PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled

projectblack.io | research | #ai-security | #active-directory | #hardening | #adcs | #esc8 | #ntlm-relay
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Fixing ESC8: when ADCS web enrolment is reachable over HTTP or lacks Channel Binding/EPA, a relay attack can obtain a domain controller certificate. The fix is requiring EPA and SSL in IIS.
Published
Collected

Related coverage

blog · abdulmhsblog.com
When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss
A pentester notes Certify and Certipy can misjudge ESC8 NTLM relay exposure: even with EPA enabled, AD CS Web Enrollment may stay relayable when channel or service binding isn't configured right.
blog · blog.sentry.security
ESC8 Attack Guide for Windows Environments
The ESC8 attack abuses AD CS Web Enrollment with NTLM relay: coercing a DC to authenticate hands attackers a certificate as that high-privilege account, potentially compromising the entire domain.
blog · semperis.com
Detecting and Mitigating the PetitPotam Attack on Windows Domains
How the PetitPotam attack works: EFSRPC authentication coercion relayed via NTLM to AD CS Web Enrollment (ESC8) can yield Domain Admin; the post maps the full chain and covers detection plus mitigations like disabling NTLM or enabling EPA.
blog · abdulmhsblog.com
ESC8s and Where to Find Them
How to locate AD CS Web Enrollment endpoints for ESC8 relay attacks by enumerating constrained delegation with nxc and BloodHound, then confirming certsrv endpoints with curl before relaying.
research · projectblack.io
Fixing ESC4 - User has dangerous permissions
Fixing ESC4: when low-privileged principals hold Owner, Full Control, or Write permissions on an ADCS certificate template they can hijack it to escalate privileges. The fix is removing those ACLs.
research · projectblack.io
Fixing ESC1 - Enrollee supplies subject and template allows client authentication
ESC1 remediation: vulnerable ADCS templates let low-privileged users request certificates as other accounts, even domain admins; fixes include restricting enrolment or disabling supply-in-request.
Back