Certificate authority
Theory
Certificate Authority misconfiguration
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on a dangerous CA setting (i.e. the EDITF_ATTRIBUTESUBJECTALTNAME2 flag). The escalation vector was dubbed ESC6.
When the flag is set on the CA, templates configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose (OID 2.5.29.37.0), or no EKU (SubCA)) and allowing low-priv users to enroll can be abused to authenticate as any other user/machine/admin.
The default User template checks all the template requirements stated above.
If the CA is configured with the EDITF_ATTRIBUTESUBJECTALTNAME2 flag (admins tend to enable that flag without knowing the security implications), and the User template is enabled (which is very often), any user can escalate to domain admin.
May 2022 security updates broke the ESC6 attack.
YubiHSM Key Storage Provider
As described by Hans-Joachim Knobloch in his article ESC12 – Shell access to ADCS CA with YubiHSM, administrators may configure the Certificate Authority to store its private key on an external device like "Yubico YubiHSM2", over storing it in the software storage.
This is a USB device connected to the CA server via a USB port, or a USB device server in case of the CA server is a virtual machine.
In order to generate and use keys in the YubiHSM, the Key Storage Provider must use an authentication key (sometimes dubbed "password"). This key/password is stored in the registry under
HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPasswordin cleartext.
Practice
(ESC6) EDITF_ATTRIBUTESUBJECTALTNAME2
From UNIX-like systems, Certipy (Python) can be used to enumerate info about the CAs, including the "User Specified SAN" flag state which is an alias to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.
certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep "User Specified SAN"By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.
Once the right template is found (i.e. the default User template) (how to enumerate), a request shall be made to obtain a certificate, with another high-priv user set as SAN (subjectAltName).
# To specify a user account in the SAN
certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -upn 'domain admin'
# To specify a computer account in the SAN
certipy req -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -ca 'ca_name' -template 'vulnerable template' -dns 'dc.domain.local'The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.
(ESC12) Shell access to ADCS CA with YubiHSM
Redirect the USB device server
At the time of writing, no solution exists to perform this attack from a UNIX-like machine.
Forge a certificate
If the CA's private key is stored on a physical USB device such as "YubiHSM2", and a shell access is obtained on the PKI server (even with low privileges), it is possible to recover the key.
At the time of writing, no solution exists to perform this attack from a UNIX-like machine.
Resources
https://posts.specterops.io/certified-pre-owned-d95910965cd2
https://www.keyfactor.com/blog/hidden-dangers-certificate-subject-alternative-names-sans
https://pkiblog.knobloch.info/esc12-shell-access-to-adcs-ca-with-yubihsm