CQURE Hacks #83: Attack on Active Directory Certificate Services (AD CS) – ESC16

Source: CQURE Academy

Author: Daniel

URL: https://cqureacademy.com/blog/cqure-hacks-83-attack-on-active-directory-certificate-services-ad-cs-esc16/

ONE SENTENCE SUMMARY:

ESC16 exploits missing SID extensions and weak mapping to impersonate accounts via UPN changes, enabling domain compromise through AD CS.

MAIN POINTS:

1. ESC16 arises when a CA omits the SID security extension in certificates.
2. SID extension normally binds certificates strongly to specific Active Directory accounts.
3. Without SID binding, weak certificate mapping can rely on UPN identity fields.
4. A low-privileged user, bob, can modify his own userPrincipalName attribute.
5. Bob changes his UPN to Administrator before requesting a standard user certificate.
6. The CA issues a certificate embedding Administrator UPN, yet tied to Bob’s SID.
7. Bob restores his original UPN after obtaining the misbound certificate.
8. KDC maps the certificate to the real Administrator account during authentication.
9. Attacker obtains an Administrator TGT and recovers the Administrator NT hash.
10. With Domain Admin rights, DCSync retrieves the krbtgt account hash.

TAKEAWAYS:

1. Enforce SID security extension issuance to prevent ambiguous certificate-to-account binding.
2. Disable weak certificate mapping behaviors that allow UPN-based identity confusion.
3. Restrict permissions to modify identity attributes like userPrincipalName.
4. Audit AD CS templates, CA settings, and KDC mapping configurations regularly.
5. Minor PKI misconfigurations can cascade into full Active Directory domain compromise.