Description

Active Directory Certificate Services (ADCS) is Microsoft’s Public Key Infrastructure (PKI). It runs as a Windows Server role (a “Certification Authority”, or CA) and its job is to issue digital certificates the digital ID cards of the network. We will look on how to exploit misconfiguration in ADCS to escalate privileges on domain networks.

Steps to exploit

• First enumerate the vulnerable ADCS

┌──(certipy_venv)─(n16hth4wk㉿n16hth4wk-sec)-[~/Documents/GOAD/certipy_venv/bin]                                     
└─$ python certipy find -u jon.snow -p iknownothing -dc-ip 192.168.56.11 -stdout

We can see vulnerability ESC8