Auditing AD Certificate Services templates for escalation risks

Why templates matter

Active Directory Certificate Services issues certificates that can be used to sign in. A template defines who may enroll, what the certificate can be used for, and who may set the subject. Researchers catalogued risky combinations as ESC1 through ESC16. Two of the most common are ESC1, where low-privileged users can enroll in a client-authentication template and supply any subject name, and ESC4, where low-privileged users can edit a template and create that condition themselves.

This lesson stays on finding and fixing those settings in your own lab. It does not request certificates for other identities.

A read-only query for the ESC1 flag

The msPKI-Certificate-Name-Flag attribute holds CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT as bit 1. pKIExtendedKeyUsage shows whether client authentication is allowed. Any template with both, and with enrollment granted to broad groups, needs attention.

$cfg = (Get-ADRootDSE).configurationNamingContext
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,$cfg" `
  -Filter * -Properties msPKI-Certificate-Name-Flag, pKIExtendedKeyUsage |
  Where-Object { $_.'msPKI-Certificate-Name-Flag' -band 1 } |
  Select-Object Name, @{n='EKU';e={$_.pKIExtendedKeyUsage -join ','}}

Name            EKU
----            ---
WebServer       1.3.6.1.5.5.7.3.1
LabVPNUser      1.3.6.1.5.5.7.3.2

Locksmith and Certipy find

Locksmith is a PowerShell module written for defenders; mode 0 lists issues with explanations, and other modes can output fix scripts for review. Certipy’s find command enumerates the CA and templates read-only and marks vulnerable ones; it prompts for the password when -p is omitted, which keeps it out of shell history.

Install-Module -Name Locksmith -Scope CurrentUser
Invoke-Locksmith -Mode 0

certipy find -u auditor@lab.local -dc-ip 10.8.0.10 -vulnerable -stdout

Template Name        : LabVPNUser
Enrollee Supplies Subject : True
Client Authentication     : True
Enrollment Rights         : LAB.LOCAL\Domain Users
[!] Vulnerabilities
  ESC1                    : Enrollee supplies subject and template allows client authentication

Worked fix for LabVPNUser

LabVPNUser was copied from a template meant for manual web server requests, which is how the subject flag came along. The fix, in the Certificate Templates console: on Subject Name, choose Build from this Active Directory information; on Security, replace Domain Users with the VPN Users group; on Issuance Requirements, require CA manager approval while the change beds in. WebServer keeps its flag because it lacks client authentication and enrollment is limited to server admins.

Rerun Locksmith and Certipy find; both should stop reporting ESC1. Then check which certificates were already issued from the template, because a fix to the template does not revoke them.

certutil -view -restrict "CertificateTemplate=LabVPNUser" -out "RequestID,RequesterName,CommonName,NotAfter"

Turn on CA auditing

AD CS logs nothing useful by default. Enable the Certification Services audit subcategory on the CA, then set the CA audit filter so it records requests, issuance, and template changes. Event 4886 records a request received and 4887 a certificate issued, including the requester and the subject. A 4887 where the requester and the subject name differ, on a client-authentication template, is the detection that would have caught ESC1 abuse.

auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
certutil -setreg CA\AuditFilter 127
Restart-Service certsvc