Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools
Summary: Unit 42 describes how Active Directory Certificate Services, undermined by insecure default configurations and overly permissive enrollment rights, has become a high-impact, under-monitored vector for privilege escalation and identity impersonation that relies on native certificate issuance rather than zero-days or malware. The report details ESC1 template abuse, in which low-privileged users request certificates as high-privileged accounts, and shadow credential attacks that register attacker keys in the msDS-KeyCredentialLink attribute so access survives password resets and certificate revocation.
Key Takeaway: Shadow credentials persist even after a password change or certificate revocation, and open-source tools like Certipy, Certify, PKINITtools and Whisker have lowered the barrier so moderately skilled attackers can run what once required deep expertise - with Certipy already observed in Fog ransomware activity.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2022-26923
- Related
- CVE-2022-26923: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Aug 18, 2022