ADCS ESC1 and ESC4 Explained

Active Directory Certificate Services (AD CS) misconfigurations can allow attackers to obtain certificates that grant domain admin privileges.

What is AD CS?

Active Directory Certificate Services issues digital certificates for authentication, encryption, and digital signatures. When configured incorrectly, it can become a path to domain compromise.

ESC1: Misconfigured Certificate Templates

ESC1 allows any domain user to obtain a certificate that can be used for authentication as any other user, including Domain Admins.

How It Works

1. A certificate template has:

   • Enrollment permissions that allow "Authenticated Users" or "Domain Users" to enroll
   • Client Authentication EKU (Extended Key Usage)
   • CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag, allowing the requester to specify the subject
   • No manager approval or authorized signatures required

2. An attacker enrolls in the template, specifying a Domain Admin as the subject

3. The attacker uses the certificate to authenticate as the Domain Admin

4. The attacker now has Domain Admin privileges

Remediation

• Remove "Authenticated Users" or "Domain Users" from enrollment permissions
• Remove CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag
• Require manager approval for sensitive templates
• Use certificate template access control to limit enrollment

ESC4: Vulnerable Certificate Template ACLs

ESC4 allows attackers to modify a certificate template's ACL to grant themselves enrollment permissions, then abuse the template.

How It Works

1. A certificate template has weak ACLs that allow modification
2. An attacker modifies the template to:
   • Add themselves to enrollment permissions
   • Enable CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT if not already enabled
   • Remove manager approval requirements
3. The attacker enrolls and obtains a certificate
4. The attacker uses the certificate to authenticate as a privileged user

Remediation

• Restrict certificate template modification permissions
• Use least privilege for template ACLs
• Monitor for template modifications
• Regularly audit certificate template permissions

Detection

Look for:

• Certificate templates with "Authenticated Users" enrollment permissions
• Templates with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT enabled
• Templates with weak ACLs
• Certificates issued to unexpected users
• Certificate enrollment events in logs

Prevention

1. Review certificate templates: Identify templates with dangerous configurations
2. Restrict enrollment: Limit enrollment permissions to specific groups
3. Remove dangerous flags: Disable CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT where not needed
4. Require approval: Enable manager approval for sensitive templates
5. Harden ACLs: Restrict template modification permissions
6. Monitor enrollment: Alert on certificate enrollment, especially for sensitive templates
7. Regular audits: Review certificate templates and issued certificates regularly