The most perilous weakness you’ve never heard of.
Int the realm of cyber defense, weaknesses are uncovered so frequently, and at such a rapid pace, that staying informed can be quite challenging. Some weaknesses may trigger alerts within your security measures, while others are more subtle, yet equally menacing. Today, we aim to examine one of these subtler weaknesses that may be silently residing in your system waiting to be exploited: Active Directory Certificate Services vulnerabilities.
vPenTest by Vonahi Security recently executed an infiltration strategy tailored to detect and counteract these concealed AD CS risks. But first, let’s delve into why AD CS weaknesses are so hazardous and how they function.
Understanding Active Directory Certificate Services
Active Directory Certificate Services (“AD CS”), as described by Microsoft, is, “a Windows Server role for issuing and managing public key infrastructure (PKI) certificates used in secure communication and authentication protocols.” Some typical functionalities and services that depend on AD CS include:
- The Windows Logon Process
- Enterprise VPN and Wireless Networks
- Email Encryption and Digital Signatures
- Smart Card Authentication
As organizations expand the range of technologies within their infrastructures, AD CS will grow more prevalent and vital, particularly as services are increasingly hosted in the cloud. Many AWS, Azure, and GCP services necessitate certificate-based authentication for operation, hence the anticipation of AD CS becoming a more prominent and mandatory service in modern multi-cloud networks.
Concealed dangers.
Like all potent tools, there is a responsibility to uphold these tools properly, as they can easily be misused in the absence of adequate safeguards. This is particularly true for AD CS. Since AD CS is a fundamental element of contemporary Windows and Active Directory authentication and authorization frameworks, any existing weaknesses pose a substantial risk to those environments. As witnessed 6-7 years ago with Kerberos, and continuing to this day, a compromised key authentication infrastructure can be exploited to a significant extent. The same applies to AD CS, possibly to a greater degree.
AD CS Intrusion Fundamentals
AD CS intrusions hinge on the domain’s trust in the Certificate Authority (“CA”) server at the same level as its trust in its Kerberos servers and other identity servers. Visualize the CA server as a sentinel. Just as a sentinel governs access to a secure area, the CA server regulates the dissemination and validation of certificates, ensuring that only trusted entities gain admission.
Nevertheless, AD CS intrusions exploit this fact to bypass the necessity for elements like passwords or encryption keys. There are four key categories of AD CS weaknesses:
- ESC – These weaknesses result in a degree of privilege elevation within the target network / domain. Attackers can exploit these weaknesses to elevate their access from a low-level user to the domain administrator, with minimal effort.
- THEFT – These weaknesses arise when there are insufficient security measures around the client endpoint, enabling the theft of authentication certificates, leading to privilege escalation or persistence in the environment.
- PERSIST – As the name implies, these weaknesses lead to a scenario in the network where the attacker can leverage their access to a certificate to persist their presence in an environment, sans the need for a password.
- CVE – Different from the first three categories, these weaknesses revolve around the exploitation of specific known vulnerabilities within AD CS that have received patches.
A crucial point to note is that, although Microsoft monitors and issues patches for AD CS weaknesses with assigned CVEs, for most of these weaknesses, Microsoft places the burden of remediation and security on the consumer, resulting in these vulnerabilities persisting more frequently.
The most hazardous among the AD CS weakness categories is the ESC category (ESC as in privilege elevation). These pose the most significant threat to the user’s environment as they demand little or no privileges, depending on the specific misconfiguration. One such misconfiguration is the ESC2 weakness, arising from a server’s requirement to impersonate certain users under specific conditions.
This breach allows a standard user to enroll for a certificate by masquerading as them via the on-behalf-of field in the request. By doing so, a standard low-leveluser may assume the role of the domain administrator and request certificates, followed by obtaining their NTLM hash. This could lead to a complete compromise of the domain administrator account and potentially the entire domain. Explore the demo to witness how a malicious actor might take advantage of this situation using the AD CS hacking utility, Certipy.
What can be done?
As mentioned, Microsoft does not offer straightforward patches to address or detect these vulnerabilities, putting the onus on AD CS users to safeguard their own systems. This task can be quite daunting. So, what steps to take?
Developed by the original finders of this vulnerability category, https://github.com/GhostPack/PSPKIAudit is a PowerShell framework crafted to automate many of the cumbersome tasks for you and pinpoint any potential vulnerabilities within the AD CS setup. However, even after eliminating these vulnerabilities at one point, they could reemerge with the introduction of new tools into the ecosystem. This is where vPenTest by Vonahi Security proves its worth.
vPenTest is an advanced automated penetration testing solution that takes control of your network, executing thorough security assessments automatically, allowing your organization to concentrate on its primary objectives. It features built-in detections for AD CS vulnerabilities and can exhibit the impact of exploiting these vulnerabilities within the network, enabling you to elucidate to the relevant stakeholders the importance of addressing these vulnerabilities. Discover vPenTest today!
Credits to the SpecterOps team for their insightful research on the topic and to ly4k for creating the exceptional tool, Certipy, which aids in detecting these vulnerabilities.
About Author
