adcs-template-abuse

AD CS template abuse is the process of exploiting misconfigured certificate services to impersonate domain users. It targets ESC1, ESC2, ESC3, and ESC6 vulnerabilities to obtain certificates that authenticate as arbitrary domain principals via PKINIT or LDAPS.

Yes, you can use Certipy to enumerate vulnerable Active Directory Certificate Services templates. The Skill utilizes Certipy alongside Certify.exe to identify exploitable ESC1, ESC2, ESC3, and ESC6 misconfigurations and request certificates for domain user impersonation.

To impersonate domain users through ESC1 and ESC6 vulnerabilities, you need domain user credentials and network access to CA servers. These prerequisites allow you to enumerate templates and request certificates for high-privilege targets like administrator.

Certificate-based authentication via PKINIT works by using the obtained certificate to request a Ticket Granting Ticket. The Skill supports PKINIT and includes a LDAPS fallback mechanism to authenticate to domain services as the impersonated user.

ESC1 and ESC6 are distinct AD CS template misconfigurations. ESC1 involves SAN manipulation allowing arbitrary user impersonation, while ESC6 relates to enrollment agent abuse within the certificate services infrastructure, both enabling privilege escalation.

Limitations include requiring valid domain user credentials and network access to CA servers. The Skill depends on gettgtpkinit.py for PKINIT and getnthash.py for hash extraction, meaning failures occur if CA servers are unreachable or templates are properly secured.