Certipy Category

blog
16+ Note
Focus
OSCP · Red Team
Structure
Recon → Exploit

Certipy blog

Filters

  • Shadow Credentials AD: PrivEsc msDS-KeyCredentialLink
    windows

    Shadow Credentials AD: PrivEsc msDS-KeyCredentialLink

    Shadow Credentials: Leverage msDS-KeyCredentialLink for passwordless AD account takeover. A practical guide with Whisker, pyWhisker, and Certipy for AD pentesting.

    Discover more Discover more
  • ESC16 ADCS: CA with SID Security Extension Disabled
    windows

    ESC16 ADCS: CA with SID Security Extension Disabled

    ESC16 exploits a CA configured not to include the SID Security Extension in certificates. This weakens the certificate mapping and may allow impersonation.

    Discover more Discover more
  • ESC10 ADCS: Privilege Escalation via Weak Certificate Mapping Schannel
    windows

    ESC10 ADCS: Privilege Escalation via Weak Certificate Mapping Schannel

    ESC10 uses weak certificate mapping in Schannel to impersonate AD accounts via LDAPS. A practical guide with Certipy and UPN manipulation.

    Discover more Discover more
  • ESC11 ADCS: NTLM Relay to Certificate Authority RPC Enrollment
    windows

    ESC11 ADCS: NTLM Relay to Certificate Authority RPC Enrollment

    ESC11 uses NTLM relay to the AD CS RPC interface when the CA doesn't require encryption. A practical guide to obtaining privileged certificates using Certipy.

    Discover more Discover more
  • ESC12 ADCS: CA Compromised via YubiHSM2
    windows

    ESC12 ADCS: CA Compromised via YubiHSM2

    ESC12 concerns vulnerabilities in the YubiHSM2 stack used by AD CS. If the CA's private key is compromised, an attacker can forge Golden Certificates.

    Discover more Discover more
  • ESC13 ADCS: Privilege Escalation via Issuance Policy OID
    windows

    ESC13 ADCS: Privilege Escalation via Issuance Policy OID

    ESC13 leverages Issuance Policy OIDs linked to Active Directory groups. A certificate can add privileged SIDs to the Kerberos TGT and lead to Domain Admin.

    Discover more Discover more
  • ESC8 ADCS: NTLM Relay versus Web Enrollment for Domain Admin
    windows

    ESC8 ADCS: NTLM Relay versus Web Enrollment for Domain Admin

    ESC8 privilege escalation, leverages NTLM Relay against AD CS /certsrv/ endpoints to obtain privileged certificates. A practical guide with Certipy and NTLM coercion.

    Discover more Discover more
  • ESC9 ADCS: Privilege Escalation via Template without SID Security Extension
    windows

    ESC9 ADCS: Privilege Escalation via Template without SID Security Extension

    ESC9 uses AD CS templates without the SID Security Extension to impersonate privileged users. A practical guide with Certipy and UPN manipulation.

    Discover more Discover more
  • ESC3 ADCS Privilege Escalation: Exploit Active Directory with Certipy
    windows

    ESC3 ADCS Privilege Escalation: Exploit Active Directory with Certipy

    ESC3 ADCS Privilege Escalation: Leverage templates with EKU Certificate Request Agent to request on-behalf-of certificates and get Domain Admin with Certipy.

    Discover more Discover more
  • ESC4 ADCS Privilege Escalation: Template Hijacking with Certipy
    windows

    ESC4 ADCS Privilege Escalation: Template Hijacking with Certipy

    ESC4 ADCS Privilege Escalation: Exploit weak ACLs on Active Directory certificate templates to transform them into ESC1 and gain Domain Admin with Certipy.

    Discover more Discover more
  • ESC5 ADCS Privilege Escalation: Golden Certificate and CA Compromise with Certipy
    windows

    ESC5 ADCS Privilege Escalation: Golden Certificate and CA Compromise with Certipy

    ESC5 ADCS Privilege Escalation: Compromising Active Directory PKI and forging Golden Certificate via CA private key using Certipy.

    Discover more Discover more
  • ESC6 ADCS Privilege Escalation: SAN Injection via CA Flag (Certipy Exploit)
    windows

    ESC6 ADCS Privilege Escalation: SAN Injection via CA Flag (Certipy Exploit)

    ESC6 ADCS Privilege Escalation: Exploiting the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the CA to inject arbitrary SANs and impersonate Active Directory users with Certipy.

    Discover more Discover more
  • ESC7 ADCS: Privilege Escalation Via Manage CA on Active Directory
    windows

    ESC7 ADCS: Privilege Escalation Via Manage CA on Active Directory

    ESC7 on AD CS allows privilege escalation by abusing the Manage CA and Manage Certificates permissions. A practical guide with Certipy for obtaining Administrator certificates.

    Discover more Discover more
  • AD CS Privilege Escalation: All ESC1–ESC16 Techniques with Certipy (Active Directory Attack Guide)
    windows

    AD CS Privilege Escalation: All ESC1–ESC16 Techniques with Certipy (Active Directory Attack Guide)

    AD CS Privilege Escalation on Active Directory: A Complete Guide to ESC1–ESC16 Techniques with Certipy. Learn how to gain Domain Admin by exploiting misconfigured certificate templates and CAs.

    Discover more Discover more
  • ESC1 ADCS Privilege Escalation: Exploit Active Directory with Certipy
    windows

    ESC1 ADCS Privilege Escalation: Exploit Active Directory with Certipy

    ESC1 ADCS Privilege Escalation: How to Exploit Vulnerable Certificate Templates in Active Directory with Certipy. A practical step-by-step guide to gaining Domain Admin.

    Discover more Discover more
  • ESC2 ADCS Privilege Escalation: Exploit Active Directory with Certipy
    windows

    ESC2 ADCS Privilege Escalation: Exploit Active Directory with Certipy

    ESC2 ADCS Privilege Escalation: Leverage templates with EKU Any Purpose or without EKU to get Enrollment Agent and Domain Admin with Certipy.

    Discover more Discover more