Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled

projectblack.io | research | #ai-security | #active-directory | #hardening | #adcs | #esc8 | #ntlm-relay

Summary

Fixing ESC8: when ADCS web enrolment is reachable over HTTP or lacks Channel Binding/EPA, a relay attack can obtain a domain controller certificate. The fix is requiring EPA and SSL in IIS.
Published
Collected

original ↗

Related coverage

  1. When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss (abdulmhsblog.com)
  2. Detecting and Mitigating the PetitPotam Attack on Windows Domains (semperis.com)
  3. NetSPI/AD-PathFinder: Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data (github.com)
  4. ESC8s and Where to Find Them (abdulmhsblog.com)
  5. Fixing ESC4 - User has dangerous permissions (projectblack.io)
  6. Fixing ESC1 - Enrollee supplies subject and template allows client authentication (projectblack.io)

back