUTESUBJECTALTNAME2<\/a><\/li>\n
              3. Local administrator rights on ADCS server<\/a><\/li>\n
              4. ACL exploit on user objects (1)<\/a><\/li>\n
              5. ACL exploit on user objects (2)<\/a><\/li>\n
              6. ACL exploit on certificate templates<\/a><\/li>\n
              7. ACL exploit on enrollment services<\/a><\/li>\n<\/ol>\n<\/li>\n
              8. Current mitigations<\/a>\n
                  \n
                1. Integration within the Active Directory tiering model<\/a>\n
                    \n
                  1. ESAE: Enhanced Security admin Environment<\/a><\/li>\n
                  2. Moving ADCS objects up one tier!<\/a><\/li>\n<\/ol>\n<\/li>\n
                  3. Proper handling of corner cases<\/a>\n
                      \n
                    1. Context example<\/a><\/li>\n
                    2. Setting the manager approval<\/a><\/li>\n
                    3. Choosing your CA managers<\/a><\/li>\n<\/ol>\n<\/li>\n
                    4. Adding the detection layer<\/a><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                      <\/h2>\n

                       <\/p>\n

                      <\/a>Active Directory pentest: mission briefing<\/h1>\n

                      This article will tackle Microsoft ADCS and its potential issues under the specific prism of an Active Directory pentest, but the conclusions will be applicable on a broader scope: red team assignments, ADCS hardening, etc.<\/p>\n

                       <\/p>\n

                      <\/a>Context and objectives<\/h2>\n

                      An Active Directory pentest is a type of assignment where the sponsor of the audit is asking the pentester to interact with the audit target\u2019s infrastructure to find ways of gaining control of Active Directory. The auditor usually performs this task under the two following approaches:<\/p>\n