Blessed CertPotato, Who Promoted the Service Accounts

Patron of virtual service accounts, corporate PKIs, and the Windows "potato" family.

Life

On 4 November 2022 Hocine Mahtout of SensePost described CertPotato: on a domain-joined machine, a virtual or network service account, normally low-privileged, could request a certificate for the machine account and use it to authenticate as the machine itself, climbing all the way to SYSTEM. It was the latest in the Windows "potato" family, which from RottenPotato onward has turned small privileges into full power by abusing system authentication.

Prayer

O Blessed CertPotato, who promotes the humble service account, let our certificates not be requested by just anyone. Amen.

How to celebrate

Celebrated by hardening the AD CS certificate templates and limiting who may request them, one potato at a time.

Even the humblest account dreams of the machine certificate.