XUTS LABS
Back to Red Team Playbooks
Active DirectoryRed Team Playbook

ADCS Enumeration

Discover certificate authorities and risky templates before any certificate request testing.

ADCSCertificatesCertipy

Purpose

Identify ADCS exposure and template misconfiguration using authenticated enumeration.

Inputs

  • - DOMAIN/user
  • - Password
  • - DC_IP

Prerequisites

  • - Valid domain account
  • - DOMAIN
  • - DC_IP or CA hostname
  • - ADCS testing allowed

Operator Assumptions

  • - Enumeration is separate from certificate abuse.
  • - Template findings require validation.

Commands

Find ADCS

Kali
certipy-ad find -u 'user@DOMAIN' -p 'Password' -dc-ip DC_IP -enabled -vulnerable -stdout

Why: Enumerate CAs and risky enabled templates.

Expected: CA names, templates, and ESC findings if present.

LDAP CA objects

Kali
ldapsearch -x -H ldap://DC_IP -D 'DOMAIN\user' -w 'Password' -b 'CN=Configuration,BASE_DN' '(objectClass=pKIEnrollmentService)' cn dNSHostName

Why: Confirm CA objects from LDAP.

Expected: Enrollment service objects.

Decision Points

  • - If no CA exists, move on.
  • - If vulnerable templates exist, create a scoped proposal before requests.
  • - If LDAP base is unknown, run RootDSE first.

Follow-On Actions

  • - Template validation
  • - NTLM Relay review
  • - Report misconfiguration

Evidence To Capture

  • - Certipy output
  • - LDAP CA objects
  • - Template permissions
  • - Risk classification

Common Failures

  • - Wrong UPN format
  • - Missing configuration naming context
  • - Tool version differences

Operational Cautions

  • - Certificate requests can create durable credentials.
  • - Do not request certificates without approval.

Related Content

Ask EXO