Skip to content

Commit 7f6f900

Browse files
jakehildrethjakehildreth
authored
Merge pull request #249
Add ESC9 and Improve Risk Ratings
2 parents c47b95a + fec7548 commit 7f6f900

17 files changed

Lines changed: 941 additions & 362 deletions

‎Build/Build-Module.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ Build-Module -ModuleName 'Locksmith' {
129129

130130
# The scans to run. Defaults to 'All'.
131131
[Parameter()]
132-
[ValidateSet('Auditing', 'ESC1', 'ESC2', 'ESC3', 'ESC4', 'ESC5', 'ESC6', 'ESC7', 'ESC8', 'ESC11', 'ESC13', 'ESC15', 'EKUwu', 'ESC16', 'All', 'PromptMe')]
132+
[ValidateSet('Auditing', 'ESC1', 'ESC2', 'ESC3', 'ESC4', 'ESC5', 'ESC6', 'ESC7', 'ESC8', 'ESC9', 'ESC11', 'ESC13', 'ESC15', 'EKUwu', 'ESC16', 'All', 'PromptMe')]
133133
[array]$Scans = 'All'
134134
)
135135
}

‎Invoke-Locksmith.ps1‎

Lines changed: 472 additions & 179 deletions
Large diffs are not rendered by default.

‎Locksmith.psd1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
FunctionsToExport = 'Invoke-Locksmith'
99
GUID = 'b1325b42-8dc4-4f17-aa1f-dcb5984ca14a'
1010
HelpInfoURI = 'https://raw.githubusercontent.com/jakehildreth/Locksmith/main/en-US/'
11-
ModuleVersion = '2025.5.18'
11+
ModuleVersion = '2025.5.26'
1212
PowerShellVersion = '5.1'
1313
PrivateData = @{
1414
PSData = @{

‎Private/Find-ESC1.ps1‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -92,12 +92,14 @@ Get-ADObject `$Object | Set-ADObject -Replace @{'msPKI-Enrollment-Flag' = 0}
9292
Technique = 'ESC1'
9393
}
9494

95-
if ( $Mode -in @(1, 3, 4) ) {
96-
Update-ESC1Remediation -Issue $Issue
97-
}
9895
if ($SkipRisk -eq $false) {
9996
Set-RiskRating -ADCSObjects $ADCSObjects -Issue $Issue -SafeUsers $SafeUsers -UnsafeUsers $UnsafeUsers
10097
}
98+
99+
if ( $Mode -in @(1, 3, 4) ) {
100+
Update-ESC1Remediation -Issue $Issue
101+
}
102+
101103
$Issue
102104
}
103105
}

‎Private/Find-ESC3C1.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
$($entry.IdentityReference) can use this template to request an Enrollment Agent
6161
certificate without Manager Approval.
6262
63-
The resulting certificate can be used to enroll in any template that requires
63+
The resulting certificate can be used to enroll in any template that allows
6464
an Enrollment Agent to submit the request.
6565
6666
More info:

‎Private/Find-ESC4.ps1‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -173,12 +173,14 @@ Set-Acl -Path 'AD:$($_.DistinguishedName)' -AclObject `$ACL
173173
Technique = 'ESC4'
174174
}
175175

176-
if ( $Mode -in @(1, 3, 4) ) {
177-
Update-ESC4Remediation -Issue $Issue
178-
}
179176
if ($SkipRisk -eq $false) {
180177
Set-RiskRating -ADCSObjects $ADCSObjects -Issue $Issue -SafeUsers $SafeUsers -UnsafeUsers $UnsafeUsers
181178
}
179+
180+
if ( $Mode -in @(1, 3, 4) ) {
181+
Update-ESC4Remediation -Issue $Issue
182+
}
183+
182184
$Issue
183185
}
184186
}

‎Private/Find-ESC6.ps1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
$Issue = [pscustomobject]@{
3838
Forest = $_.CanonicalName.split('/')[0]
3939
Name = $_.Name
40+
CAFullname = $CAFullName
4041
DistinguishedName = $_.DistinguishedName
4142
Issue = $_.SANFlag
4243
Fix = 'N/A'

