The WriteOverCertificateTemplate permission in Active Directory grants a user or group write permission over certificate templates. This permission allows the holder to modify and manage all writable aspects of certificate templates. Administrators can configure key aspects such as validity periods, encryption algorithms, enrollment options, auto-renewal settings, and which Certificate Authorities can issue certificates based on these templates.
However, if misconfigured, the WriteOverCertificateTemplate permission can pose significant security risks. An attacker who gains WriteOverCertificateTemplate right on a certificate template could modify its settings to issue fraudulent certificates, bypass security checks, or weaken cryptographic controls. This exploitation could lead to unauthorized access, compromise of secure communications, and widespread disruption of the Public Key Infrastructure (PKI).
Identification
PowerShell
Active Directory Module
Using the ActiveDirectory PowerShell module, you can enumerate WriteOverCertificateTemplate entries.
1. Find-WriteOverCertificateTemplate function
2. Scan all templates
3. Scan a specific template
4. Exclude default admins for clear visibility
.NET Directory Services
By leveraging PowerShell’s built-in .NET DirectoryServices namespace, you can enumerate WriteOverCertificateTemplate entries without relying on any external modules or dependencies.
1. Find-WriteOverCertificateTemplateSimple function
2. Scan all templates
3. Scan a specific template
4. Exclude default admins for clear visibility
Certification Authority
1. Open Certification Authority (certsrv) on your Windows server.
2. Expand CA name and right click the Certificate Templates
3. Select Manage from the context menu.
4. In the Certificate Templates Console window, double-click the Certificate Template.
5. In the Properties window, navigate to the Security tab.
6. In the Security Settings window, locate and select the relevant Access Control Entry (ACE) for the user or group you wish to configure.
7. In the permissions list, locate and check the option Write.
8. Click OK to save your changes and close the dialogs.
certsrv
Exploitation
This permission can be exploitable on Windows systems with certify and rubeus, while on Linux systems, tools such as certipy can be effectively used for exploitation.Certify, Rubeus, Certipy
The following examples demonstrate exploitation on Windows and Linux environments.
Windows
Using powerview to edit the template to be vulnerable to ESC01
ESC1 using powershell
Request a certificate for administrator
Example:
Request a certification using Certfiy.exe
After running this, certify will give a certificate to you. You should create a pem file and write came file. Then convert pem file to pxf format with openssl, it will give you a pfx-formatted certificate. (You don't have to set password)
Example:
Convert certificate to pfx format
Then you can obtain a TGT using the formatted certificate with Rubeus and retrieve the NTLM hash.
Example:
Get TGT and NTLM hash using Rubeus.exe
Linux
Using Certipy-AD to list vulnerable templates
Example:
find all templates using certipy
Edit the Template to Be Vulnerable to ESC01 Using Certipy-AD
Example:
ESC01 with certipy-ad
Request a certificate for administrator
Example:
Retrieve the NTLM hash of administrator
Example:
Request a certificate & Get NTLM hash using the certificate
Mitigation
1. Open Certification Authority (certsrv) on your Windows server.
2. Expand CA name and right click the Certificate Templates
3. Select Manage from the context menu.
4. In the Certificate Templates Console window, double-click the Certificate Template.
5. In the Properties window, navigate to the Security tab.
6. In the Security Settings window, locate and select the relevant Access Control Entry (ACE) for the user or group you wish to configure.
7. In the permissions list, locate and remove the Write permission from unauthorized users.
8. Click OK to save your changes and close the dialogs.
certsrv
Detection
Adding new Access Control Entries on the Active Directory objects changes the ntSecurityDescriptor attribute of the objects themselves. These changes can be detected with the 5136 and 4662 Event IDs to identify unauthorized modifications.
