Understanding AD CS Escalation: From Template Vulnerabilities to Shadow Credentials

Introduction

Active Directory Certificate Services (AD CS) is a critical component in many enterprise environments, providing public key infrastructure (PKI) capabilities that enable secure communication, authentication, and digital signing. However, its complexity and integration with Active Directory make it a prime target for attackers seeking to escalate privileges. This article, based on analysis by Unit 42, explores advanced misuse techniques such as certificate template misconfigurations and shadow credential attacks, along with behavioral detection methods that defenders can employ.

Common AD CS Attack Vectors

AD CS attacks often exploit misconfigured certificate templates or authentication mechanism vulnerabilities. These vectors enable adversaries to obtain unauthorized certificates that can be used for privilege escalation or lateral movement.

Certificate Template Misconfigurations

Certificate templates define the properties and permissions for certificate issuance. Common misconfigurations include:

• Enrollment rights granted to low-privileged users: When any authenticated user can enroll for a template that allows domain authentication, attackers can request a certificate with arbitrary Subject Alternative Names (SANs).
• Incorrect CA certificate manager approval: If templates are not set to require manager approval, attackers can request certificates without oversight.
• Overly permissive object identifier (OID) mapping: Templates that map OIDs to privileges can be abused if the mapping is too broad.

These misconfigurations are often categorized under ESC1 through ESC8 in research literature, each detailing a specific exploitation path. For example, ESC1 occurs when a template allows enrollment by low-privileged users and permits specifying custom SANs—enabling an attacker to impersonate a domain admin.

Shadow Credential Misuse

Shadow credentials leverage the PKINIT (Kerberos PKINIT) protocol to authenticate using a certificate instead of a password. In a shadow credential attack, an adversary gains access to a machine account’s credentials (often via lsadump::dcsync or other means) and then uses that account to authenticate via PKINIT. This allows the attacker to obtain a Ticket Granting Ticket (TGT) without needing the account’s NTLM hash. Tools like PKINITtools and Certipy enable this technique, which can be used for persistence or privilege escalation.

Attackers may also modify the msPKI-Credential attribute on a user or computer object to add a new certificate, effectively creating a “shadow” credential that can be used for authentication without triggering password changes.

Tools Used in AD CS Exploitation

Several tools have emerged to automate AD CS attacks:

• Certipy: A Python-based tool for enumerating and exploiting AD CS misconfigurations, including ESC1-ESC8 and shadow credentials.
• PKINITtools: Focuses on PKINIT-based attacks, including shadow credential abuse and Kerberos authentication with certificates.
• Impacket’s getTGT: Can be used in conjunction with PKINITtools to request TGTs using certificate-based authentication.

These tools simplify complex attack chains that previously required manual steps, making AD CS escalation more accessible to attackers.

Behavioral Detection for Defenders

To defend against these attacks, security teams should focus on behavioral detection rather than relying solely on signatures. Key indicators include:

1. Unusual certificate enrollment requests: Monitor for requests from users or computers that normally do not enroll certificates, especially for templates with broad usage rights.
2. Abnormal PKINIT authentication: Look for authentication events where a certificate is used for the first time from a previously unknown client, or where the certificate subject does not match expected patterns.
3. Modifications to msPKI-Credential attributes: Audit changes to this attribute, as it can indicate shadow credential creation.
4. Correlation with privilege escalation: Cross-reference certificate enrollment events with subsequent administrative actions, such as creation of new domain admin accounts.

Additionally, hardening configurations can mitigate these risks. Ensure that certificate templates require manager approval, restrict enrollment to privileged users, and disable the use of SANs in templates used for domain authentication. Regularly audit CA logs and review template permissions.

Conclusion

AD CS escalation remains a potent technique for attackers, exploiting fundamental trust relationships in certificate-based authentication. By understanding common misconfigurations and shadow credential attacks, defenders can implement behavioral detection and proactive hardening measures. The analysis by Unit 42 underscores the importance of continuous monitoring and configuration review to prevent these advanced misuse techniques from succeeding.