Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Active Directory Certificate Services (AD CS) abuse: how certificate misconfigurations lead to domain takeover

Category hub: Hacking techniques explained

In one sentence: AD CS abuse is when a badly set up internal certificate system lets an ordinary user get a certificate that proves they are an administrator and take over the network.

What it is

Many Windows networks run Active Directory, the system that holds users, computers and passwords. Active Directory Certificate Services (AD CS) is Microsoft’s public key infrastructure, which issues digital certificates. SpecterOps says these cover everything from encrypting files to digital signatures and user authentication.

In June 2021 SpecterOps researchers Will Schroeder and Lee Christensen published “Certified Pre-Owned”. They wrote that AD CS is not installed by default but is widely deployed, and that the consequences of misconfiguring it are enormous. They found no out-of-the-box flaw but said it is extremely easy to misconfigure. They named misconfiguration classes ESC1 onwards, where ESC stands for escalation.

How it works

This is the idea, without the steps.
1. A certificate template is a recipe saying who can request a certificate, what it can be used for and who it names.
2. A certificate can be used to log in to a Windows domain in place of a password.
3. In the best-known misconfiguration, ESC1, several things are true together: ordinary users may request from the template, the certificate can be used to log in, the requester can choose who the certificate names, and (TrustFoundry adds) no manager approval is needed.
4. An attacker with a low-privilege account asks for a certificate naming an administrator, then logs in as that administrator.
5. The certificate stays valid after a password change, so access can last until it expires.

Other classes involve weak permissions on templates or the certificate authority, and web enrolment endpoints that can be tricked.

Who it affects and how badly

  • Sole trader to 10 staff. Rarely relevant. Small offices seldom run their own certificate authority.
  • 10 to 50 staff. Only if you run on-premises Windows servers with AD CS. Your MSP should know.
  • 50 plus and regulated firms. Manufacturers, councils, universities, healthcare and finance firms with on-premises Active Directory often have it, installed years ago and never reviewed. A domain takeover means access to all data on the network, with long-lasting access that password resets do not end, plus incident reporting, rebuild costs and client loss.

SpecterOps said it saw ESC1 to ESC7 issues in real environments from January 2021.

Real examples

  • The SpecterOps research, 2021. “Certified Pre-Owned” is a published paper and blog post, not an incident at a named victim. It catalogued misconfiguration classes and persistence techniques, and led to wide defender attention and open-source auditing tools.
  • No victim organisation is named. A secondary source says Microsoft later changed certificate mapping in update KB5014754. We have not opened Microsoft’s notice.

How to detect it

  • Turn on auditing on each certificate authority. Events usually watched are 4886 (request received), 4887 (certificate issued) and 4888 (request denied).
  • Alert where a certificate is issued for a name different from the account that asked.
  • Alert on changes to template permissions or settings.
  • Review your AD CS configuration on a schedule, using open-source auditing tools.

How to fix or prevent it

  1. Inventory your certificate authorities and templates. Remove AD CS if you do not use it.
  2. On every template, turn off the setting that lets the requester supply the subject name unless there is a documented need, and require manager approval.
  3. Limit enrolment rights to groups that need them, not Domain Users or Authenticated Users.
  4. Remove login use from templates that do not need it.
  5. Restrict who can edit templates and the certificate authority, like domain admin rights.
  6. Turn off or harden web enrolment, and keep certificate servers patched.
  7. Log and review certificate events. If you suspect abuse, revoke the certificates and review the domain.

Related terms

  • How pass-the-hash works
  • How Kerberoasting works
  • How privilege escalation works
  • How lateral movement works
  • NTLM authentication
  • CVE

FAQ

What is AD CS?
Microsoft’s public key infrastructure for Active Directory, which issues certificates for authentication, signing and encryption.

What does ESC1 mean?
A misconfiguration class named by SpecterOps. ESC stands for escalation. In ESC1 a user can request a login certificate and choose who it names.

How do I check mine?
Review certificate templates and enrolment rights, enable certificate authority auditing and use auditing tools. A penetration test can show whether a route to admin exists.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.