active-directory-certificate-services

Identify and exploit Active Directory Certificate Services vulnerabilities for privilege escalation.

Updated Jun 11, 2026

Search Tags:#privilege escalation #attack techniques #NTLM relay #AD CS #certificate-based persistence

Ready to run

npx skills add https://github.com/utsavthakur/agenticskills --skill active-directory-certificate-services-utsavthakur

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: active-directory-certificate-services
Source: https://github.com/utsavthakur/agenticskills/tree/main/active-directory-certificate-services
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill active-directory-certificate-services-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires certipy, ntlmrelayx, PetitPotam, ForgeCert, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides expert-level AD CS attack techniques for privilege escalation and persistence, targeting misconfigured AD CS environments.

Core Features & Use Cases

AD CS Attack Playbook: Offers a comprehensive guide to attacking AD CS with techniques like template abuse, NTLM relay, and certificate-based persistence.
Detailed Enumeration: Enumerates AD CS configurations and vulnerabilities, including certificate templates, enrollment endpoints, and CA permissions.
Exploitation Techniques: Demonstrates step-by-step exploitation of vulnerabilities like ESC1-ESC13, NTLM relay, and CA misconfigurations.
Certificate-Based Persistence: Provides methods for creating golden certificates and using them for persistence on the network.

Quick Start

Load the skill and use the 'certipy find' command to enumerate vulnerable certificates and templates in your AD CS environment.

Frequently Asked Questions about active-directory-certificate-services

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit Active Directory Certificate Services for privilege escalation?▼

Active Directory Certificate Services privilege escalation involves exploiting misconfigured certificate templates, NTLM relay attacks, and CA misconfigurations. You can abuse vulnerable templates by requesting certificates that grant elevated domain privileges using tools like certipy.

What are ESC1 through ESC13 vulnerabilities in AD CS?▼

ESC1 through ESC13 are specific AD CS vulnerability classes targeting misconfigured certificate templates, enrollment endpoints, and CA permissions. They allow attackers to escalate privileges by abusing template settings, enrollment agent restrictions, and relay mechanisms.

How do I enumerate vulnerable AD CS certificate templates?▼

Enumerate vulnerable AD CS certificate templates by running 'certipy find' to identify misconfigured templates, weak CA permissions, and enrollment endpoints. This reveals templates susceptible to privilege escalation and persistence attacks across the environment.

Can I use PetitPotam for NTLM relay attacks against AD CS?▼

Yes, PetitPotam forces authentication requests from domain controllers or other hosts, which can be relayed to AD CS HTTP enrollment endpoints using ntlmrelayx. This allows attackers to obtain certificates on behalf of privileged accounts.

How do I maintain persistence using AD CS golden certificates?▼

AD CS golden certificates are forged using stolen CA private keys or compromised certificate templates, allowing persistent authentication as any user. Tools like ForgeCert can generate these certificates to maintain long-term undetectable network access.

Do I need prior knowledge of AD CS architecture to use these attack techniques?▼

Yes, exploiting AD CS requires understanding of certificate templates, enrollment endpoints, CA permissions, and Active Directory architecture. Familiarity with tools like certipy, ntlmrelayx, and PetitPotam is essential for successful exploitation.