The ESC16 vulnerability in AD CS allows attackers to bypass certificate validation and escalate privileges through misconfigured templates, UPN mapping, and shadow credentials. This can lead to full domain compromise. Immediate mitigation is critical to protect your Microsoft PKI and prevent unauthorized access. Table of Content Overview the ESC16 Attack Prerequisites Lab Setup Enumeration & […]
ADCS ESC15 – Exploiting Template Schema v1
The ESC15 vulnerability (EKUwu), affects Active Directory Certificate Services (AD CS), allowing attackers to inject unauthorized EKUs (e.g., Client Authentication) into Schema Version 1 templates. This flaw enables privilege escalation, bypassing security restrictions and granting unauthorized access. Organizations using AD CS must act quickly to mitigate this high risk security issue. Table of Content Overview […]
ADCS ESC14 – Write access on altSecurityIdentities
ESC14 targets weak certificate mapping in Active Directory, exploiting the altSecurityIdentities attribute to allow attackers to spoof Subject CN or Issuer DN fields. This enables unauthorized PKI authentication as a privileged user or Domain Controller, leading to privilege escalation and potential domain compromise. Proper certificate validation is critical to prevent ESC14 attacks. Table of Content […]
ADCS ESC11 – Relaying NTLM to ICPR
ESC11 (Enterprise Security Control 11) represents a sophisticated attack path targeting Active Directory Certificate Services (AD CS), exploiting a dangerous combination of vulnerabilities. This advanced security threat leverages RPC-only certificate enrollment enforcement, NTLM relay vulnerabilities, and coercion techniques that force NTLM authentication from privileged machines, including Domain Controllers. As a result, ESC11 opens the door […]
ADCS ESC10 – Weak Certificate Mapping
ESC10 is a powerful post-exploitation technique in Active Directory Certificate Services (ADCS) that lets attackers authenticate as any user even Domain Admins without knowing their password. It exploits two key weaknesses: weak certificate mapping enforcement and shadow credentials (custom certificate logins). Unlike traditional attacks, ESC10 abuses PKI trust and AD flexibility, making it stealthy, persistent, […]
ADCS ESC9 – No Security Extension
Misconfigured certificate templates, particularly those affected by ESC9, pose a critical threat to Active Directory environments. By disabling the szOID_NTDS_CA_SECURITY_EXT security extension through the CT_FLAG_NO_SECURITY_EXTENSION flag, even with StrongCertificateBindingEnforcement enabled, weak or implicit certificate mappings can still be exploited. This misconfiguration enables attackers to bypass security mechanisms and potentially escalate privileges to unauthorized domain admin […]
ADCS ESC8 – NTLM Relay to AD CS HTTP Endpoints
ESC8 is a critical vulnerability in Active Directory Certificate Services (ADCS) that targets web enrollment interfaces, making them vulnerable to NTLM relay attacks. If HTTPS is not enforced and the Certificate Authority (CA) supports client authentication or domain computer enrollment templates, attackers can exploit this to impersonate users and escalate privileges. This attack can target […]
ADCS ESC7 – Vulnerable Certificate Authority Access Control
ESC7 is a critical security vulnerability where attackers exploit weak access controls within Certificate Authorities (CAs). By targeting key permissions like ManageCA and Manage Certificates, attackers can compromise certificate management systems. The ManageCA permission grants administrative control, allowing attackers to modify settings like EDITF_ATTRIBUTESUBJECTALTNAME2 and exploit vulnerabilities such as ESC6 using PSPKI cmdlets. Meanwhile, ManageCertificates […]
ADCS ESC6: Editf_attributesubjectaltname2
The ESC6 attack is a sophisticated privilege escalation technique that targets Active Directory Certificate Services (ADCS). By exploiting misconfigured certificate templates and overly permissive CA settings, attackers can stealthily acquire legitimate certificates to impersonate high-privilege accounts, such as Domain Admins, without resorting to exploits or brute force. This attack takes advantage of trusted infrastructure and […]
ADCS ESC5: Vulnerable PKI Object Access Control
ESC5 is a high-risk certificate attack targeting Active Directory Certificate Services (ADCS). This ADCS attack exploits insecure access to the Certificate Authority (CA)’s private key. When attackers gain local admin access on the CA server, they can export the private key. This allows them to forge valid certificates for any AD account, including Domain Admins. This […]