> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/ad-cs-escalation-paths.md).

# AD CS Escalation Paths

AD CS abuse usually comes down to one outcome.

An attacker gets a certificate that the domain will trust for authentication.

### Two broad abuse buckets

Think about AD CS escalation in two groups.

#### Template abuse

Template abuse happens when certificate templates allow the wrong principals to enroll, supply identity fields, or request high-trust EKUs.

The most common paths are ESC1 through ESC4.

#### CA and enrollment abuse

CA-level abuse happens when the certificate authority, enrollment endpoints, or surrounding PKI objects expose dangerous permissions or relay paths.

That is where ESC5 through ESC8 usually fit.

### Template abuse at a glance

#### ESC1

Low-privileged users can enroll in a template that supports authentication and lets the requester supply subject data.

If arbitrary SAN or subject values are accepted, the attacker may request a certificate as another user.

#### ESC2

The template allows broad enrollment and includes `Any Purpose` or similarly dangerous capability.

This may not always allow immediate impersonation of another user, but it still creates a powerful authentication foothold.

#### ESC3

The attacker can enroll in a template with the Certificate Request Agent EKU.

That can allow requests on behalf of other users, especially against version 1 templates or version 2+ templates configured to accept that co-signing flow.

#### ESC4

The attacker can modify a certificate template's access control or risky flags.

This turns a safe template into a vulnerable one by changing subject rules, enrollment permissions, or issuance requirements.

### CA and endpoint abuse at a glance

#### ESC5

The attacker gains control over PKI-related AD objects or the CA server path itself.

That includes object ACL abuse, descendant container abuse, or trust pivoting into the CA host.

#### ESC6

The CA enables `EDITF_ATTRIBUTESUBJECTALTNAME2`.

That can let requesters inject SAN values even when templates look safer on paper.

#### ESC7

The attacker gets CA management rights.

`ManageCA` can enable dangerous settings. `ManageCertificates` can bypass approval-based protections.

#### ESC8

HTTP enrollment endpoints accept NTLM and become relay targets.

If the attacker coerces authentication and relays it to AD CS web enrollment, they may obtain a certificate as the relayed machine or user.

### Enumeration

Start by finding authentication-capable templates.

```powershell
Certify.exe find /clientauth
```

You can also enumerate with Certipy.

```bash
certipy find -u user@corp.local -p 'Passw0rd!'
```

Focus on templates with:

* Broad enrollment rights.
* Authentication EKUs.
* Requester-supplied subject or SAN data.
* No manager approval.
* No authorized signatures.

### Requesting a certificate

Once you identify a usable template, request a certificate through a native or offensive client.

```bash
certipy req -username john@corp.local -password Passw0rd -ca corp-DC-CA -target ca.corp.local -template User
```

GUI workflows also exist, but command-line tooling makes repeatable testing easier.

### Using the certificate

After issuance, the next step is authentication.

There are two common paths:

* **PKINIT** to request Kerberos material such as a TGT.
* **Schannel** to authenticate to LDAPS and perform directory actions.

That is why tools such as Rubeus, Certipy, and PassTheCert appear together in many AD CS chains.

### Chaining into delegation

Certificate abuse does not stop at authentication.

A certificate-backed identity can be used to modify LDAP objects, grant RBCD, request service tickets, or recover hashes depending on the template and environment. In practice, AD CS and delegation often reinforce each other.

### Defensive priorities

Review these first:

* Templates with client authentication EKUs.
* Templates that allow requester-supplied SAN values.
* Enrollment agent templates.
* CA permissions such as `ManageCA` and `ManageCertificates`.
* AD CS web enrollment endpoints that accept NTLM.

If AD CS is present, treat it like an identity tier, not a side feature.