skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-active-directory-certificate-services-esc1

Exploits AD CS ESC1 misconfigurations to forge certificates and escalate domain privileges.

954|172|Updated Mar 13, 2026
Search Tags:#red-team#privilege-escalation#Active-Directory#esc1#ad-cs#certipy#pkinit
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-active-directory-certificate-services-esc1
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-active-directory-certificate-services-esc1
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/red-teaming/exploiting-active-directory-certificate-services-esc1
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-active-directory-certificate-services-esc1

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized red team engagements, testers need a repeatable, verified procedure to identify and exploit ESC1 misconfigurations in Active Directory Certificate Services, where templates allowing enrollee-supplied subjects let low-privileged users request certificates as Domain Admins.

Core Features & Use Cases

  • AD CS Enumeration: Uses Certify and Certipy to enumerate Certificate Authorities and identify templates with ENROLLEE_SUPPLIES_SUBJECT, authentication EKUs, and no manager approval.
  • Certificate Forgery & PKINIT Authentication: Requests certificates with an arbitrary SAN/UPN for a privileged account, then authenticates via Rubeus or certipy auth to obtain a TGT or NT hash.
  • Privilege Escalation Validation: Confirms Domain Admin access through DCSync with secretsdump.py or administrative share access, with detection signatures mapped to Windows Events 4886/4887 and 4768.
  • Use Case: A red team operator with standard domain user credentials runs certipy find -vulnerable, discovers an ESC1-vulnerable template, requests a certificate as administrator, and demonstrates full domain compromise for the engagement report.

Quick Start

Ask the AI to enumerate AD CS certificate templates with Certipy and exploit any ESC1-vulnerable template to request a Domain Admin certificate.

Frequently Asked Questions about exploiting-active-directory-certificate-services-esc1

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit ESC1 with Certipy?▼

Run certipy find -vulnerable to identify templates with ENROLLEE_SUPPLIES_SUBJECT, then use certipy req with -upn administrator@domain.local to request a certificate as a privileged user. Finally, run certipy auth -pfx to authenticate via PKINIT and recover the NT hash.

What conditions make an AD CS template vulnerable to ESC1?▼

ESC1 requires all of: the ENROLLEE_SUPPLIES_SUBJECT flag, an authentication EKU such as Client Authentication or Smart Card Logon, no manager approval requirement, and enroll rights granted to a low-privileged group like Domain Users.

Certify vs Certipy for AD CS exploitation?▼

Certify runs on Windows as a .NET binary for enumeration and certificate requests, while Certipy is a Python tool for Linux that handles enumeration, requests, and PKINIT authentication. Both detect ESC1; Certipy additionally returns the NT hash directly.

Why does PKINIT authentication fail after getting a certificate?▼

PKINIT fails when the domain controller lacks a DC authentication certificate, when the PFX was converted with the wrong crypto provider, or when the UPN/SAN was not supplied during the request. Verify the cert with certipy auth and check klist for a loaded TGT.

How can defenders detect ESC1 certificate abuse?▼

Monitor Windows Events 4886 and 4887 on the CA for certificate requests where the SAN differs from the requester, and Event 4768 for certificate-based pre-authentication. EDR command-line logging can also catch Certify or Certipy execution.

Related Skills

Explore More Software Engineering Skills→
0x0pointer0x0pointer
13

lateral-movement

Identify and exploit Active Directory lateral movement paths using credential reuse and relay techniques.

Official
Advanced
trilwutrilwu
109

attacking-active-directory

Automate Active Directory security assessments with Kerberoasting, credential dumping, and BloodHound analysis.

Community
Advanced
AeonDaveAeonDave
15

certify

Enumerate and abuse Active Directory Certificate Services misconfigurations for privilege escalation.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

adcs-access-and-relay

Exploit ADCS via ACL abuse and NTLM relay to enrollment endpoints.

Official
Advanced