EKUwu - Not Just another AD CS ESC

Justin Bollinger opens with a primer on Active Directory Certificate Services, likening certificate templates and signing requests to the forms and endorsements a motor vehicle agency issues. He recaps earlier research that catalogued template-based escalation paths and explains why these misconfigurations remain common in client environments.

The core of the talk follows an engagement where standard tooling reported nothing useful, but a manual look at a web server template revealed unexpected behavior. By adding extra application policies to a certificate request, the requester could push the issued certificate beyond the purpose the template allowed, including client authentication, code signing, and enrollment agent capabilities. He shows how such a certificate could be used against LDAP and Schannel to reach privileged accounts, and explains how the conflict between the standard Extended Key Usage field and Microsoft's proprietary application policies lets the requester's values prevail.

The final section covers the disclosure process with Microsoft, which initially did not treat the behavior as a vulnerability before a CVE was eventually assigned. Bollinger closes with defensive guidance: auditing template EKUs, limiting enrollment rights, requiring manager approval, monitoring issuance, and revoking suspect certificates. The takeaway for administrators is that a certificate's name and purpose need checks beyond the template alone.