PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ESC8s and Where to Find Them

abdulmhsblog.com | blog | #pentesting | #vulnerability-research | #active-directory | #adcs | #esc8 | #certipy | #relay-attack | #web-enrollment
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How to locate AD CS Web Enrollment endpoints for ESC8 relay attacks by enumerating constrained delegation with nxc and BloodHound, then confirming certsrv endpoints with curl before relaying.
Published
Collected

Related coverage

blog · abdulmhsblog.com
When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss
A pentester notes Certify and Certipy can misjudge ESC8 NTLM relay exposure: even with EPA enabled, AD CS Web Enrollment may stay relayable when channel or service binding isn't configured right.
blog · blog.sentry.security
ESC8 Attack Guide for Windows Environments
The ESC8 attack abuses AD CS Web Enrollment with NTLM relay: coercing a DC to authenticate hands attackers a certificate as that high-privilege account, potentially compromising the entire domain.
blog · semperis.com
Detecting and Mitigating the PetitPotam Attack on Windows Domains
How the PetitPotam attack works: EFSRPC authentication coercion relayed via NTLM to AD CS Web Enrollment (ESC8) can yield Domain Admin; the post maps the full chain and covers detection plus mitigations like disabling NTLM or enabling EPA.
research · projectblack.io
Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled
Fixing ESC8: when ADCS web enrolment is reachable over HTTP or lacks Channel Binding/EPA, a relay attack can obtain a domain controller certificate. The fix is requiring EPA and SSL in IIS.
blog · abdulmhsblog.com
Becoming the Machine, A Virtual Account's Guide to Total Control
Presents an ADCS takeover path: from a MSSQL virtual account, enroll a machine certificate with certreq, recover the machine account NTLM hash via PKINIT, then use S4U2SELF for a silver ticket.
blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
Back