active-directory-certificate-services

Active Directory Certificate Services privilege escalation involves exploiting misconfigured certificate templates, NTLM relay attacks, and CA misconfigurations. You can abuse vulnerable templates by requesting certificates that grant elevated domain privileges using tools like certipy.

ESC1 through ESC13 are specific AD CS vulnerability classes targeting misconfigured certificate templates, enrollment endpoints, and CA permissions. They allow attackers to escalate privileges by abusing template settings, enrollment agent restrictions, and relay mechanisms.

Enumerate vulnerable AD CS certificate templates by running 'certipy find' to identify misconfigured templates, weak CA permissions, and enrollment endpoints. This reveals templates susceptible to privilege escalation and persistence attacks across the environment.

Yes, PetitPotam forces authentication requests from domain controllers or other hosts, which can be relayed to AD CS HTTP enrollment endpoints using ntlmrelayx. This allows attackers to obtain certificates on behalf of privileged accounts.

AD CS golden certificates are forged using stolen CA private keys or compromised certificate templates, allowing persistent authentication as any user. Tools like ForgeCert can generate these certificates to maintain long-term undetectable network access.

Yes, exploiting AD CS requires understanding of certificate templates, enrollment endpoints, CA permissions, and Active Directory architecture. Familiarity with tools like certipy, ntlmrelayx, and PetitPotam is essential for successful exploitation.