DEF CON 34 - Main - Certified Re-Pwned Escalating All the Way Up -Daniel Monzon, Eric Labrador
Source: YouTube · DEFCONConference · published Nov 6, 2026 · 47:31
This Devcon talk from Halborn's Daniel Mont and Eric presents five new ADCS privilege escalation techniques (ESC18–22), with exploitation demos and mitigations for defenders 2:22.
Key Takeaways:
• ESC18: Supplying a certificate policy OID in the CSR gets a linked security group's privileges added to the attacker's Kerberos ticket—like ESC13/15 but with no template linkage needed 4:55.
• ESC19: With the security extension OID whitelisted, attackers bypass strong certificate binding, submitting admin's UPN with their own SID to authenticate as administrator directly 17:56.
• ESC20: An undocumented KDC fallback—omitting the security extension from the CSR makes the KDC read the attacker-controlled SAN URL SID; even full enforcement (SCB=2) doesn't block it 25:09.
• ESC21: v1 templates lack the MSPKI-RASignature-Attribute, so the CA silently skips enrollment-on-behalf-of checks—any enrollment agent certificate can enroll as anyone 32:52.
• ESC22: Enrollment agent restrictions aren't configured by default, and the certutil flag fails silently on Server 2025—combined with ESC21, this yields domain admin 40:05.
• Defense: Removing the ESS flag blocks ESC18–20 at once; also enforce explicit EKUs, upgrade v1 templates to v2+, and monitor events 4887/4768 44:40.
After Microsoft hardened the "front door" against ESC1–16, the speakers found these five new "windows" and released accompanying tooling.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everybody. H you can you hear me well? Okay, perfect. H so hello everybody and thank you very much for attending to our talk. H we are very excited to be here. H we are first time speakers here at Devcon. So yes uh thank you very much to the organization for letting us uh yes uh you know uh talk to you about our research and yeah let's uh get started. So uh our the title of our talk is escalating all the way up via ADCS. So this talk uh is uh about uh five new techniques that we found uh in about uh ADCS. Uh well most likely you already know but just as a reminder ADCS is a somewhere owned by Microsoft which uh enables uh public infrastructure uh features within AD environments. So it is very complex as you may know handling certificates identity related stuff. It has a lot of differ…