ESC6
A CA is vulnerable to ESC6 is the EDITF_ATTRIBUTESUBJECTALTNAME2 flag is set. However, it's important to note that the misconfiguration that make this domain escalation possible was patched as part of the May 2022 Security Updates from Microsoft.
For this reason, the only case we will find this misconfiguration is when the security updates have not been installed. If that's the case, all templates allowing to specify a SubjectAltName in the CSR become vulnerable to ESC1.
Read more about the security measures implemented around SmartCard Logon here.
If this flag is set on the CA, any request (including when the subject is built from Active Directory) can have user defined values in the subject alternative name.
The EDITF_ATTRIBUTESUBJECTALTNAME2 flag impacts the entire Certificate Authority, meaning that every certificate template enabling non or less-privileged users to request a certificate with Client Authentication (1.3.6.1.5.5.7.3.2) EKU can be exploited. This means we can request a certificate with any user designated as an additional User Principal Name (UPN).
The alternative names here are included in a CSR. This differs from the method for abusing SANs in ESC1 as it stores account information in a certificate attribute vs a certificate extension.
We can use certipy to identify a vulnerable certificate authority:
If the CA is vulnerable we'll see that the User Specified SAN attribute is enabled and we can request a certificate with an alternative SAN for a template that generally doesn't allow it.
Abuse from Windows requires to execute Certify directly on the CA to examine the status of the UserSpecifiedSAN / EDITF_ATTRIBUTESUBJECTALTNAME2 flag.
To carry out this attack, we need a template that allows client authentication, as is the case with the default User template, and include an alternative SAN
and convert it into a format we can use with Rubeus to request a ticket using PKINIT.
Last updated