ESC17: Using ADCS to Attack HTTPS-Enabled WSUS Clients#

Alexander Neff (DigiTrace GmbH)

• Why: ADCS misconfiguration research has produced the most consequential AD attack techniques of the last years, and this adds a new numbered entry that chains PKI trust into host compromise. Directly in your AD-identity wheelhouse.
• What: A new escalation technique, dubbed ESC17, combining misconfigured certificate templates with a MitM on HTTPS-enabled WSUS to gain command execution on Windows machines that are configured per best practice. The authors found that partial ESC1 mitigations leave room for this less-discussed path, and that the root cause is general to ADCS trust relationships, not WSUS-specific. A companion blog post exists, and the speaker maintains related open-source tooling (NetExec, wsuks, EVENmonitor).
• How: A misused certificate template lets the attacker obtain a certificate that enables impersonating/MitM-ing the WSUS server's HTTPS channel that clients trust; the update channel then delivers attacker-controlled content. The talk frames this as an identifiable, mitigatable template-configuration class (hence the new ESC number).
• Where applicable: Windows enterprises running ADCS and WSUS over HTTPS — a common "hardened" configuration. Requires an internal foothold (position to MitM internal traffic and access to request/abuse a certificate). Broadly applicable across AD fleets, not org-specific.