这个漏洞主要是利用了ntlm 中继攻击
强制域控或高权限目标向攻击机发起 NTLM 认证，然后将该认证中继到 AD CS 的 HTTP Web 注册接口，以此冒充该目标（如域控机器账户 DC$）申请并导出其对应的 .pfx 证书。

实验:

探测ESC8漏洞存在

┌──(root㉿yeswind)-[/home/kali/attack]
└─# certipy-ad find -u 'yadianna@yes.com' -p 'yadianna123' -dc-ip 192.168.116.123 -vulnerable
Certipy v5.1.0 - by Oliver Lyak (ly4k)
┌──(root㉿yeswind)-[/home/kali/attack]
└─# cat 20261014145429_Certipy.txt
Certificate Authorities
  0
    CA Name                             : yes-DC-01-CA
    DNS Name                            : DC-01.yes.com
    Certificate Subject                 : CN=yes-DC-01-CA, DC=yes, DC=com
    Certificate Serial Number           : 2C36D47A40EED4AC42392A855F8D5888
    Certificate Validity Start          : 2026-09-16 19:44:04+00:00
    Certificate Validity End            : 2031-09-16 19:54:04+00:00
    Web Enrollment
      HTTP
        Enabled                         : True
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Enabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : YES.COM\Administrators
      Access Rights
        ManageCa                        : YES.COM\Administrators
                                          YES.COM\Domain Admins
                                          YES.COM\Enterprise Admins
                                          YES.COM\Domain Users
        ManageCertificates              : YES.COM\Administrators
                                          YES.COM\Domain Admins
                                          YES.COM\Enterprise Admins
                                          YES.COM\Domain Users
                                          YES.COM\esc1user
                                          YES.COM\雅典娜
        Enroll                          : YES.COM\Authenticated Users
    [+] User Enrollable Principals      : YES.COM\Authenticated Users
    [+] User ACL Principals             : YES.COM\Domain Users
                                          YES.COM\雅典娜
    [!] Vulnerabilities
      ESC6                              : Enrollee can specify SAN.
      ESC7                              : User has dangerous permissions.
      ESC8                              : Web Enrollment is enabled over HTTP.

标签: none