PKI Well Revised: Common Mistakes Which Lead to Huge Compromise of Identity
summary
Live demo shows that a misconfigured CA template with requesting a server template with clientAuthentication and arbitrary SAN lets a low-privilege user request a cert for admin@domain, export its private key (software KSP/DPAPI) and import it to a TPM/smartcard. Using runas /smartcard to authenticate as that SAN grants a shell that escalates to domain admin, mounts DC C$, reads NTDS and steals Kerberos tickets. Fixes: disable multipurpose templates, require manual approval, restrict template permissions to domain admins, and avoid unconstrained cross‑certs.
AI-written summary · about
chapters (5)
- 0:00Introduction to PKI risks
- 1:02Cryptography and PKI basics
- 3:13Public key infrastructure
- 11:51Live hacking demonstration
- 27:14Mitigation and conclusions
related talks
31mPKI the Wrong Way: Simple TLS Mistakes and Surprising Consequences
16mPKI problem: who we actually trust
40mDigital Identities - 21 PKI Pitfalls and How Best to Avoid Them
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
40mExploiting Windows Hello for Business
22mTreat the Problems, Not the Symptoms
32mA SSLippery Slope: Unraveling the Hidden Dangers of Certificate Misuse