AD CS
Last updated
Last updated
Active Directory Certificate Services (AD CS) is a feature of Active Directory that allows a desginated server to issue certificates. This assists in helping environments leverage and deploy the security advantages of using certificate-based authentication.
For a way more well explained blog on exploiting AD CS, I highly recommend checking out .
Additionally, notes from the are essential to understanding the attack chain of AD CS.
If we get a hit from these methods then we can browse to the host identified with the following URL: http://localhost/certsrv/
Dump and display certification authority information with Certutil.exe. This utility can be used to quickly identify if there is a certificate authority on the domain for AD CS attacks:
When dealing with AD CS, and are going to be your best friends.
The following section builds off of several available repositories that are referenced at the bottom of this page. There are multiple ways to exploit vulnerable certificate templates so I highly recommend searching through red team wikis and blogs to find one that may be specific for your use case.
If this attribute is set on the CA, any request (including when the subject is built from Active Directory) can have user defined values in the subject alternative name.
The above quote from Microsoft in attacker-speak means that we can then enroll in any template configured for domain authentication that also allows unprivileged users to enroll. This would allow the attacker to obtain a certificate that then allows them to authenticate as any user/machine on the domain.
One of the easiest ways to assist in detecting exploitation of AD CS is to enable Certificate Authority logging. By default, AD CS does not enable logging by default, which in the case of an incident will prevent an organization from responding. This can be easily remediated:
Additionally, it is recommended to perform regular auditing with tools such as Certify/Certipy or PSPKIAudit to detect vulnerable certificate templates:
This setting, like many others in this section can be discovered and exploited #through using .
