domains / families / security / exploiting-adcs-with-certipy

exploiting-adcs-with-certipy

separate

Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT/Schannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks.

When to use

• During internal penetration tests and red-team engagements where AD CS is in scope
• When a low-privileged domain foothold needs a path to Domain Admin / Domain Controller
• To validate that certificate template ACLs and CA configuration are hardened
• When testing detection coverage for certificate-based privilege escalation
• During purple-team exercises to generate ESC1/ESC8 telemetry for blue-team tuning

When not to use

• unauthorized use
• systems without explicit written authorization

Skill page

Source