Full Report
Active Directory Certificate Services (ADCS) is used for public key infrastructure in an Active Directory environment. ADCS is widely used in enterprise Active Directory environments for managing certificates for systems, users, applications, and more. The post Abusing Active Directory Certificate Services (Part 1) appeared first on Black Hills Information Security, Inc..
Analysis Summary
# Tool/Technique: Certipy
## Overview
Certipy is a Python-based offensive security tool used to enumerate and abuse vulnerable Active Directory Certificate Services (ADCS) configurations. It aids attackers in identifying misconfigurations that can lead to credential theft and domain privilege escalation.
## Technical Details
- Type: Tool
- Platform: Windows Active Directory environments (Execution via a compromised host with Python)
- Capabilities: Enumerates ADCS configurations, identifies vulnerable certificate templates (e.g., those susceptible to ESC1), interacts with ADCS for certificate requests, and outputs forensic data (including BloodHound compatible data).
- First Seen: Post-2021, following the SpecterOps research.
## MITRE ATT&CK Mapping
This analysis focuses on the enumeration and abuse path facilitated by the tool, specifically related to certificate template misconfigurations.
- **TA0004 - Privilege Escalation**
- **T1118 - Misconfiguration** (Relates to leveraging misconfigured ADCS)
- **T1558.004 - Steal or Forge Kerberos Tickets: AS-REP Roasting** (If combined with certificate issuance leading to potential credential material derivation, though direct mapping is complex without full exploitation chain)
- **T1098.003 - Account Manipulation: Domain Policy Modification** (If subsequent actions alter domain trust via new certificates)
- **TA0007 - Discovery**
- **T1087.002 - Account Discovery: Domain Account** (Via AD CS enumeration)
## Functionality
### Core Capabilities
- **ADCS Enumeration:** Can query Active Directory for Certificate Authority (CA) and certificate template information, requiring only standard domain credentials.
- **Vulnerability Identification:** Specifically flags enabled and vulnerable ADCS templates (e.g., those susceptible to ESC1).
- **Data Output:** Generates output in JSON and TXT formats containing discovered configuration details.
- **BloodHound Integration:** Capable of running BloodHound collectors to map out potential privilege escalation paths derived from ADCS findings.
### Advanced Features
- **ESC1 Abuse Focus:** Specifically aids in identifying templates vulnerable to **ESC1 (Enroll on behalf of service account certificate)**, where low-privileged users can enroll for certificates on behalf of arbitrary high-privileged domain objects if templates allow subject name supply and do not require management approval.
- **BloodHound Data Generation:** It generates data compatible with a specific fork of BloodHound to visualize ADCS-related attack paths.
## Indicators of Compromise
*Note: The IOCs provided here are related to the tool’s behavior, not specific adversaries.*
- File Hashes: N/A (Tool execution)
- File Names: Output files are typically named using a timestamp prefix followed by `_Certipy` (e.g., `20230602164801_Certipy.txt`, `[timestamp]_Certipy.zip`).
- Registry Keys: N/A
- Network Indicators: Tool interacts with Active Directory for LDAP queries to CAs/Templates. Network traffic would involve standard AD protocols (LDAP/LDAPS) directed at Domain Controllers or CAs. No specific C2 is inherent to the enumeration phase.
- Behavioral Indicators: Execution of Python scripts, heavy LDAP queries specifically targeting ADCS configuration objects (Certificate Templates), and creation of zipped/text files containing domain information.
## Associated Threat Actors
The primary focus of the article is research and offensive security tooling based on published techniques discovered by SpecterOps. Specific threat actors known to use Certipy operationally are not detailed in this context, but the underlying ADCS abuse techniques are relevant to sophisticated actors targeting Active Directory compromise.
## Detection Methods
- Signature-based detection: Detection on the presence of the `Certipy.py` script or associated compiled executables if wrapper tools are used.
- Behavioral detection: Monitoring for standard domain users executing LDAP queries targeting certificate template objects when such activity is unusual for that user context. Monitoring the execution of Python scripts (especially those querying AD) by standard users. Monitoring the creation of structured output files containing AD configuration details.
- YARA rules: Could be developed for the known Python import structure or specific hardcoded strings/command-line arguments used by the tool.
## Mitigation Strategies
- **Template Configuration Review:** Ensure Certificate Templates strictly follow security best practices identified by SpecterOps (e.g., enforce **Requires Management Approval** for sensitive templates, limit enrollment rights, and ensure "Enrollee Supplies Subject" is set to False where appropriate).
- **Principle of Least Privilege:** Restrict which users or groups have enrollment rights on certificate templates, especially those that allow users to supply the subject name.
- **Monitoring:** Implement enhanced logging and monitoring for ADCS queries and certificate issuance requests, specifically flagging requests enrolling on behalf of high-privileged accounts or requests attempting to supply their own subject name.
## Related Tools/Techniques
- PKINITtools
- PyWhisker
- Certi
- Impacket
- Certify
- Techniques documented in the SpecterOps "Certified Pre-Owned" research, particularly techniques related to ESC1.