23 pages
AD CS / PKI (ESC)
Active Directory Certificate Services misconfigurations — the ESC1–ESC15 family — that mint authentication certificates.
Page Kind Tags Updated
AD CS ESC Attacks
ESC1-15
PKI & AD CS Architecture
CA, templates, enrollment
Certificate Templates
the ESC1-4 surface
Certificate Mapping
strong vs weak; ESC9/ESC10
NTAuthCertificates
the forest client-auth trust store
ESC1
enrollee-supplied SAN on a client-auth template
ESC2
Any Purpose / no-EKU template
ESC3
Certificate Request Agent (enroll on behalf of)
ESC4
writable certificate-template ACL
ESC5
CA object / CA server ACL (ManageCA via WriteDacl)
ESC6
EDITF_ATTRIBUTESUBJECTALTNAME2 (CA-wide SAN)
ESC7
ManageCA / ManageCertificates (CA management rights)
ESC8
NTLM relay to AD CS web enrollment (PetitPotam → DCSync)
ESC9
template omits the security extension (no SID binding)
ESC10
weak certificate binding (CertificateMappingMethods)
ESC11
NTLM relay to RPC ICPR enrollment
ESC12
CA admin key access (registry key / CA server)
ESC13
privileged issuance policy linked to a group
ESC14
weak explicit mapping via altSecurityIdentities
ESC15
EKUwu / CVE-2024-49019 (V1 template arbitrary application policy)
ESC16
Security Extension disabled CA-wide (no SID in any cert)
Cross-forest AD CS
PKI as an authentication bridge
Golden Certificate
CA-key forgery / rogue CA in NTAuth
23 pages in this section