Academy Node
ADCS Discovery
ADCS discovery finds enterprise CAs and vulnerable certificate templates.
Advanced100 XPEnumeration
Why it matters
ADCS can produce instant privilege escalation when templates are misconfigured.
How to identify it
- Certipy finds CA
- LDAP objects under Enrollment Services
- Templates with dangerous settings
BloodHound indicators
- ADCS template relationships
Certipy commands
certipy-ad find -u USER@xutslabs.local -p 'PASS' -dc-ip 192.168.184.141 -vulnerable -stdoutcertipy-ad find -u USER@xutslabs.local -p 'PASS' -dc-ip 192.168.184.141 -jsonExpected output
- CA name
- Template vulnerabilities
- ESC findings
Success looks like
- ESC1/ESC8/etc identified
Failure looks like
- No CA
- Enrollment denied
- RPC blocked
Troubleshooting
- Use -debug
- Try LDAP-only find
- Check DNS
Common mistakes
- Wrong CA name
- Ignoring template enrollment rights
Alternative attacks
- Kerberoast
- DACL abuse
What to try next
- ADCS ESC1
- ADCS ESC8
- Cert auth
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.