In this episode of CQURE Hacks, we demonstrate how the ESC16 misconfiguration in Active Directory Certificate Services (AD CS) can be abused to escalate privileges from a regular domain user to Domain Administrator.
by Krystian Tytoń, CQURE
ESC16 occurs when a Certificate Authority is configured not to include the SID security extension in issued certificates. This extension provides a strong binding between a certificate and the Active Directory account for which it was issued. If the extension is absent and the Domain Controller permits weak certificate mapping, certificate identities such as the UPN can potentially be used to map the certificate to another account.
In the demonstration, a low-privileged user named bob is able to modify his userPrincipalName. We temporarily change his UPN to Administrator and request a standard user certificate. Because the CA does not add the SID security extension, the issued certificate contains the Administrator UPN without being strongly bound to Bob’s SID.
After restoring Bob’s original UPN, the certificate is used for authentication and is mapped by the KDC to the real Administrator account. This allows us to obtain an Administrator TGT and recover the Administrator NT hash.
With Domain Admin privileges, the demonstration concludes with DCSync, retrieving the krbtgt account hash.
The attack highlights why AD CS configuration, certificate mapping settings, and permissions to modify identity attributes such as userPrincipalName should all be carefully reviewed. A seemingly small certificate configuration issue can become part of a complete domain compromise.
Join our FREE live webinar:
Uncovering New Identity Theft Vectors and How to Mitigate Them
Discover how identity theft no longer begins and ends with a stolen password.
Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.
Register for free:
👉 https://luma.com/TheftVectors
Want to know more?
Learn more about our offer in terms of Consulting. Our Cybersecurity Experts perform consulting work on a daily basis, hence we are fully prepared for any challenge.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
