hunting-adcs-certificate-template-abuse

Hunting ADCS certificate template abuse: when a standard user enrolls as a domain admin

A certificate authority in a Windows domain issues certificates that clients then use to authenticate, and the identity a certificate carries is whatever the authority put in it. That is safe only when the authority decides the identity from the authenticated enrollee, never from what the enrollee asked for. A template that lets the requester supply the subject alternative name, combined with a use that permits client authentication and enrollment rights granted to ordinary users, lets a standard user request a certificate naming a domain administrator and then authenticate as that administrator. Other template settings weaken the same boundary: a flag that carries the requester's identity into the issued certificate, or enrollment permissions loose enough that any user obtains a template meant for privileged roles. The bug is a certificate whose identity the low-privileged enrollee, not the authority, decided. You hunt these by reading each template's enrollment rights, subject source, and permitted uses.

When to use

• A certificate authority issues templates usable for domain authentication and standard users may enroll.
• A template lets the enrollee supply the subject or a subject alternative name rather than deriving it.
• Enrollment permissions or template flags may let an ordinary user obtain a privileged-identity certificate.

Scope check

Test certificate template abuse only in directories you own or are authorized to assess, on non-production or a lab domain, enrolling only for an identity you are permitted to test with and never authenticating as a real privileged principal outside the authorization. A confirmed abuse yields authentication as a privileged account, so keep every probe within scope. If you can't name the authorization, stop.

The loop

1. Establish where the certificate's identity actually comes from first. For each template a standard user can enroll in, determine whether the authority derives the subject and any alternative name from the authenticated enrollee, or whether the enrollee supplies them, and whether the resulting certificate permits client authentication. This is the false-positive killer: a template that fixes the identity from the enrollee and forbids requester-supplied names cannot mint a privileged identity, however broad its enrollment rights. Name the identity source before crafting a request.