16. Latest AD/Infrastructure Attacks
16.1 ADCS Attack Evolution (Complete ESC1-ESC16 Attack Chain)
ADCS (Active Directory Certificate Services) is one of the most powerful privilege escalation paths inside a domain. From ESC1 through ESC16, each number represents an independent attack surface.
Attack Classification Overview:
| ESC# | Type | Core Principle | Exploitation Approach |
|---|---|---|---|
| ESC1 | Template misconfiguration | Template allows requesters to define a custom SAN (Subject Alternative Name) | Low-privilege user specifies SAN=domain admin when enrolling → authenticate with that certificate → obtain a domain admin TGT |
| ESC2 | Overly broad EKU | Template with Any Purpose EKU → usable for any purpose | Similar to ESC1 but does not require the Client Authentication EKU |
| ESC3 | Enrollment agent | A template carrying the enrollment agent EKU → can enroll on behalf of other users | Two stages: first enroll an agent certificate → then use the agent certificate to enroll an authentication certificate for the target user |
| ESC4 | Template ACL controllable | Write permission over the template | Modify the template configuration → turn it into ESC1 → then exploit as ESC1 |
| ESC5 | CA ACL controllable | Control over the CA object | Directly control the CA → approve any request / modify any template |
| ESC6 | CA-level SAN | CA enables EDITF_ATTRIBUTESUBJECTALTNAME2 | Any template can specify a SAN → forge a domain admin certificate directly (after the 2022.05 patch, pair with ESC10) |
| ESC7 | CA admin rights | ManageCA / ManageCertificates permissions | Enable disabled templates / appoint yourself as Certificate Officer / directly approve pending requests |
| ESC8 | NTLM Relay | Web Enrollment enabled | PetitPotam forces DC authentication → relay to the AD CS HTTP endpoint → enroll a certificate as the DC → DC Sync |
| ESC9 | No security extension | Template lacks szOID_NTDS_CA_SECURITY_EXT (SID security extension) |
Pair with GenericWrite: change the target user's UPN to the domain admin's UPN → enroll a certificate → restore the original UPN → authenticate as domain admin with the certificate |
| ESC10 | Weak certificate mapping | DC's StrongCertificateBindingEnforcement=0/1 |
Similar to ESC9 but exploits a DC-level setting → Schannel UPN mapping requires no SID verification. ⚠ After 2025.09 Full Enforcement becomes the only option |
| ESC11 | RPC Relay | ICPR endpoint does not enforce encryption (IF_ENFORCEENCRYPTICERTREQUEST not set) |
Similar to ESC8 but targets the RPC endpoint → NTLM relay to RPC → enroll a certificate as the relayed identity |
| ESC12 | External key | CA private key stored on an external device (YubiHSM) with a plaintext authentication password in the registry | Gain Local Admin on the CA server → extract the YubiHSM password from the registry → forge arbitrary certificates offline |
| ESC13 | OID group link | The certificate template's Issuance Policy OID is linked to an AD group | Enroll a certificate carrying a specific OID policy → automatically gain membership of the linked AD group (possibly Domain Admins) |
| ESC14 | altSecurityIdentities | Weak explicit certificate mapping configured on user/computer accounts | Modify the target's altSecurityIdentities to point to an attacker-controlled certificate → impersonate the target |
| ESC15 | EKUwu CVE-2024-49019 | In a V1 template CSR, msPKI-Application-Policy can override the template EKU |
The built-in WebServer template is a V1 template → override it to Client Authentication EKU at request time → use the Web Server certificate for domain authentication. Every ADCS installation has the WebServer template |
| ESC16 | Global security extension removal | Security extension disabled at the CA level | Remove global SID embedding → all certificates lack SIDs → fall back to weak UPN mapping |
Practical Attack Decision Tree:
1. Have a network position (unauthenticated)? → ESC8 (HTTP Relay) / ESC11 (RPC Relay)
2. Have a domain user? → check enrollable templates (ESC1/ESC2/ESC3)
3. Have write permission over a template? → ESC4 (turn the template into ESC1)
4. Have GenericWrite? → ESC9 (UPN tampering)
5. Have Local Admin on the CA server? → ESC5/ESC12 (extract the private key)
6. Have ManageCA? → ESC7 (enable templates + appoint an Officer)
Tools: Certify (C#) / Certipy (Python, recommended) / ADCSKiller (automated) Detection: BloodHound (ADCS edge support for ESC1-ESC10)
Key Timeline:
- 2025.02: Microsoft Full Enforcement enabled by default (StrongCertificateBindingEnforcement=2)
- 2025.09: Compatibility Mode permanently removed, Full Enforcement becomes the only option → ESC9/ESC10 window closes
- 2024.11: ESC15 (CVE-2024-49019) patch released → V1 template Application Policy override fixed
16.2 Shadow Credentials Attack
- Exploit the
msDS-KeyCredentialLinkattribute to add a self-controlled key → PKINIT → obtain a TGT - Prerequisite: the target object is writable + Windows Server 2016+ domain functional level
- Tools: Whisker / PyWhisker
16.3 Major Infrastructure CVEs (2024-2026)
| CVE | Product | Impact |
|---|---|---|
| CVE-2024-3400 | Palo Alto GlobalProtect | Arbitrary command execution (no authentication required) |
| CVE-2024-21762 | Fortinet FortiOS | Out-of-Bounds Write RCE |
| CVE-2023-46805/48788 | Ivanti Connect Secure | Authentication bypass + RCE |
| CVE-2024-29847 | Ivanti EPM | SQL injection → RCE |
| CVE-2024-23897 | Jenkins | Arbitrary file read via CLI |
| CVE-2024-1709 | ConnectWise ScreenConnect | Authentication bypass |
| CVE-2025-22788 | - | Windows privilege escalation (new) |
16.4 New Linux Post-Exploitation
eBPF Rootkit: use eBPF programs to intercept/modify syscalls at the kernel layer → hide processes/files/network connections - Tools: TripleCross / ebpfkit
K8s Attack Frameworks: kube-hunter / kube-bench / checkov