Understanding ESC15: A New Privilege Escalation Vulnerability in Active Directory Certificate Services (ADCS) [EN]

Active Directory Certificate Services (ADCS) play a critical role in managing and securing the digital identities of users and devices in enterprise environments. However, vulnerabilities in this system can lead to disastrous security breaches. On October 7, 2024, a new attack method targeting ADCS, dubbed ESC15, was discovered. This method allows unauthorized users to escalate privileges within an Active Directory (AD) environment by exploiting misconfigured certificate templates.

The ESC15 vulnerability is an enhancement of previously known techniques like ESC1 but bypasses many of the constraints set by older attack vectors. Notably, this attack method was added to Certipy, a popular tool in the offensive security community, thanks to contributions from dru1d-foofus and TrustedSec’s Justin Bollinger. In this blog post, we’ll dive into how ESC15 works, how to detect vulnerable environments, and the steps to mitigate the risk.

ESC15 is an attack vector that exploits Certificate Templates with Schema Version 1 in ADCS. This method builds on ESC1, which allowed attackers to request certificates for privileged accounts. However, ESC15 bypasses even more security checks, making it a more dangerous variant.

Key Exploit Conditions for ESC15:

1. Certificate Template Schema Version is 1.
2. The Certificate Template allows arbitrary subjectAltName values in the Certificate Signing Request (CSR).
3. Enrollment Rights for non-privileged users

By exploiting these conditions, attackers can impersonate privileged users like Domain Admins and escalate their privileges within the domain.

In the original ESC1 vulnerability, attackers could request a certificate for any user if:

1. The Certificate Template allowed users to supply the Subject in the CSR.
2. The template included at least one EKU (Enhanced Key Usage), such as Domain Authentication, allowing authentication in the domain.

ESC15 improves upon ESC1 by allowing attackers to exploit Schema Version 1 Certificate Templates even if they lack an EKU for Domain Authentication.

On October 7, 2024, a GitHub user named dru1d-foofus submitted a Pull Request to the Certipy repository, automating the exploitation of ESC15. The Pull Request (PR #228) was built upon an earlier discovery by TrustedSec’s Justin Bollinger (@Bandrel). Thanks to these contributors, offensive security professionals now have the ability to automate the ESC15 exploitation process within the Certipy tool.

For those interested, you can view the Pull Request here: Certipy PR #228.

Administrators must first determine whether any Certificate Templates in their environment are vulnerable to ESC15. This can be done through a combination of manual checks and PowerShell commands. Below is the PowerShell command to identify vulnerable templates:

 

Manual Detection Process:

1. Log into the Certificate Authority (CA) server.
2. Open Certtmpl.msc.
3. Identify Certificate Templates with Schema Version 1.
4. Check if the Subject Name is set to Supplied in the Request.
5. In the Security tab, ensure only authorized users have enroll permissions.
6. Verify in the Extensions tab that no Domain Authentication EKUs are present.

The Certipy tool can be used to exploit the ESC15 vulnerability. The following steps demonstrate how to request a certificate using a misconfigured template and escalate privileges.

Step 1: Cloning and Installing Certipy

You need to clone the Certipy repository and install its dependencies:

 

Step 2: Requesting a Certificate for Domain Admin

The next step is to use Certipy to request a certificate for a Domain Admin using a vulnerable Schema Version 1 certificate template.

 

Explanation:

• -template “WebServer”: The vulnerable template.
• -upn: Requesting a certificate for Domain Admin.
• –application-policies ‘Client Authentication‘: Manipulating the EKU field to include client authentication.

Once the certificate is obtained, it can be used to authenticate as the domain administrator.

Step 3: Adding Attacker to Domain Admins

With the obtained certificate, the attacker can use Certipy to interact with the LDAP interface and add themselves to the Domain Admins group.

This gives the attacker full control over the domain.

Step 1: Analyze Vulnerable Templates

Review all Certificate Templates in your ADCS environment, particularly those with Schema Version 1. Templates that are no longer required should be removed. Alternatively, upgrade them to Schema Version 2 to mitigate the risk of exploitation.

Step 2: Disable the “Supplied in the Request” Option

Modify any vulnerable templates by disabling the Supplied in the Request option and instead selecting Built from information in Active Directory. This prevents attackers from specifying arbitrary subject names when requesting certificates.

Step 3: Updating the Template Using ADSIEDIT

For templates with Schema Version 1, changes cannot be made via the Certtmpl.msc interface. You will need to use ADSIEDIT to update the msPKI-Certificate-Name-Flag attribute.

Once this change is applied, attempts to exploit ESC15 will fail.

This research and discovery of ESC15 are made possible through the collaboration of Justin Bollinger (@Bandrel) from TrustedSec and dru1d-foofus, who contributed the Certipy PR #228 to automate this attack. The security community owes a debt of gratitude to these contributors for their tireless efforts in advancing the understanding of ADCS security risks.

Certipy, a tool developed by @ly4k, continues to be a valuable asset in testing ADCS environments for security vulnerabilities. You can follow the project’s development on GitHub at Certipy GitHub Repository.

The ESC15 vulnerability is a significant risk for organizations using ADCS, allowing attackers to elevate privileges and compromise domain administrator accounts. While Microsoft has yet to release a patch, administrators can protect their environments by carefully reviewing and updating vulnerable certificate templates.

By leveraging tools like Certipy and PowerShell scripts, defenders can quickly identify and remediate risky templates in their Active Directory environments.

Stay vigilant and ensure your certificate templates are correctly configured to prevent such attacks from being successful.

• https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc
• https://github.com/ly4k/Certipy/pull/228