Part 2: Escalating Privileges via AD CS ESC2 Attack Path
Автор: ruatelo
Загружено: 2025-10-21
Просмотров: 21
In this second part of our Active Directory Certificate Services (AD CS) exploitation series, we explore ESC2 — an attack path that abuses certificate templates configured with the AnyPurpose EKU (2.5.29.37.0) or no EKU at all. These templates allow an attacker to request certificates that can be reused to request another certificate for a different user, including "Domain Administrator".
We’ll analyze a misconfigured template named Vulnerable2 using Certipy, walk through the exploitation process, and explain how to detect and remediate this configuration issue.
Importantly, we’ll also cover how to perform this attack in environments that do not support Kerberos authentication — and show how to work around it by getting an LDAP shell.
🔗 Certipy documentation: https://github.com/ly4k/Certipy/wiki/...
🔗 PKINIT not supported issue:https://github.com/ly4k/Certipy/issue...
If you missed Part 1 where we introduced how AD CS works and outlined the fundamentals, make sure to watch that first for better context.
Доступные форматы для скачивания:
Скачать видео mp4
-
Информация по загрузке:
