Advanced AD CS Escalation: Techniques, Tools, and Detection Strategies

Introduction

Active Directory Certificate Services (AD CS) is a fundamental component for managing public key infrastructure (PKI) within enterprise environments. However, its complexity and common misconfigurations make it an attractive target for attackers seeking to escalate privileges, forge authentication tokens, or persist within a network. This article explores the advanced misuse of AD CS, focusing on template misconfigurations and shadow credential abuse, while providing defenders with behavioral detection strategies to counteract these threats.

Advanced AD CS Escalation: Techniques, Tools, and Detection Strategies — Source: unit42.paloaltonetworks.com

Understanding AD CS Misuse

AD CS escalation techniques leverage inherent trust relationships and certificate-based authentication weaknesses. Attackers exploit misconfigured certificate templates, which define how certificates are issued, or abuse the Shadow Credentials feature to impersonate users or machines. The result often leads to domain administrator (DA) privileges or persistent backdoors via certificate theft.

Key Concepts

Certificate Templates: Define issuance policies, enrolled permissions, and usage (e.g., smart card logon, client authentication).
Shadow Credentials: A technique where an attacker uses a compromised certificate to request another certificate for a different user, effectively stealing their identity.
Behavioral Detection: Monitoring anomalous certificate requests, enrollment patterns, or authentication failures to identify ongoing abuse.

Template Misconfigurations

Misconfigured certificate templates are the most common entry point. Research has documented multiple escalation scenarios (ESC1 through ESC8), each exploiting specific template settings. Below are the most prevalent.

ESC1: Misconfigured Enrollment Rights

When a template allows a low-privileged user to enroll and includes the Client Authentication or Smart Card Logon EKU (Extended Key Usage), an attacker can request a certificate with arbitrary Subject Alternative Names (SAN), impersonating a domain admin. Tools like Certipy automate this by discovering vulnerable templates and crafting malicious requests.

ESC2: Manager Approval Bypass

If manager approval is required but the manager attribute is null or misconfigured, attackers can bypass restrictions and issue certificates with elevated privileges. This often relies on abusing the Enroll On Behalf Of (EOBO) function.

ESC3: Weak Certificate Authority (CA) Policies

A CA with loose issuance policies (e.g., no proof of possession) allows enrollment without validating key ownership, enabling Shadow Credential attacks.

Shadow Credentials Abuse

Shadow Credentials use the PKINIT Kerberos extension or the F$ attribute to request a certificate for another principal without possessing its password. The attacker obtains a certificate that grants authentication as the target user. This technique is particularly dangerous when combined with Credential Roaming or Certificate Injection.

Tools and Automation

Several open-source tools streamline AD CS exploitation:

Certipy: Scans for vulnerable templates, requests certificates, and extracts private keys.
PKINITtools: Implements the Shadow Credential attack via the getTGT and getnthash commands.
ADCS-Exploit: Provides a modular framework for ESC attacks and golden certificate creation.
SharpKatz: Extracts cached certificates from LSASS to inject into memory for pass-the-cert attacks.

Behavioral Detection for Defenders

Defenders must monitor AD CS activity for anomalies. Key indicators include:

Unusual Certificate Requests: Multiple requests from a single user to the same template, especially for Client Authentication with SANs.
Enrollment by Non-Privileged Accounts: Low-privilege users requesting certificates with high-privilege EKUs or SANs.
Failed Authentication Attempts: Recurring 0x32 (KDC_ERR_PREAUTH_FAILED) errors may indicate Shadow Credential tests.
Certificate Re-enrollment: Rapid re-issuances within short timeframes suggest automated exploitation.

Mitigation Strategies

Harden Templates: Remove unnecessary EKUs, restrict enrollment to authorized groups, and enforce manager approval with valid users.
Audit CA Configurations: Disable insecure issuance flags (e.g., EDITF_ATTRIBUTESUBJECTALTNAME2).
Enable Logging: Turn on Audit Certificate Services events (ID 4886, 4887) and collect them in a SIEM.
Use Time-Limited Certificates: Shorten validity periods to reduce the window for stolen certificates.
Implement Just-in-Time (JIT) Access: Grant temporary certificate enrollment rights via PIM or similar tools.

Conclusion

AD CS escalation remains a critical threat vector in modern Active Directory environments. By understanding template misconfigurations, Shadow Credential abuse, and detection methods, defenders can proactively secure their PKI infrastructure. Regular audits, behavioral monitoring, and adherence to least privilege principles are essential to staying ahead of adversaries. For more details, refer to our earlier section on AD CS misuse or explore detection strategies in depth.