Abusing Active Directory Certificate Services
In the next two chapters, we will cover services that can be found in almost every environment but are not installed by default during Active Directory deployment. We will start with Active Directory Certificate Service (AD CS). This service is Microsoft’s implementation of a Public Key Infrastructure (PKI) integrated with Active Directory. It allows us to utilize public key cryptography throughout the Active Directory forest, providing certificates, digital signatures, code signing, and other capabilities. As usual, with great power comes great responsibility. AD CS has been often overlooked in terms of hardening and monitoring due to its complex nature. In June 2021, SpecterOps released a comprehensive research paper where they described known and new ways to attack AD CS[1].
We will start our learning journey by explaining the necessary PKI theory. We will then cover possible ways to steal certificates and achieve persistence...
