FEITIAN / FTSafe

FEITIAN / FTSafe has one affected product with vulnerable documentation: FEITIAN / FTSafe FIDO Security Keys FEITIAN / FTSafe FIDO Security Keys – AD CS ESC3 Granted to Authenticated Users FTSafe FEITIAN FIDO Security Keys is described as: FEITIAN FIDO security keys are a series of security keys that are compatible with WebAuthN standard to provide easy and secure online authentication against phishing and MITM attacks. Enroll Windows Smart Card Logon Certificates On Behalf of Other Users Users are guided into misconfiguring a certificate template that: allows enrollees to authenticate as any principal in the domain (ESC3 Attack Technique / ATT&CK T1649) An adversary who is part of Authenticated Users can enroll to The ESC3 misconfiguration is created because: The documentation guides in creating an Enrollment Agent template: Enroll right is granted to Authenticated Users, which are not supposed to be able to act as enrollment agents: This section’s italicized text originates from the documentation, and the screenshots originate from my lab. 1. Press “win+R” button, run certtmpl. msc, right click the “Enrollment Agent” template and select “Duplicate Template”.

6. Under the Security tab, be sure the Read and Enroll ability is set for the user or group of users who will be setting up the smart cards for logon. The admin group is same as auto-enrollment settings. 8. Publish the enrollment agent certificate template: Right-click the Windows Start button and select Run.

Type certsrv. msc and press Enter. Right click the Certificate Templates folder, choose New then Certificate Template to Issue. Choose the template you just created and click Ok. Abuse DemonstrationRunning Certify.

exe find /vulnerable identifies the misconfigured template: An enrollment agent certificate is requested with Certify.