Definition
Active Directory Certificate Services issues certificates according to templates. Where a template's enrollment permissions and subject rules are too permissive, a low-privileged requester may be able to obtain a certificate that authenticates as somebody else.
Why it is unusually durable
An issued certificate is valid for its lifetime. Resetting the impersonated account's password does not invalidate it. Containment requires revocation and an understanding of what was issued, which is precisely the kind of record that is rarely reviewed until it matters.
What to review
- Which principals may enroll against which templates
- Whether a requester can influence the subject identity
- Whether issuance requires approval
- Which templates permit client authentication
- Whether issued certificates are inventoried at all
- Internal Identity
- Certificate Enrollment
- Abusable Certificate
- Privileged Identity
- Critical System
Each hop validated by successful exploitation
Tags
- adcs
- pki
- privilege escalation