AD Escalation & AD CS Decision Tree
Active Directory Certificate Services (AD CS misconfigurations ESC1 through ESC15), Kerberos delegation abuse (RBCD, Unconstrained, Constrained), and Object DACLs have nuanced prerequisite conditions. Check the indicators discovered during your reconnaissance to evaluate actionable escalation paths, generate execution syntax (Certipy, Rubeus, Impacket, BloodHound Cypher), and review verified defensive countermeasures.
Select the indicators and flags identified during domain reconnaissance to calculate viable privilege escalation vectors, generate targeted tool syntax, and inspect remediation controls.
The certificate template flag 0x00000001 is enabled, permitting an enrolling requester to supply an arbitrary Subject Alternative Name (SAN) containing any domain identity (e.g. Domain Administrator).
Template allows Client Authentication (1.3.6.1.5.5.7.3.2), Smart Card Logon (1.3.6.1.4.1.311.20.2.2), PKINIT (1.3.6.1.5.2.3.4), Any Purpose (2.5.29.37.0), or SubCA.
Security descriptor on certificate template grants 'Enroll' or 'AutoEnroll' permission to Authenticated Users, Domain Users, or Domain Computers.
Certificate template does not specify an Extended Key Usage (meaning it is valid for all cryptographic purposes) or explicitly defines Any Purpose (2.5.29.37.0).
Template contains Certificate Request Agent EKU (1.3.6.1.4.1.311.20.2.1), allowing the holder to act as an Enrollment Agent and co-sign certificate enrollment requests on behalf of other users.
Low-privileged user has GenericAll, GenericWrite, WriteOwner, or WriteDacl rights over a certificate template object in Active Directory (CN=Certificate Templates,CN=Public Key Services...).
Low-privileged user has write permissions over PKI objects such as the Certificate Authority object, the Enrollment Services container, or NTAuthCertificates.
The CA has the EDITF_ATTRIBUTESUBJECTALTNAME2 registry flag set. This forces the CA to accept arbitrary Subject Alternative Names for ANY certificate template, even if the template forbids enrollees from supplying a SAN.
Low-privileged user is granted 'Manage CA' (CA Administrator) or 'Manage Certificates' (Certificate Officer) rights directly on the Certificate Authority object.
AD CS Web Enrollment (/certsrv), Enrollment Service (CES), or NDES (/certsrv/mscep) is running over HTTP without Extended Protection for Authentication (EPA) or channel binding.
Template has the CT_FLAG_NO_SECURITY_EXTENSION flag (0x00080000) set in msPKI-Enrollment-Flag, preventing the CA from embedding the ObjectSID extension (szOID_NTDS_OBJECT_SID) in issued certificates.
Domain Controller KDC registry key 'CertificateMappingMethods' is configured to allow weak UPN mapping without SID extension enforcement (e.g. 0x4 / 0x8 / 0x18), enabling identity spoofing via UPN.
CA server accepts MS-ICPR RPC certificate requests without requiring RPC_C_AUTHN_LEVEL_PKT_PRIVACY (encryption). This allows NTLM relay attacks over RPC (CVE-2022-26925 / PetitPotam).
The CA certificate private key is stored in software (Windows Certificate Store / DPAPI / registry) rather than a hardware security module (HSM/TPM), allowing local extraction by SYSTEM/Admin.
Certificate template includes an Issuance Policy with an OID that is mapped to a privileged Active Directory group via msDS-OIDToGroupLink (e.g. Domain Admins or Tier 0 Operators).
Target user account has altSecurityIdentities configured using a weak mapping type (X509IssuerSubject or X509RFC822) where the attacker can obtain or forge matching credentials.
Template utilizes schema version 1 (or vulnerable version 2 with enrollment filters) permitting enrollee to inject arbitrary application policy OIDs (CVE-2024-49019) or exploit SAN injection.
Compromised host or service account has the TRUSTED_FOR_DELEGATION (0x80000) bit set in userAccountControl. When any user connects, their forwardable TGT is cached in the host's LSASS memory.
Compromised service account has TRUSTED_TO_AUTH_FOR_DELEGATION (0x1000000) set and an allowed SPN list in msDS-AllowedToDelegateTo. It can forge a service ticket for ANY domain user to itself and delegate it to the target service.
Account has msDS-AllowedToDelegateTo configured but lacks TRUSTED_TO_AUTH_FOR_DELEGATION. Requires coercing or capturing a forwardable service ticket from the target user to perform S4U2Proxy.
Attacker possesses GenericWrite, GenericAll, WriteDacl, or WriteProperty over the target computer object, permitting modification of msDS-AllowedToActOnBehalfOfOtherIdentity.
Domain configuration allows any standard authenticated user to create up to N new computer accounts (default is 10), enabling automated creation of an attacker-controlled machine account with SPN.
Attacker has GenericWrite, GenericAll, or WriteProperty over msDS-KeyCredentialLink on a victim user or computer account, allowing injection of a self-signed X.509 public key for PKINIT authentication.
Target user account has the DONT_REQ_PREAUTH (0x400000) bit set in userAccountControl. Any domain user can request an AS-REP encrypted timestamp without a password and crack it offline.
User account has a non-empty servicePrincipalName attribute. Any valid domain user can request a TGS Kerberos ticket for that SPN and extract the password hash (RC4 or AES) for offline cracking.
Principal has DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) and DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) on the domain NC.
Misconfigured Certificate Template (Enrollee Supplies SAN)
A certificate template permits enrollees to supply an arbitrary Subject Alternative Name (SAN), grants enrollment to low-privileged users, and specifies a Client Authentication EKU. An attacker requests a certificate impersonating a Domain Administrator and uses PKINIT to obtain a Kerberos TGT and NTLM hash.
CA EDITF_ATTRIBUTESUBJECTALTNAME2 Enabled (Global SAN Injection)
The Certificate Authority has the EDITF_ATTRIBUTESUBJECTALTNAME2 flag enabled in its registry. This flag instructs the CA to accept user-supplied Subject Alternative Names on ALL published certificate templates, completely bypassing template-level SAN restrictions. An attacker enrolls in ANY template allowing client auth (like the default 'User' template) and supplies an Administrator SAN.
Issuance Policy OID Group Link Abuse (msDS-OIDToGroupLink)
Active Directory supports linking certificate Issuance Policy OIDs directly to security groups via the msDS-OIDToGroupLink attribute. When a user authenticates using a certificate containing that policy OID, the KDC automatically adds that linked security group (e.g. Domain Admins or Server Admins) to their Kerberos token PAC.
Any Purpose EKU or No EKU Defined
A certificate template defines the 'Any Purpose' EKU (2.5.29.37.0) or has no EKU defined at all. Since X.509 RFCs treat certificates with no EKU or Any Purpose as valid for any cryptographic operation, an attacker can use this certificate for Client Authentication (or co-signing subordinate requests like ESC3).
Certificate Request Agent Misconfiguration (Enrollment Agent Abuse)
A template grants the Certificate Request Agent EKU (1.3.6.1.4.1.311.20.2.1). An attacker enrolls in this template to obtain an Enrollment Agent certificate, then uses it to co-sign an on-behalf-of enrollment request for a privileged user (e.g. Administrator) against a second template requiring enrollment agent signature.
No Security Extension with Weak Strong-Certificate Binding (CVE-2022-26923)
A template has the CT_FLAG_NO_SECURITY_EXTENSION (0x00080000) flag set, causing the CA to omit the szOID_NTDS_OBJECT_SID extension. If the domain lacks the May 2022 patch or has StrongCertificateBindingEnforcement configured in Compatibility Mode, an attacker with write access to a victim account's userPrincipalName (UPN) modifies the UPN, requests a cert, and claims the victim's identity.
Schema Version 1 / Arbitrary Application Policy EKU Injection (CVE-2024-49019)
Template uses Schema Version 1 (or vulnerable version 2 configurations) and permits enrollee to supply custom application policies or arbitrary EKUs. An attacker requests a certificate from a template that does not ostensibly allow Client Auth, but injects the Client Authentication OID (1.3.6.1.5.5.7.3.2) directly into the request attributes, which the CA accepts and signs.
Vulnerable Certificate Template Access Control (Template ACL Hijack)
A certificate template has insecure Active Directory permissions (WriteOwner, WriteDacl, GenericAll, GenericWrite) assigned to a low-privileged principal. An attacker overwrites the template configuration in LDAP to turn it into an ESC1 template (enabling CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT and Client Auth), enrolls as Domain Admin, and restores the original configuration.
Vulnerable PKI Container / CA Object Access Control
Insecure Active Directory permissions on the Public Key Services container (or child objects such as Certificate Authorities, Enrollment Services, AIA, or NTAuthCertificates). Low-privileged users with write rights can compromise the entire PKI infrastructure or establish malicious trust.
Vulnerable Certificate Authority Access Control (ManageCA / ManageCertificates)
A user has 'Manage CA' (CA Administrator) or 'Manage Certificates' (Certificate Officer) access on the CA server object. An attacker with ManageCA can add themselves as an Officer, enable the SubCA template on the CA, issue pending certificates, or alter CA configuration to gain full control.
NTLM Relay to AD CS HTTP Web Enrollment Endpoints
AD CS Web Enrollment services (such as /certsrv, /certsrv/mscep, or CES) operate over HTTP without Extended Protection for Authentication (EPA). An attacker coerces a machine account (such as a Domain Controller via PetitPotam, SpoolSample, or ShadowCoerce) to authenticate back over SMB/HTTP, relays the NTLM authentication to AD CS, enrolls a machine certificate for the DC, and executes a DCSync.
Weak KDC Certificate Mapping Configuration (Registry 0x4/0x8)
The KDC registry key CertificateMappingMethods on Domain Controllers is configured with weak mapping methods (e.g. 0x4 for UPN mapping or 0x8 for generic Subject/Issuer mapping) without SID verification. Any certificate containing a target UPN (even if signed by a subCA or from an account that previously had that UPN) authenticates as the target.
NTLM Relay to AD CS RPC ICPR Interface (No Packet Privacy)
The CA exposes the MS-ICPR RPC interface without enforcing RPC_C_AUTHN_LEVEL_PKT_PRIVACY (packet encryption). An attacker coerces a machine account (DC$) to authenticate over SMB/RPC and relays the raw NTLM credentials over RPC to the CA, obtaining a machine certificate for the DC and DCSyncing the domain.
CA Private Key Stored in Software / Exportable DPAPI
The CA certificate private key is stored in software (Windows DPAPI / CryptoAPI machine keys) instead of a certified Hardware Security Module (HSM). An attacker who obtains local administrator access on the CA server extracts the CA root private key from disk/memory and offline-signs Golden Certificates for any domain identity.
Weak Explicit Mapping via altSecurityIdentities
A target user account has altSecurityIdentities explicitly configured with weak mapping patterns (such as X509IssuerSubject, X509IssuerSerialNumber, or X509RFC822). If an attacker can obtain or forge an X.509 certificate matching the specified issuer and subject string, the KDC authenticates them as the target user.
Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity)
An attacker has write access (GenericWrite, GenericAll, WriteProperty) over a target computer object in Active Directory. The attacker populates the target's msDS-AllowedToActOnBehalfOfOtherIdentity attribute with a security descriptor granting delegation rights to a computer account controlled by the attacker. Using S4U2Self and S4U2Proxy, the attacker impersonates a local Administrator on the target host.
Kerberos Unconstrained Delegation (TRUSTED_FOR_DELEGATION)
A compromised host has the TRUSTED_FOR_DELEGATION flag set in userAccountControl. When any domain user connects to a service on this host via Kerberos, their forwardable TGT is embedded in the authenticator and cached in LSASS. An attacker coerces a Domain Controller (e.g. via SpoolSample or PetitPotam) to authenticate to the host, extracts the DC$ machine TGT from LSASS, and executes a DCSync.
Constrained Delegation with Protocol Transition (S4U2Self / S4U2Proxy)
A compromised service account has TRUSTED_TO_AUTH_FOR_DELEGATION enabled and has target SPNs listed in msDS-AllowedToDelegateTo. With Protocol Transition enabled, the service account can forge an arbitrary user's identity (Administrator) to itself via S4U2Self without needing the user's password, and forward that ticket to the allowed target service via S4U2Proxy.
Shadow Credentials (msDS-KeyCredentialLink Write Abuse)
An attacker has GenericWrite, GenericAll, or WriteProperty rights over the msDS-KeyCredentialLink attribute of a target user or computer. The attacker generates a self-signed X.509 certificate, injects the public key structure (KeyCredential) into the target's msDS-KeyCredentialLink attribute in LDAP, and uses the private key to authenticate via Kerberos PKINIT to claim the target's TGT and NTLM hash.
AS-REP Roasting (Kerberos Pre-Authentication Disabled)
Target accounts have the DONT_REQ_PREAUTH flag enabled in userAccountControl. Any valid domain user (or unauthenticated user with access to KDC port 88) can request a Kerberos AS-REP message without knowing the account password. The AS-REP contains an encrypted timestamp encrypted with the user's password hash, which can be cracked offline.
Kerberoasting (Service Principal Name Password Hash Extraction)
Target accounts have a registered servicePrincipalName (SPN). Any authenticated domain user can request a Kerberos service ticket (TGS-REQ) for that service from the KDC. The returned TGS-REP is encrypted using the NTLM/AES secret key of the account running the service, enabling offline cracking.
Directory Replication Rights Abuse (DCSync)
The attacker controls an account that possesses Directory Replication permissions (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) on the domain naming context. The attacker uses DRSUAPI over RPC to simulate a Domain Controller replicating Active Directory secrets, extracting the KRBTGT NTLM hash and Domain Admin hashes directly.
Misconfigured Certificate Template (Enrollee Supplies SAN)
# 1. Enumerate vulnerable templates certipy find -u 'lowpriv' -p 'Password123!' -dc-ip 10.10.10.10 -vulnerable # 2. Request certificate for Administrator using ESC1 template certipy req -u 'lowpriv' -p 'Password123!' -ca 'CORP-ENTERPRISE-CA' -target 'ca.corp.local' -template 'ESC1-Template' -upn 'Administrator@corp.local' # 3. Authenticate with the obtained certificate via PKINIT certipy auth -pfx Administrator.pfx -dc-ip 10.10.10.10
Design complex multi-hop tunneling pipelines with Ligolo-ng, Chisel, and SSH reverse SOCKS to reach internal Domain Controllers.
Generate client rules of engagement, emergency contact trees, SOC deconfliction protocols, and cryptographic SHA-256 verification stamps.
Review tactical playbooks, evasion methodologies, payload engineering techniques, and live telemetry references.