active-directory-certificate-services

AD CS Attack Playbook is a security-testing reference for assessing Active Directory Certificate Services, the PKI component of Active Directory, for misconfigurations that lead to privilege escalation and persistence. Aimed at penetration testers and red teams, it catalogs the ESC weakness classes from ESC1 through ESC13, along with NTLM relay to enrollment endpoints, certificate-authority officer abuse, and certificate-based persistence.

After an architecture overview of enterprise CAs, certificate templates, enrollment endpoints, and the certificate-to-Kerberos (PKINIT) authentication flow, it provides enumeration commands and then a section per technique. Coverage includes ESC1 (enrollee-supplied subject/SAN), ESC2 (Any Purpose EKU), ESC3 (enrollment agent), ESC4 (template ACL misconfiguration), ESC6 (the EDITF_ATTRIBUTESUBJECTALTNAME2 flag), ESC7 (ManageCA/ManageCertificates officer permissions), ESC8 (relay to the HTTP certsrv endpoint), ESC9 and ESC10 (weak certificate mapping), ESC11 (relay to RPC enrollment), and ESC13 (OID group link). Each technique states its precondition and gives concrete command examples using tools such as Certipy, Certify, certutil, ntlmrelayx, and PetitPotam. A certificate-based persistence section describes the golden certificate approach, where possession of the CA private key allows forging certificates for arbitrary users.

Use it when an engagement scope includes AD CS and you need to identify which ESC conditions are present and how they chain, for example using ACL abuse to reach ESC4, or coercion plus relay to reach ESC8. The skill notes that base models often miss enrollment prerequisite chains and the specific condition combinations that make a template exploitable, and it routes to companion playbooks for ACL abuse, Kerberos attacks, NTLM relay coercion, and lateral movement, plus an ESC matrix reference with per-variant conditions, one-liner commands, and detection indicators.