exploiting-active-directory-certificate-services-esc1

What problem does it solve? During authorized red team engagements, testers need a repeatable procedure to identify and exploit ESC1 misconfigurations in Active Directory Certificate Services, where templates with "Supply in Request" enabled allow low-privileged users to request certificates as Domain Admins. ## Core Features & Use Cases - AD CS Enumeration: Enumerate Certificate Authorities and vulnerable certificate templates using Certify or Certipy, verifying ENROLLEE_SUPPLIES_SUBJECT flags and enrollment rights. - Certificate Forgery and PKINIT Authentication: Request certificates with arbitrary Subject Alternative Names, convert PEM to PFX, and authenticate via PKINIT with Rubeus or Certipy to obtain a Domain Admin TGT. - Use Case: A red team operator with standard domain user credentials runs Certipy against the domain controller, finds a vulnerable template, requests a certificate with the administrator UPN, and uses the resulting TGT to perform a DCSync and validate Domain Admin access. ## Quick Start Ask the agent to enumerate AD CS certificate templates with Certipy against the target domain controller and identify any templates vulnerable to ESC1.