search

ly4k / Certipy

Tool for Active Directory Certificate Services enumeration and abuse
MIT License
2.23k stars 302 forks source link

Certificate vulnerable but there is no Certificate Authority #178

Open oppsec opened 8 months ago

oppsec commented 8 months ago

Hello ly4k and Certipy team, hope you're doing well.

During a pentest, I encountered a certificate vulnerable to ESC1, ESC2, and ESC3, however, there is no Certificate Authority to use on the -ca flag. There is anything that I can do?

For context, this is my current scenario:

 Template Name                       : EXAMPLECA
    Display Name                        : EXAMPLE CA
    Enabled                             : False
    Client Authentication               : True
    Enrollment Agent                    : True
    Any Purpose                         : True
    ...

    [!] Vulnerabilities
      ESC1                              : 'DC.LOCAL\\Authenticated Users' can enroll, enrollee supplies subject and template allows client authentication
      ESC2                              : 'DC.LOCAL\\Authenticated Users' can enroll and template can be used for any purpose
      ESC3                              : 'DC.LOCAL\\Authenticated Users' can enroll and template has Certificate Request Agent EKU set