Tag: ESC15

New ESC15 vulnerability discovered in Active Directory Certificate Services - easy-to-implement countermeasures

The purposes for which a digital certificate may be used are controlled via the "Key Usage" and "Extended Key Usage" certificate extensions. The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.

However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.

Justin Bollinger from TrustedSec has found out that with offline certificate requests against schema version 1 certificate templates it is possible (similar to the Security Identifier extension ) to include arbitrary Application Policies in the certificate request, which are transferred unchanged to the issued certificate and can then be used to attack the Active Directory forest. The attack was named ESC15.

Continue reading "New ESC15 vulnerability discovered in Active Directory Certificate Services - easy-to-implement countermeasures"

The "Application Policies" certificate extension

The purposes for which a digital certificate may be used are controlled via the certificate extensions "Key Usage" and "Extended Key Usage".

The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.

However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.

Continue reading "The "Application Policies" certificate extension"

From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It

In the following, I would like to present a highly dangerous PKI configuration, perhaps not necessarily known to the general public, which can probably be encountered quite frequently in this way in corporate networks.

I show how, by exploiting various unfortunate circumstances in the Windows PKI, it is possible to elevate privileges from mere network access to complete Active Directory takeover.

The initial point of attack in this example is the Network Device Enrollment Service (NDES).

Continue reading "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It"