Agent skill · security · yaklang
active-directory-certificate-services
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
Why this skill is useful
Adds detailed attack scripts and techniques for exploiting misconfigured AD Certificate Services that are not widely known.
What it needs
Requires certify, certipy installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: AD CS Attack Playbook — Expert Guide AI LOAD INSTRUCTION: Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations. 0. RELATED ROUTING Before going deep, consider loading: active-directory-acl-abuse for ACL-based attacks that enable ESC4 (template modification) active-directory-kerberos-attacks for Kerberos techniques after obtaining certificates ntlm-relay-coercion for ESC8 (relay to HTTP enrollment endpoint) windows-lateral-movement for using obtained certificates for lateral movement Advanced Reference Also load ADCSESCMATRIX.md when you need: ESC1–ESC13 quick reference table with conditions, impact, and tool commands One-liner exploitation commands per ESC variant Detection indicators per technique --- 1. AD CS ARCHITECTURE OVERVIEW --- 2. ENUMERATION --- 3. ESC1 — ENROLLEE SUPPLIES SUBJECT Condition: Template allows enrollee to specify Subject Alternative Name (SAN) + client authentication EKU + low-privilege enrollment. --- 4. ESC2 — ANY PURPOSE EKU Condition: Template has "Any Purpose" EKU or no EKU (subordinate CA cert) + low-privilege enrollment. --- 5. ESC3 — ENROLLMENT AGENT Condition: Template allows enrollment agent certificate + another template allows enrollment on behalf of others. --- 6. ESC4 — TEMPLATE ACL MISCONFIGURATION Condition: Low-privilege user has write access to certificate template object. --- 7. ESC6 — EDITFATTRIBUTESUBJECTALTNAME2 Condition: CA has EDITFATTRIBUTESUBJECTALTNAME2 flag enabled → any template becomes ESC1. --- 8. ESC7 — CA OFFICER / MANAGER PERMISSIONS Condition: User has ManageCA or ManageCertificates permission on the CA. --- 9. ESC8 — NTLM RELAY TO HTTP ENROLLMENT Condition: CA has HTTP enrollment endpoint (certsrv) without HTTPS enforcement. --- 10. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/active-directory-certificate-services