so good afternoon everybody at uh Wild
West hackenfest thank you for taking
time out of your day uh to choose to see
a presentation about a tiny little
script that'll help you fix stuff with
active directory certificate Services uh
my name is Jake Hildreth I am a senior
security consultant at Trimark
and uh who am I and why should you
listen to me
um I am a guy that's been in technology
for over 20 years uh did a couple years
in help desk
uh for the at-home cable modem
conglomerate uh then moved on to a tiny
little uh meta security services
provider
uh in which I had a mentor there that
kind of taught me that
uh good security is synonymous with
operational excellence
and then after that I moved on to
uh did 16 years in local government
working as a quote-unquote network
administrator I actually planned to
retire there but I spent the last half
of my tenure there undoing all of the
stuff that my predecessors had done to
active directory and
prove that uh got a really deep
understanding of active directory and
security around it um then in May 2021 I
saw a tweet from Sean Metcalf that read
if you have been managing active
directory or Azure ID in an operations
role and are trying to figure out how to
shift to a role in security my DMs are
open
uh I contacted immediately poured my
heart out
and then a couple months later was
working for Trimark uh I do work I'm
considered a subject matter expert on
our active directory security assessment
and then of course
most primarily I I consider myself a
husband and a dad
but a blue teamer at heart and that's
why
I created locksmith I
I just want to protect
so since you're sitting here uh
listening to a guy speak remotely about
adcs I'm going to assume that you have
some knowledge about what it is
um but I'm going to touch a little bit
quick primer just just in case you're
not aware Microsoft
adcs is Microsoft's version of public
key infrastructure
um it's been part of the active
directory Suite of services since active
directory's initial release in 2000
um and
it is incredibly popular because it is
incredibly easy to set up literally
anybody can have a single tier pki stood
up in their environment in about 10
minutes by clicking next a bunch of
times and finish
um
and it's usually used for uh secure
Communications between domain
controllers file encryption security
mail encrypted ldap Etc we're not going
to talk about any of that today what
we're going to talk about instead is uh
is issues surrounding certificate-based
authentication and how that can be
abused
um
why is adcs so easy to screw up
well
it takes the notoriously easy to
configure pki
and combines it with the notoriously
easy to configure active directory and
well that's where we are
so this is the state of adcs research
and how it's being used
in the in the before times which I call
before certified pre-owned
there was a smattering of of Articles
all across the internet that would teach
you how to how to abuse adcs in this
little way in this little way in this
little way
Specter Ops came along
condensed all that into a breezy 143
page Beach read called certified
pre-owned
and suddenly the world of certificate
services
exploitation really exploded
shortly after that was released I joined
Trimark I joined Trimark and we were
discussing
let's let's start doing some adcs checks
and I volunteered because I am not smart
and then uh now I'm the adcs guy that I
did not expect to be
um
then in April 20th 2022 this year uh
Mandy it revealed that apt-29 is using
some of the techniques described in
certified pre-owned
and
we have also had at Trimark uh several
uh pentastic firms you know comment how
they are now using adcs vulnerabilities
all the time to get quick wins
so what types of vulnerabilities are we
actually discussing here
well
the most common one it's not really an
authentication issue at all
it is the lack of auditing
why is there a lack of auditing it seems
like this would be easy to do well
out of the box
adcs auditing is completely disabled you
have to manually go and turn it on
and you have to manually turn it on on
every single box that is hosting a
certificate Authority
if you miss one
You're vulnerable
and then even if you do have it applied
on every single certificate Authority
in order to really do full auditing uh
it requires an additional two gpos to be
set
so in the time that we've been assessing
adcs through Trimark I have seen exactly
zero
environments where auditing has been
properly enabled
which then means that the next few
issues that we're talking about here
will never be identified
and never dissected
um
speaking of those the
next most common thing is definitely
overly permissive ACLS uh
active directory can be tough
and especially in setting up things that
