Summary
| Forestall ACL Alias | HAS_CA |
| Affected Object Types | Computers |
| Exploitation Certainty | Certain |
Description
The HAS_CA edge in Active Directory indicates that a specific computer hosts a Certificate Authority (CA). This role is important for providing Public Key Infrastructure (PKI) services, enabling the issuance and management of digital certificates across the network. A CA helps enforce secure communication, authenticate identities, and establish trusted relationships among services and components.
The HAS_CA edge itself does not represent a direct vulnerability, but it can be a risk factor depending on the environment’s overall security posture and configuration. For example, if a Certificate Authority is misconfigured, has weak access controls, or lacks adequate auditing, an attacker might exploit those weaknesses to issue unauthorized certificates, impersonate trusted services, or compromise the integrity of certificate chains. Such actions can enable lateral movement, bypass security controls, or provide persistent access to critical assets.
Identification
PowerShell
Active Directory Module
Using the ActiveDirectory PowerShell module, you can enumerate HAS_CA entries.
Function: Find-HAS_CA
function Find-HAS_CA { [CmdletBinding()] param ([string]$ComputerDistinguishedName = $null,[string]$OutputPath = ".\HAS_CA.csv" ) # 1) Load ActiveDirectory module Import-Module ActiveDirectory -ErrorAction Stop # 2) Get Configuration Naming Context try { $configurationNC = (Get-ADRootDSE).ConfigurationNamingContext } catch { Write-Error "Failed to retrieve ConfigurationNamingContext: $($_.Exception.Message)" return } # 3) Query all Certificate Authority objects try { $caObjects = Get-ADObject -SearchBase $configurationNC -LDAPFilter "(objectClass=pKIEnrollmentService)" -Properties dNSHostName } catch { Write-Error "Failed to query CA objects: $($_.Exception.Message)" return }
# 4) Filter by specific computer if provided if ($ComputerDistinguishedName) { try { $dNSHostName = (Get-ADComputer -Identity $ComputerDistinguishedName -Properties dNSHostName).dNSHostName $caObjects = $caObjects | Where-Object { $_.dNSHostName -eq $dNSHostName } } catch { Write-Error "Failed to match CA to specified computer: $($_.Exception.Message)" return } } # 5) Format results $formattedResults = $caObjects | Select-Object Name, dNSHostName # 6) Export results if found if ($formattedResults -or $formattedResults.Count -gt 0) { try { $formattedResults | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8 -ErrorAction Stop Write-Host "Results exported to '$OutputPath'" } catch {Write-Error "Failed to export to CSV: $($_.Exception.Message)"} } else {Write-Output "No HAS_CA entries found."}}- Scan all CA objects in the domain
Find-HAS_CA- Scan a specific CA server by distinguished name
Find-HAS_CA -ComputerDistinguishedName 'CN=FSCA01,CN=Computers,DC=forestall,DC=labs'Active Directory Service Interfaces (GUI)
To identify HAS_CA entries using ADSI Edit, follow these steps:
1. Open ADSI Edit on a Windows server with the appropriate tools installed.
2. Expand: Configuration > Services > Public Key Services > Enrollment Services.
3. The computers listed are the Certificate Authority (CA) servers in the domain.
4. Right-click a CA server and select Properties.
5. In the Properties window, check the dNSHostName or cn attribute to confirm the CA role.
Exploitation
The HAS_CA edge represents the presence of a Certificate Authority in the environment and does not itself provide an exploitable path.
Mitigation
No specific mitigation applies to the HAS_CA edge. Because it only represents the existence of a Certificate Authority and does not indicate an exploitable path, no direct mitigation is required.
Detection
Adding new Access Control Entries to Active Directory objects changes the ntSecurityDescriptor attribute of those objects. These changes can be detected using the following Event IDs: