ADCS enumeration identifies certificate authorities, enabled templates, enrollment permissions, EKUs, subject-name rules, manager approval, authorized signatures, HTTP enrollment endpoints, and template ACLs.
Linux variables
export DC=10.10.10.200
export DOMAIN=ootw.local
export USER=student
export PASS='student'
Certipy find vulnerable paths
certipy find -u "$USER@$DOMAIN" -p "$PASS" -dc-ip $DC -vulnerable -enabled -stdout
certipy find -u "$USER@$DOMAIN" -p "$PASS" -dc-ip $DC -vulnerable -enabled -text -output adcs_vulnerable
Certipy collect all ADCS data
certipy find -u "$USER@$DOMAIN" -p "$PASS" -dc-ip $DC -enabled -text -output adcs_all
certipy find -u "$USER@$DOMAIN" -p "$PASS" -dc-ip $DC -enabled -json -output adcs_all
NetExec
nxc ldap $DC -d $DOMAIN -u $USER -p "$PASS" -M adcs
LDAP certificate templates
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ootw,DC=local" '(objectClass=pKICertificateTemplate)' cn displayName pKIExtendedKeyUsage msPKI-Certificate-Name-Flag msPKI-Enrollment-Flag nTSecurityDescriptor
LDAP enrollment services
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=ootw,DC=local" '(objectClass=pKIEnrollmentService)' cn dNSHostName certificateTemplates
LDAP NTAuth store
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ootw,DC=local" '(objectClass=certificationAuthority)' cn cACertificate
Certify CA enumeration
Certify.exe enum-cas --quiet
Certify vulnerable templates
Certify.exe enum-templates --filter-enabled --filter-vulnerable --hide-admins --quiet
Certify specific template
Certify.exe enum-templates --template ESC1 --quiet
PowerShell AD module
$ConfigNC = (Get-ADRootDSE).configurationNamingContext
Get-ADObject -SearchBase "CN=Enrollment Services,CN=Public Key Services,CN=Services,$ConfigNC" -LDAPFilter "(objectClass=pKIEnrollmentService)" -Properties dNSHostName,certificateTemplates
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigNC" -LDAPFilter "(objectClass=pKICertificateTemplate)" -Properties *
HTTP enrollment check
curl -I http://ca.ootw.local/certsrv/
curl -k -I https://ca.ootw.local/certsrv/
What to mark
Template name
CA name
Enrollment principal
Client authentication EKU
Any Purpose or empty EKU
ENROLLEE_SUPPLIES_SUBJECT
Manager approval required
Authorized signatures required
Template owner
Template DACL writers
HTTP enrollment enabled