abusing-adcs

Abusing AD CS

A certificate authority in an Active Directory domain is usually the shortest path from a standard user to domain administrator, because certificate templates are permission objects that almost nobody audits. A single template that lets the enrollee supply their own subject name is a full domain compromise, and it is the default on more networks than it should be.

Only against domains you are authorized to test.

When to Use

• The domain has a CA (pKIEnrollmentService objects exist)
• certipy find or BloodHound reports vulnerable templates
• You have any domain credential and need a privilege escalation path
• You need durable domain persistence that survives a password reset
• Reviewing PKI configuration defensively

When NOT to Use

• General AD attacks (Kerberoasting, DCSync, lateral movement) — use attacking-active-directory
• Delegation abuse — use attacking-kerberos-delegation
• Entra ID / cloud PKI — use attacking-entra-id
• Detecting these attacks — use engineering-detections; certificate request events (4886/4887) are the primary telemetry

Enumerate First

# Certipy — the standard tool; run this before anything else
certipy find -u [email protected] -p 'Password' -dc-ip 10.0.0.10 -vulnerable -stdout
certipy find -u [email protected] -p 'Password' -dc-ip 10.0.0.10 -old-bloodhound

# From Windows
Certify.exe find /vulnerable
Certify.exe cas                      # CA hosts, flags, and enrollment endpoints

certipy find -vulnerable names the ESC number directly, which is why it is the first command. Read the output for: who can enroll, whether the requester supplies the subject, which EKUs are present, and whether manager approval is required.

The Escalation Paths

Grouped by what is misconfigured, because the fix and the detection differ.

Template misconfiguration — the common cases

ID	Condition	Result
ESC1	Enrollee supplies subject (ENROLLEE_SUPPLIES_SUBJECT) + client-auth EKU + low-priv enrollment + no approval	Request a cert as any user, including a domain admin
ESC2	Any Purpose EKU (or no EKU) + low-priv enrollment	Cert usable for client auth; same outcome as ESC1
ESC3	Certificate Request Agent EKU	Enroll on behalf of another user
ESC9	CT_FLAG_NO_SECURITY_EXTENSION set	Cert lacks the SID binding, enabling weak-mapping abuse
ESC15	v1 template with enrollee-supplied subject, application policies injectable	Client auth via application policy, bypassing the EKU restriction