Lion Cipher Lab
Exploit AD CS ESC1 with Certipy: forge a Domain Admin certificate, then fix the template
- Penetration Testing / Red Team
- Advanced
- ~90 min (plus AD CS install time)
- Free · no account required
Why it matters
For years, Active Directory Certificate Services was the quiet corner of the domain nobody audited -- and it turned out to be one of the most reliable roads to total domain compromise. AD CS is the Microsoft service that issues the digital certificates an organisation uses for smart-card logon, Wi-Fi, VPN, and web servers; because a certificate can be used to LOG IN as a user (via PKINIT, the certificate flavour of Kerberos), a single misconfigured certificate template can let an ordinary domain user request a certificate that says 'I am the Domain Administrator' and then authenticate as that…
What you'll learn
- what Active Directory Certificate Services (AD CS), a Certificate Authority (CA), and a certificate template actually are, in plain words
- reading a certificate template's four ESC1 ingredients: low-privilege enrollment rights, ENROLLEE_SUPPLIES_SUBJECT, a client-authentication EKU, and no manager approval
- installing the AD CS role and publishing a deliberately vulnerable template in your OWN isolated lab so you can attack it safely
- running `certipy find -vulnerable` to enumerate certificate templates and having the tool name the ESC1 finding for you
- abusing ESC1 with `certipy req -upn administrator@corp.local` to obtain a certificate that impersonates a Domain Admin
- understanding PKINIT (certificate-based Kerberos logon) and using `certipy auth` to turn that certificate into a Ticket Granting Ticket (TGT) and the target's NT hash
- proving domain compromise with the recovered TGT / hash (a pass-the-hash or DCSync)
- fixing ESC1 for real: removing ENROLLEE_SUPPLIES_SUBJECT, restricting enrollment, enabling Manager Approval, and how KB5014754 strong certificate mapping defeats the forged-UPN trick
- the judgment: when AD CS is the fastest path to Domain Admin, why it is so often missed, and the when-NOT-to boundary of only ever doing this on a directory you own
Steps in this lab
- First: this is your lab, and AD CS abuse is a real domain takeover
- The words you need: AD CS, CA, certificate template, EKU, enrollment rights
- What ESC1 is: the four ingredients that make a template a domain-takeover
- Set up the target: install AD CS and publish a deliberately vulnerable template
- Get Certipy ready on your Kali attacker VM
- Enumerate: let Certipy find and name the ESC1 template
- Attack step 1: request a certificate that impersonates the Domain Admin
- Attack step 2: PKINIT with the certificate to get a TGT and the admin's hash
- Prove domain compromise with what you recovered
- Fix it: remove the ESC1 condition and re-test to prove it's closed
- What you did, when to reach for it, and when NOT to