Does Active Directory offer permanent access to hackers?

Security researchers have discovered critical flaws in Microsoft Active Directory Certificate Services (AD CS), which could allow hackers permanent access to compromised networks.

See also: WazirX hackers “hide” stolen crypto via Tornado Cash

The findings, detailed in a comprehensive investigation by Will Schroeder and Lee Christensen, reveal how Active Directory CS misconfigurations can be exploited for credential theft, privilege escalation, and persistent access.

AD CS, Microsoft's implementation of Public Key Infrastructure (PKI) in Active Directory environments, is widely deployed but often overlooked from a security perspective.

Microsoft says that Active Directory Certificate Services (AD CS) “allows you to create a public key infrastructure (PKI) and provide public key encryption, digital certificates, and digital signature capabilities for your organization.”

See also: Young gamers targeted by hackers – The most "dangerous" games

Researchers identified several hackers exploiting Active Directory CS credentials for persistent access:

• Certificate Theft: Attackers can extract user and machine certificates, including their private keys, from compromised systems. This allows for the impersonation of users and machines for authentication purposes.
• Malicious Certificate Enrollments: Low-privileged users can potentially enroll in certificate templates that grant elevated privileges, leading to domain escalation.
• Certificate Template Misconfigurations: Certain template settings, such as the ability for requesters to specify Subject Alternative Names (SAN), can be abused to request certificates for any user in the domain, including administrators.
• EDITF_ATTRIBUTESUBJECTALTNAME2 Flag: If enabled on a Certificate Authority (CA), this setting allows attackers to specify arbitrary SANs in certificate requests, potentially leading to privilege escalation.
• CA Private Key Theft: Compromising a CA's private key allows attackers to forge certificates in the domain, providing permanent access that cannot be easily revoked.

One of the most serious scenarios involves exploiting certificate templates that are not configured properly. Suppose a template allows requesters to specify SANs and has an extended key usage (EKU) that allows domain authentication. In this case, an attacker can request a certificate for any user, including domain administrators. This effectively grants the attacker administrative.

See also: North Korean hackers distribute COVERTCATCH malware

Persistence refers to the ability of an attacker to maintain access to a compromised system over time, even after detection and remediation efforts. This technique often involves developing various methods to evade security measures, such as using hidden backdoors, creating fake user accounts, or reinstalling malware. Understanding and addressing persistence is critical for organizations aiming to protect their digital infrastructure. Effective strategies include regular security audits, continuous monitoring for unusual activity, and implementing robust incident response plans that quickly neutralize threats and eliminate unauthorized access.

Source: cybersecuritynews