Certified Re-Pwned - Escalating All the Way Up

The talk argues that Active Directory Certificate Services is still exploitable despite Microsoft's 2022 strong certificate binding enforcement and the 2024 CVE fix. The presenters introduce five new techniques, numbered ESC18 through ESC22 to extend the public ESC1 to ESC17 scheme. Each was validated on a fully patched Windows Server 2025 enterprise CA with Microsoft's recommended mitigations applied. Every chain starts from an ordinary domain user with no special ACL, GPO, or template rights and ends with extraction of the krbtgt key.

The techniques target different parts of the post-2022 defences. One abuses certificate policy identifiers that the CA copies from the CSR into issued certificates, linked to security groups through Authentication Mechanism Assurance. Another injects a security extension that the CA passes through unchecked. A third omits the security extension entirely, which makes the KDC fall back to reading the SID from the SAN URL, an undocumented behaviour. A fourth abuses enrollment on behalf of with version 1 templates, whose array signature attribute the CA silently ignores. The last shows that enrollment agent restrictions can appear configured while being absent, because the certutil flag is not recognised on Server 2025. Each technique was demonstrated live.

For defenders, the recommendations include removing the security extension from the CSR whitelist, enforcing explicit EKUs, disabling the ESS flag where it is not needed, upgrading version 1 templates, restricting enrollment to specific groups, and verifying enrollment agent restrictions in both the GUI and the registry. Suggested detections include event 4887 for security extension object IDs and event 4768 for PKINIT authentication without that extension.