ADCS ESC17 Abuse Enables TLS Server Impersonation and WSUS Privilege Escalation
· 54:26 · Watch on YouTube ↗
Summary
BHIS presenters demonstrate how ESC17 certificate-template misconfigurations enable TLS server impersonation. Their lab combines a trusted certificate with DNS redirection to impersonate WSUS and gain local administrator access.
Key points
- ESC17 requires an enabled server-authentication template, enrollee-supplied subjects, enrollment rights, and no additional approval or signature requirements.
- In the lab, a low-privilege account obtained a certificate for the target server and used existing DNS write permissions to redirect clients to a controlled host.
- The presenters impersonated an HTTPS WSUS service and demonstrated adding a domain account and a generated local account to a client's local administrators group.
- Recommended mitigations include restricting enrollment, disabling unnecessary enrollee-supplied subjects, requiring approval, limiting DNS write permissions, and certificate pinning.
- Detection guidance includes enabling CA auditing, investigating requester/SAN mismatches, monitoring DNS changes and unexpected WSUS connections, and alerting on local administrator additions.
- DNS redirection can disrupt every service using the affected hostname. Cleanup includes restoring DNS, revoking obtained certificates, and removing added administrator accounts.
Article Details
- Topics
- [01:12] ADCS fundamentals and certificate-template settings
- [04:57] ESC1 prerequisites and client impersonation
- [08:09] ESC17 prerequisites and server impersonation
- [12:23] Enumerating vulnerable templates and identifying impersonation targets
- [18:13] Obtaining certificates and redirecting client traffic through DNS
- [22:09] Impersonating HTTPS WSUS to gain local administrator access
- [30:26] Template hardening, DNS access restrictions, and certificate pinning
- [34:03] Detecting suspicious certificate requests, DNS changes, and administrator additions
MITRE ATT&CK
T1098.007 · Additional Local or Domain GroupsThe demonstrated malicious update adds a low-privilege domain account to the connecting client's local administrators group.T1136.001 · Local AccountAn alternative demonstration generates a local username and password and creates that account on the WSUS client.T1557 · Adversary-in-the-MiddleThe lab redirects clients through a modified DNS record and presents a trusted server certificate to impersonate the HTTPS WSUS service.
People
AlyssaBHIS continuous penetration testing team member and webcast presenter who demonstrates ESC17-based WSUS impersonation and discusses detection opportunities.CaitlynBHIS continuous penetration testing team member and webcast presenter who explains ADCS template abuse, certificate requests, mitigations, and operational risks.