‎Private/Find-ESC7.ps1‎

Lines changed: 58 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -34,74 +34,80 @@
3434
[switch]$SkipRisk
3535
)
3636
process {
37-
$ADCSObjects | Where-Object {
38-
($_.objectClass -eq 'pKIEnrollmentService') -and $_.CAHostDistinguishedName -and
39-
( ($_.CAAdministrator) -or ($_.CertificateManager) )
37+
Write-Output $ADCSObjects -PipelineVariable object | Where-Object {
38+
($object.objectClass -eq 'pKIEnrollmentService') -and $object.CAHostDistinguishedName -and
39+
( ($object.CAAdministrator) -or ($object.CertificateManager) )
4040
} | ForEach-Object {
41-
$UnsafeCAAdministrators = Write-Output $_.CAAdministrator -PipelineVariable admin | ForEach-Object {
41+
Write-Output $object.CAAdministrator -PipelineVariable admin | ForEach-Object {
4242
$SID = Convert-IdentityReferenceToSid -Object $admin
4343
if ($SID -notmatch $SafeUsers) {
44-
$admin
45-
}
46-
}
47-
$UnsafeCertificateManagers = Write-Output $_.CertificateManager -PipelineVariable manager | ForEach-Object {
48-
$SID = Convert-IdentityReferenceToSid -Object $manager
49-
if ($SID -notmatch $SafeUsers) {
50-
$manager
51-
}
52-
}
53-
if ($UnsafeCAAdministrators -or $UnsafeCertificateManagers) {
54-
$Issue = [pscustomobject]@{
55-
Forest = $_.CanonicalName.split('/')[0]
56-
Name = $_.Name
57-
DistinguishedName = $_.DistinguishedName
58-
CAAdministrator = $_.CAAdministrator
59-
CertificateManager = $_.CertificateManager
60-
Issue = $null
61-
Fix = $null
62-
Revert = $null
63-
Technique = 'ESC7'
64-
}
65-
if ($UnsafeCAAdministrators) {
66-
$Issue.Issue = $Issue.Issue + @"
67-
Unexpected principals are granted "CA Administrator" rights on this Certification Authority.
68-
Unsafe CA Administrators: $($UnsafeCAAdministrators -join ', ').
44+
$Issue = [pscustomobject]@{
45+
Forest = $object.CanonicalName.split('/')[0]
46+
Name = $object.Name
47+
DistinguishedName = $object.DistinguishedName
48+
IdentityReference = $admin
49+
IdentityReferenceSID = $SID
50+
Right = 'CA Administrator'
51+
Issue = @"
52+
$admin has been granted CA Administrator rights on this Certification Authority (CA).
6953
70-
"@
71-
$Issue.Fix = $Issue.Fix + @"
72-
Revoke CA Administrator rights from $($UnsafeCAAdministrators -join ', ')
54+
$admin has full control over this CA.
7355
74-
"@
75-
$Issue.Revert = $Issue.Revert + @"
76-
Reinstate CA Administrator rights for $($UnsafeCAAdministrators -join ', ')
56+
More info:
57+
- https://posts.specterops.io/certified-pre-owned-d95910965cd2
7758
7859
"@
79-
}
80-
if ($UnsafeCertificateManagers) {
81-
$Issue.Issue = $Issue.Issue + @"
82-
expected principals are granted "Certificate Manager" rights on this Certification Authority.
83-
Unexpected Principals: $($UnsafeCertificateManagers -join ', ')
60+
Fix = "Revoke CA Administrator rights from ${admin}."
61+
Revert = "Restore CA Administrator rights to ${admin}."
62+
Technique = 'ESC7'
63+
}
8464

85-
"@
86-
$Issue.Fix = $Issue.Fix + @"
87-
Revoke Certificate Manager rights from $($UnsafeCertificateManagers -join ', ')
65+
if ($SkipRisk -eq $false) {
66+
Set-RiskRating -ADCSObjects $ADCSObjects -Issue $Issue -SafeUsers $SafeUsers -UnsafeUsers $UnsafeUsers
67+
}
8868

89-
"@
90-
$Issue.Revert = $Issue.Revert + @"
91-
Reinstate Certificate Manager rights for $($UnsafeCertificateManagers -join ', ')
69+
if ( $Mode -in @(1, 3, 4) ) {
70+
Update-ESC7Remediation -Issue $Issue
71+
}
9272

93-
"@
94-
}
95-
if ($SkipRisk -eq $false) {
96-
Set-RiskRating -ADCSObjects $ADCSObjects -Issue $Issue -SafeUsers $SafeUsers -UnsafeUsers $UnsafeUsers
73+
$Issue
9774
}
98-
$Issue.Issue = $Issue.Issue + @"
75+
}
76+
77+
Write-Output $object.CertificateManager -PipelineVariable admin | ForEach-Object {
78+
$SID = Convert-IdentityReferenceToSid -Object $admin
79+
if ($SID -notmatch $SafeUsers) {
80+
$Issue = [pscustomobject]@{
81+
Forest = $object.CanonicalName.split('/')[0]
82+
Name = $object.Name
83+
DistinguishedName = $object.DistinguishedName
84+
IdentityReference = $admin
85+
IdentityReferenceSID = $SID
86+
Right = 'Certificate Manager'
87+
Issue = @"
88+
$admin has been granted Certificate Manager rights on this Certification Authority (CA).
89+
90+
$admin can approve pending certificate requests on this CA.
9991
10092
More info:
10193
- https://posts.specterops.io/certified-pre-owned-d95910965cd2
10294
10395
"@
104-
$Issue
96+
Fix = "Revoke Certificate Manager rights from ${admin}."
97+
Revert = "Restore Certificate Manager rights to ${admin}."
98+
Technique = 'ESC7'
99+
}
100+
101+
if ($SkipRisk -eq $false) {
102+
Set-RiskRating -ADCSObjects $ADCSObjects -Issue $Issue -SafeUsers $SafeUsers -UnsafeUsers $UnsafeUsers
103+
}
104+
105+
if ( $Mode -in @(1, 3, 4) ) {
106+
Update-ESC7Remediation -Issue $Issue
107+
}
108+
109+
$Issue
110+
}
105111
}
106112
}
107113
}

0 commit comments

Comments
 (0)