skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

adcs-persistence

Automate AD CS persistence via Golden Certificate forging and certificate theft.

253|37|Updated Feb 22, 2026
Search Tags:#persistence#active directory#adcs#certificate abuse#golden certificate#esc9#esc10
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill adcs-persistence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: adcs-persistence
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/adcs-persistence
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill adcs-persistence

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires certipy, certify.exe, ForgeCert, mimikatz, SharpDPAPI, Rubeus, openssl, pfx2john.py, getnthash.py, Stifle.exe, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers establish persistent access within Active Directory environments by exploiting misconfigurations and vulnerabilities in Active Directory Certificate Services (AD CS).

Core Features & Use Cases

  • Exploit AD CS Vulnerabilities: Leverages techniques like Golden Certificate forging, ESC9/10 mapping bypass, and certificate theft.
  • Establish Persistence: Creates long-term access through various certificate-based methods, surviving password changes and system reboots.
  • Use Case: A penetration tester needs to maintain access to a compromised domain after initial foothold. They can use this Skill to forge a Golden Certificate, granting them administrative access for an extended period without relying on traditional credentials.

Quick Start

Use the adcs-persistence skill to forge a golden certificate for the administrator account.

Frequently Asked Questions about adcs-persistence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I establish persistence in Active Directory using certificate abuse?▼

You can establish Active Directory persistence by exploiting misconfigurations in AD CS to forge a Golden Certificate, allowing long-term administrative access that survives password changes and reboots.

What is a Golden Certificate and how does it maintain domain access?▼

A Golden Certificate is a forged AD CS certificate that grants persistent administrative access to a compromised domain, maintaining long-term foothold without relying on traditional credentials.

Can I use Certipy and Mimikatz to exploit ESC9 and ESC10 vulnerabilities?▼

Yes, this Skill leverages tools like Certipy, Mimikatz, and Rubeus to execute ESC9 and ESC10 mapping bypasses, targeting vulnerable AD CS configurations for persistent access.

Do I need Certify.exe and ForgeCert to steal AD CS certificates?▼

Yes, certificate theft and forging require dependencies like Certify.exe and ForgeCert, alongside SharpDPAPI and OpenSSL, to successfully exploit AD CS environments.

When should I use AD CS persistence over traditional credential theft?▼

Use AD CS persistence when you need long-term access to a compromised domain that survives system reboots and password changes, bypassing traditional credential reliance.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

active-directory-certificate-services

Identify and exploit Active Directory Certificate Services vulnerabilities for privilege escalation.

Community
Advanced
rahmatullahbossrahmatullahboss

Active Directory Attacks

Test Windows Active Directory security with reconnaissance, credential extraction, and Kerberos attacks.

Community
Advanced
zebbernzebbern
34

Active Directory Attacks

Execute offensive security techniques against Active Directory environments.

Community
Advanced
utsavthakurutsavthakur

active-directory-kerberos-attacks

Execute multi-step Kerberos attacks against Active Directory authentication.

Community
Advanced