AD CS ESC — Attack Index
Ctrl+F:
ESC1·ESC9·certipy find·Hacker Recipes·Certified
External: Internal All The Things — Certificate Services
External: Internal All The Things — Certificate ESC
External: Internal All The Things — Golden Certificate
SpecterOps “Certified Pre-Owned” misconfigurations → domain compromise via PKINIT.
Always start:
certipy-ad find -u user@domain.htb -p 'PASS' -dc-ip DC_IP -vulnerable
grep -i ESC *_Certipy.txt # read the .txt report Certipy writes→ Certipy & Certify · Certipy & Certify > find — enumerate
📌 ESC quick map
| ESC | Name | Vault note | Hacker Recipes |
|---|---|---|---|
| ESC1 | Enrollee supplies SAN / UPN | ESC1 | Template SAN |
| ESC2 | Any Purpose EKU | ESC2 | Any purpose EKU |
| ESC3 | Enrollment Agent EKU | ESC3 | Certificate Agent |
| ESC4 | Vulnerable template ACL | ESC4 | Template ACL (ESC4) |
| ESC6 | CA EDITF_ATTRIBUTESUBJECTALTNAME2 | ESC6 | EDITF SAN on CA |
| ESC7 | Vulnerable CA ACL | ESC7 | CA ACL (ESC7) |
| ESC8 | NTLM relay → web enrollment | ESC8 | Web endpoint ESC8 |
| ESC9 | No security extension + UPN swap | ESC9 | No security extension |
| ESC10 | Weak certificate mapping | ESC10 | Weak mapping |
| ESC13 | Issuance policy → privileged group | ESC13 | Issuance policy |
| ESC14 | Weak explicit mapping | ESC14 | Weak explicit mapping |
| ESC15 | Arbitrary application policy | ESC15 | CVE-2024-49019 |
| ESC16 | Security extension disabled on CA | ESC16 | ESC16 on CA |
Also: SpecterOps whitepaper — Certified Pre-Owned (PDF)
📌 Generic post-cert workflow
After any ESC gives you a .pfx:
certipy-ad auth -pfx administrator.pfx -domain 'domain.htb' -dc-ip DC_IP
evil-winrm -i DC_IP -u Administrator -H NTHASHOr with ticket → Use Kerberos Ticket