Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication from a coerced domain controller into the AD CS HTTP web-enrollment endpoint (ESC8), obtaining a DC certificate usable via Certipy for PKINIT/DCSync. Use during internal AD penetration tests or purple-team exercises when AD CS Web Enrollment lacks Extended Protection for Authentication.
Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication from a coerced domain controller into the AD CS HTTP web-enrollment endpoint (ESC8), obtaining a DC certificate usable via Certipy for PKINIT/DCSync. Use during internal AD penetration tests or purple-team exercises when AD CS Web Enrollment lacks Extended Protection for Authentication.
Legal Notice: This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Coercing authentication and relaying credentials against systems you do not own or lack explicit written authorization to test is illegal. Operate strictly within a signed rules-of-engagement; ESC8 coercion can affect production domain controllers.
Overview
ESC8 is one of the Active Directory Certificate Services (AD CS) escalation paths catalogued by SpecterOps in "Certified Pre-Owned." It abuses the AD CS HTTP web-enrollment endpoint (/certsrv/), which by default supports NTLM authentication and, critically, does not enforce HTTPS channel binding or Extended Protection for Authentication (EPA). Because NTLM over HTTP on that endpoint is unprotected, an attacker can coerce a privileged machine account (typically a domain controller) into authenticating to an attacker-controlled host, then relay that NTLM authentication to the CA's web-enrollment page and request a certificate as the coerced machine.
When the relayed victim is a domain controller, the attacker obtains a certificate for the DC's machine account (DC01$). That certificate can then be used for Kerberos PKINIT to request a TGT as the DC, recover the DC's NT hash, and ultimately perform DCSync — a full domain compromise. This maps to MITRE ATT&CK T1557.001 (Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay), extended here to NTLM relay against an HTTP enrollment service.
The standard toolchain is Impacket's ntlmrelayx.py (the relay engine, with --adcs mode), a coercion tool (PetitPotam, Coercer, printerbug.py/dementor), and Certipy for enumeration and for turning the captured certificate into a TGT / NT hash.
When to Use
During an internal AD penetration test where AD CS with the HTTP Web Enrollment role is present and EPA is not enforced.
When you have a foothold (even an unauthenticated network position with a coercion vector) and want a path to Domain Admin via certificate impersonation.
When validating that the organization has mitigated ESC8 (EPA enabled, HTTP enrollment disabled, RPC/EFSRPC coercion patched).
During purple-team exercises to test detection of coercion + relay + anomalous certificate enrollment.
Prerequisites
A network position that can reach the CA web-enrollment endpoint and a coercion vector to the target DC.
The CA hostname and an enrollable template that yields client-auth EKU (e.g., DomainController, Machine).
Look for ESC8 in the output and note the CA's web-enrollment URL (e.g., http://ca01.corp.local/certsrv/certfnsh.asp).
2. Start the NTLM relay in ADCS mode
Point ntlmrelayx at the CA's web-enrollment endpoint and request a DomainController template certificate. --adcs enables AD CS relay; -smb2support accepts SMB2 coerced auth:
When the coerced DC authenticates, ntlmrelayx relays it to the CA and prints output similar to:
[*] Authenticating against http://ca01.corp.local as CORP/DC01$ SUCCEED
[*] GOT CERTIFICATE! ID 1337
[*] Base64 certificate of user DC01$:
MIIRXAIBAzCC...<snip>...
Save the base64 PKCS#12 blob to a .pfx file (decode it; the cert has no export password by default):
Use Certipy to authenticate with the certificate via PKINIT, obtaining a Kerberos TGT and the DC machine-account NT hash:
certipy auth -pfx dc01.pfx -dc-ip 10.0.0.10
Certipy outputs a .ccache TGT and the NT hash, e.g. [*] Got hash for 'dc01$@corp.local': aad3b435...:<NTHASH>.
6. Leverage the DC identity (DCSync)
With the DC machine account's hash/TGT, perform DCSync to extract domain credentials (e.g., krbtgt, Domain Admins) using the recovered TGT:
# Use the ccache TGT, then DCSync via secretsdumpexport KRB5CCNAME=dc01.ccache
impacket-secretsdump -k -no-pass corp.local/'DC01$'@dc01.corp.local -just-dc-user krbtgt
7. Validate mitigations (defensive checklist)
Confirm the environment is hardened against ESC8 after testing:
Enable Extended Protection for Authentication (EPA) on the AD CS web-enrollment IIS site and require HTTPS.
Disable NTLM on the CA enrollment endpoint; prefer the enrollment proxy with EPA.
Remove unused HTTP Web Enrollment role services where possible.
Patch coercion vectors (MS-EFSRPC/PetitPotam, MS-RPRN/printerbug) and restrict RPC.
Monitor for forced authentication and anomalous machine-account certificate enrollment.
