Missing Vuln Cert Template check for Domain Computers

netwrix / pingcastle

PingCastle - Get Active Directory Security at 80% in 20% of the time

https://www.pingcastle.com

Other

2.35k stars 292 forks source link

Missing Vuln Cert Template check for Domain Computers #224

Open cmahrl opened 8 months ago

cmahrl commented 8 months ago

PingCastle does not report when computers are allowed to enroll for vulnerable certificate templates, so a direct critical path to DA remains undetected. e.g.:

1) Flag: EnrolleSuppliesSubject 2) EKU: Client / Server Authentication 3) Enrolement Rights: Domain Computers 4) PWN

JoeDibley commented 2 months ago

Hi there, Thanks for reporting this. This specific case is captured by PingCastle but only when the msds-MachineAccountQuota is not set to 0, which makes it even easier to exploit. I think Domain Computers on its own is a valid finding too so I have added this to the backlog for us to implement.