One certificate to rule them all: how ESC1 turns a user into a domain admin

Why the certificate authority is a crown jewel

An enterprise certificate authority is trusted by the whole domain. A certificate it issues is, in effect, a passport the domain will honour. That is why attackers love it: compromise the issuance rules and you do not need to steal a password, you mint an identity. Researchers at SpecterOps catalogued a family of these escalation paths, labelled ESC1 through the teens. ESC1 is the one you meet most often.

ESC1 in plain terms

A certificate template is a form. It becomes dangerous when four conditions line up at once:

• ordinary users are allowed to request certificates from it;
• the requester may specify an arbitrary subject alternative name, that is, name someone else as the identity;
• manager approval is off;
• no authorised signatures are required.

Put together, a normal user requests a certificate and simply types administrator as the subject. The CA issues it. The user then authenticates with that certificate through Kerberos PKINIT and is, to the entire domain, the administrator. Tools such as Certify and Certipy automate the whole path, which is why it does not take an expert.

How to see it and stop it

• Audit certificate requests and issuance (events 4886 and 4887) and alert on subjects that do not match the requester.
• Watch msDS-KeyCredentialLink changes (event 5136) for the related shadow-credentials trick.
• Remove the arbitrary-SAN right, or require manager approval, on any template ordinary users can enrol from.
• Enforce the certificate-mapping hardening Microsoft shipped for exactly this class of abuse.

What it means for your register

ESC1 is not a software bug you patch; it is a configuration you have or you do not. That makes it a governance question, which is where a risk programme belongs. The certificate authority should be one of the highest-criticality assets in your inventory, with a named owner, a documented review of its templates, and that review dated and repeatable. An auditor who asks “when did you last review who can enrol from which template” is asking whether ESC1 is open. If the answer lives in one engineer’s memory, you cannot answer. If it lives in your register, you can.

Attack detail from Unit 42’s write-up on AD CS exploitation.