ADCS-Vulnerabilities (ESC1, ESC8)
ESC1, ESC4 & ESC8 Vulnerabilities in Active Directory Certificate Services. (ADCS)
jayden@invoqlabs.com
1/7/20263 min read
What is ADCS?
Active Directory Certificate Services (ADCS) is a Windows server feature that lets organizations create and manage digital certificates, which help secure things like email, network traffic, and user logins by proving identities and encrypting data. In short, ADCS is a way to build and run your own certificate authority inside your company. It uses certificate templates to define what kinds of certificates can be issued, who’s allowed to request them, and what those certificates can be used for. These templates have permissions that control enrollment and include flags for things like client authentication or smartcard logon. If templates are misconfigured — by allowing too many people to enroll or enabling risky options — attackers can take advantage of them. That’s often how ESC (Enterprise Security Control) vulnerabilities like ESC1 arise, letting attackers escalate privileges or impersonate other users.
What is ESC1?
ESC1 is a common and easy-to-exploit attack in ADCS. This vulnerability arises when a certificate template allows the client to supply any Subject Alternative Name (SAN) — like an email or username — which lets an attacker impersonate other users by requesting certificates on their behalf. A typical exploitation of ESC1 looks like this:
The attacker requests a certificate, specifying the UPN (User Principal Name) of the target user.
ADCS accepts the request and issues a certificate for the impersonated user.
The attacker then uses this certificate as authentication, obtaining an NTLM hash or even a Kerberos TGT.
Exploitation
Now that we have identified ESC1, we can exploit it because our user is in "CA_MGMT":
And now that the template is vulnerable to ESC1, the attacker can preform ESC1 on the Certificate Template to obtain a certificate which can be used as authentication for an TGT/NT Hash:
Using this certificate we can authenticate as the Domain Admin for an NT hash:
What is ESC4?
ESC4 is another attack in ADCS that occurs when an attacker has Dangerous Permissions to a Certificate Template. The attack path for ESC4 goes:
Attacker writes to the Certificate Template, forcing it vulnerable to ESC1
Attacker make a request to the template impersonating the UPN (like a typical ESC1)
The attacker uses the certificate as authentication for a TGT/NT Hash
Exploitation
Command used: certipy-ad find -u hacker@invoq.labs -k -target DC01.invoq.labs -stdout -vulnerable
Command used: certipy-ad find -u hacker@invoq.labs -k -target DC01.invoq.labs -stdout -vulnerable
As you can see, the group "CA_MGMT" which our attacker is in, can Write to the Certificate Template:
Summary
ESC1 and ESC4 show how small misconfigurations in ADCS can lead to major security risks. By combining overly permissive templates with weak controls, attackers can exploit these paths to impersonate users or gain elevated access. Tightening template permissions and auditing certificate usage are key to reducing these risks.