are a little weird like certificates I
know most CIS admins just run away from
certificates I was the same way for
quite a while
um
it's it's incredibly easy to give low
privilege users privilege to modify
templates to whatever they need to be or
modify various objects in your pki to
maintain persistence
um
and then we move into some dangerous
situations uh I call these dangerous
because they are essentially one step to
domain compromise
and they are each dangerous in their own
very fun way
the first is more common
and
it basically allows
a low privileged user to request a
certificate
using
a subject alternative name
of any other security principle in your
domain so you want to be a da be a D.A
you want to be in DC go for it
we gotcha
and then the other type of dangerous
template
is uh you can just request to be a a CA
you can request to be your own
certificate Authority
which then allows you to
create new certificates that are just
trusted by by active directory by
default
and then the last bullet here was
incredibly dangerous and it's it's been
somewhat mitigated as of May
um there's a flag
that if set on a certificate Authority
will
basically change every template that a
user is allowed to enroll in it it gives
them the capability to set a subject
alternative name on that that template
during the request
like I said it's it's been partially
mitigated since May there are still some
some edge cases where where that can be
abused
um but it's
it's less common so
so with all of those in mind
I wanted to do something about this I
like I said blue team are at heart I I
see a problem I want to protect people
from it
so
let's locksmith can help with that
uh locksmith will scan your adcs
environment that'll find stuff that's
bad and then it'll report on
but Jake we already have multiple tools
to do this pspki audit certify certify
they all already do that what makes
locksmith different well
I'm going to make it easy for you to
remediate your issues instead of just
reporting on them
and with that we're just going to move
right into the demo
let's go ahead and get switched over
here
all right
got my demo machine
logged into a DC as a normal user
because I am very secure
and
I was smart and actually like pre-wrote
my command so I wouldn't screw up
all right we are now in my locksmith
demo
environment
and we are going to set our execution
policy to bypass because again I am very
good at security
and
we're just going to run locksmith and
show you what it looks like
in default mode
first off select ding all of the various
ADC objects in your Forest currently
locksmith just looks at your local
Forest
and reports on it nope we've got one of
our four uh certificate authorities is
not does not have auditing fully enabled
oh we got uh someone that request client
authentication without by using a sand
and and not getting manager approval
we've got uh
we got a lot of issues here
but that's it
um my test environment is very small
like I said 87 objects
um on larger environments it's not much
it doesn't take much longer because
there's really not a ton of objects that
we are going to be scanning through but
as you can see we've got a you know one
template where people can try to become
a sub CA we've got uh some templates
where
the work from home staff here's to have
full control rights
and
yeah we've got uh
a weird uh
yeah an object down here
this horse CA that that
users can somehow modify
and then uh lastly that dangerous tag
that I was speaking about here
um
we could say that one of our rcas has uh
that dangerous flag set
so let's clear this out we don't need we
don't need to see this again
so
that's all fine and dandy you've got
that
I didn't really that that information
not super useful
um for remediating remediating anything
so
instead Let's uh let's invoke
in mode one
again we see uh we're capturing
all of our adcs objects
and this is designed uh for
to run in basic mode
where you're just reporting
designed to run as a normal user you
know active directory is
blessing and curse is the fact that it's
open
um but it does allow you to not have to
to elevate or
you know
um
increased privilege in order to at least
do an audit of your system
so what it's doing now is writing out
two
a CSV file
and I have to apologize in advance I
have not installed any good CSV Viewer
on this machine
um
let's pour one out for
Excel viewer I miss it so much
but now we have a CSV file
indicating what force something was
found what specific object is an issue
and what the issue is
you can import that into whatever system
you need to
help you keep track of it
and that's all good
but what
this still requires you to
figure out how to resolve these issues
on your own
so that's why
created mode 2.
