Active Directory Certificate Services

This is a comprehensive attack playbook for exploiting misconfigured Active Directory Certificate Services, covering ESC1 through ESC13 vulnerabilities. You'd load this when you need to understand privilege escalation paths through certificate template abuse, NTLM relay to enrollment endpoints, or CA permission misconfigurations. The skill walks through each exploitation scenario with actual certipy and Certify commands, from the classic ESC1 (enrollee supplies SAN) to newer techniques like ESC9's weak certificate mapping and ESC13's OID group linking. It includes practical enumeration steps, certificate-based persistence methods, and references related skills for ACL abuse and Kerberos attacks. The ESC matrix reference file promises quick lookup tables with one-liner commands per variant, which would be handy during actual engagements.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill active-directory-certificate-services --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: AD CS Attack Playbook — Expert Guide

AI LOAD INSTRUCTION: Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations.

0. RELATED ROUTING

Before going deep, consider loading:

active-directory-acl-abuse for ACL-based attacks that enable ESC4 (template modification)
active-directory-kerberos-attacks for Kerberos techniques after obtaining certificates
ntlm-relay-coercion for ESC8 (relay to HTTP enrollment endpoint)
windows-lateral-movement for using obtained certificates for lateral movement