skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

adcs-access-and-relay

Exploit ADCS via ACL abuse and NTLM relay to enrollment endpoints.

253|37|Updated Feb 22, 2026
Search Tags:#active directory#adcs#certificate services#acl abuse#ntlm relay#esc4#esc8
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill adcs-access-and-relay
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: adcs-access-and-relay
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/adcs-access-and-relay
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill adcs-access-and-relay

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires certipy, certify.exe, ntlmrelayx.py, modifyCertTemplate.py, PetitPotam.py, printerbug.py, DFSCoerce.py, Rubeus.exe, secretsdump.py, mitm6, krbrelayx.py, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers exploit Active Directory Certificate Services (ADCS) by abusing access control lists (ACLs) on templates or Certificate Authority (CA) objects, and by leveraging NTLM relay attacks against enrollment endpoints.

Core Features & Use Cases

  • ACL Abuse: Exploit misconfigurations in certificate template permissions (ESC4) or PKI object ACLs (ESC5) to gain unauthorized certificate enrollment.
  • CA Permission Abuse: Leverage ManageCA or ManageCertificates permissions on the CA itself to issue privileged certificates or achieve remote code execution (ESC7).
  • NTLM Relay: Exploit HTTP (ESC8) or RPC (ESC11) enrollment endpoints by relaying NTLM authentication to obtain certificates for privileged accounts or machines.
  • Use Case: A tester needs to gain domain administrator privileges. They discover that a certificate template is misconfigured, allowing them to enroll for a certificate with a specific SAN. They use this skill to exploit the misconfiguration, obtain a certificate, and use it to authenticate as a high-privilege user.

Quick Start

Use the adcs-access-and-relay skill to identify attack paths for exploiting ADCS by checking certificate template ACLs and CA permissions.

Frequently Asked Questions about adcs-access-and-relay

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Active Directory Certificate Services misconfigurations?▼

Exploit Active Directory Certificate Services by abusing ACLs on certificate templates and CA objects, or relaying NTLM authentication to HTTP and RPC enrollment endpoints using Certipy and Certify.exe.

What is the difference between ESC4 and ESC8 ADCS vulnerabilities?▼

ESC4 targets misconfigured certificate template ACLs allowing unauthorized enrollment, while ESC8 exploits HTTP enrollment endpoints by relaying NTLM authentication to obtain privileged machine or user certificates.

Can I use NTLM relay to compromise ADCS RPC enrollment endpoints?▼

Yes, NTLM relay attacks can target ADCS RPC enrollment endpoints, exploiting the ESC11 technique to intercept authentication and obtain certificates for privileged accounts via ntlmrelayx.py.

How do I abuse ManageCA permissions on a Certificate Authority?▼

Abuse ManageCA permissions using the ESC7 technique to issue privileged certificates or achieve remote code execution by manipulating CA configuration and certificate enrollment policies.

Do I need Certipy to modify certificate template ACLs?▼

Yes, modifying certificate template ACLs requires tools like Certipy, Certify.exe, or modifyCertTemplate.py to exploit ESC4 vulnerabilities and gain unauthorized enrollment rights.

What tools are required for NTLM relay attacks against ADCS?▼

NTLM relay attacks against ADCS require ntlmrelayx.py, PetitPotam.py, and coercer tools like printerbug.py or DFSCoerce.py to trigger authentication and relay it to enrollment endpoints.

Related Skills

Explore More Software Engineering Skills→
ArianHobson333ArianHobson333
7

ad-overview

Automate Active Directory attack and defense operations with BloodHound, Kerberoasting, ADCS ESC scanning, DCSync, and LAPS extraction.

Community
Advanced
ArianHobson333ArianHobson333
7

credential-access

Extract credentials via LSASS dumping, SAM/SECURITY hives, and DPAPI decryption.

Community
Advanced
utsavthakurutsavthakur

ntlm-relay-coercion

Relay NTLM authentication to SMB, LDAP, HTTP, and MSSQL targets.

Community
Advanced
zebbernzebbern
4.5k

Network 101

Configure and test HTTP/HTTPS, SNMP, and SMB services on Windows and Linux targets.

Community
Intermediate