at this point this is getting pretty old
to look at we're collecting some some
objects Etc
we then identify the objects
and then we're going to write it out to
another CSV file
foreign
for some reason
okay
we are done
let's do
all right
so first three first three columns the
same
Forest distinguished name issue
but here at the end
I have now been able to spit out
a one line that
should resolve your issue
um in the situations that we have here
where you know users can request a
certificate with a subject alternative
name without manager approval
the code will remove that manager
approval same thing for the subca
certificate uh as you can see I have not
uh my my code around fixing ACL issues
is a little
um
little not working so that is on my
to-do list
but yeah and then here we could just
easily reset the flags that are
dangerous and uh and then force a
restart on the adcs service
so again
that's that's great I that I feel is
probably going to be the most useful
mode for most people
um this is targeted for obviously a
small shop that's you know one guy
that's probably overwhelmed and
overworked that's that's who I was so
that's kind of who I write tools for
um
but imagining me as that person I would
I would want someone to just come in and
fix the issue for me so I created mode
three
and one more time
Gathering adcs objects
I might do one at a time oh right behind
okay
okay uh yep
so we can see
I did not run this as an 80 admin or a
local admin
on the ca hosts
so
yeah you can't make any changes
with that situation so let's go ahead
and elevate
I have to look at my keyboard because I
can never type this one properly on its
own
okay
let's go ahead and invoke locksmiths in
mode three
I promise you this is the last time
we're gonna see this collecting adcs
objects
okay
successfully enabled everything
so that is pretty much uh the tool
in a nutshell
so let's flip back
so there are some things I still need to
do in locksmith uh passing parameters is
fine but let's let's build a menu out
error handling right now it was built as
an internal tool or this came out of an
internal tool in which pretty much only
I can handle uh properly so
um need to improve error handling so
that way it makes a little more sense
um
multi-forest support in in you know
modern Enterprise environments we've got
trusts on trusts on trusts uh
going into each environment and running
this tool would be annoying so uh plans
to feed a list of forests to it and then
you know given enough or proper
permissions uh should be able to at
least report
the auditing gpos are incredibly
important I currently just warn you that
those need to be set which is not best I
would like to instead alert you if they
do not exist only
um as I mentioned before the remediation
of ACL issues much harder than I
expected to do properly
um as far as methods to remediate those
dangerous templates uh I use manager
approval right now as my default
um
but there are other options we could you
know
reduce who can enroll in an in a uh
in a template we could
eliminate the ability to add a subject
alternative name a lot of options
like to give that option to the user
um and then lastly
don't want to waste your time by you
know running and failing especially in
larger environments if you were not an
admin so we'll check for elevation
before
um attempting to actually fix anything
so that's pretty much it that's
locksmiths
um
these are how you can get a hold of me
if you are interested in assisting or
just want to
talk about whatever
I am most
most active on Twitter
um and then if you want to scan that QR
Code by all means please do it just goes
to my link tree so
and yeah please stop by the Discord I am
monitoring it right now from my home and
uh would love to chat with you there
about how Trimark can help you out uh
you know getting your getting your ad
house in order
so that's it
um thanks to all y'all that came to see
this a special thanks
two black hills the whole Black Hills
Cinematic Universe anti-siphon and wild
west hackenfest and all of those
um special thanks to John strand who
without his pay what you can courses
I wouldn't have had the confidence to
leave the job that I had to join
the wild world of the private sector
um and then of course thanks to Sean and
the rest of the Primark crew on the
ground out there in Deadwood uh
Daryl Jim Danny shut up
yeah that's it any questions
okay Jay can you hear me now find a
chance to hear you now well you made a
question go ahead
what was uh are you concerned about my
sense of pki silk dance so you can
certain about people's running this
potentially making changes to their
Department that they that could
potentially could stop the PK from work
uh here I'll actually just a U.S chick
all right thank you first off thank you
for the presentation close to you yeah
first off there we go can you hear me
great yep yep thanks uh so the question
is is pki especially adcs is really
complicated and I know my clients
um you know will have dozens of
vulnerable templates
and making any of these changes can be
very impactful and potentially knock out
the pki certificates and working
potentially are you trying to design a
locksmith in such a way that changes
hopefully will be really minimal and not
take down any of the connections
right and that's um the manager approval
thing to me
I've always been amazed that anybody has
anything any certificates offered
without uh manager approval
and that to me is the least impactful
unfortunately it adds
a bit of extra work to your pki admins
and I don't like adding extra work to
anybody
that's why I want to add those
additional options on on methods of uh
fixing these issues I mean obviously if
you can reduce the number of users that
can request these dangerous templates
that's going to help a ton
is that good any other questions for
Jake before we let him go
no all right thanks Jake it's a great
job cheers sorry we couldn't have you
here hey no problem
thanks y'all