ESC6
Last updated
Last updated
A CA is vulnerable to ESC6 is the EDITF_ATTRIBUTESUBJECTALTNAME2 flag is set. However, it's important to note that the misconfiguration that make this domain escalation possible was patched as part of the from Microsoft.
For this reason, the only case we will find this misconfiguration is when the security updates have not been installed. If that's the case, all templates allowing to specify a SubjectAltName in the CSR become vulnerable to .
Read more about the security measures implemented around SmartCard Logon .
As
If this flag is set on the CA, any request (including when the subject is built from Active Directory) can have user defined values in the subject alternative name.
The EDITF_ATTRIBUTESUBJECTALTNAME2 flag impacts the entire Certificate Authority, meaning that every certificate template enabling non or less-privileged users to request a certificate with Client Authentication (1.3.6.1.5.5.7.3.2) EKU can be exploited. This means we can request a certificate with any user designated as an additional User Principal Name (UPN).
We can use certipy to identify a vulnerable certificate authority:
If the CA is vulnerable we'll see that the User Specified SAN attribute is enabled and we can request a certificate with an alternative SAN for a template that generally doesn't allow it.
Abuse from Windows requires to execute Certify directly on the CA to examine the status of the UserSpecifiedSAN / EDITF_ATTRIBUTESUBJECTALTNAME2 flag.
To carry out this attack, we need a template that allows client authentication, as is the case with the default User template, and include an alternative SAN
and convert it into a format we can use with Rubeus to request a ticket using PKINIT.