Something Wicked This Way Enrolls: Abusing ADCS with ESC17
Source: YouTube · Black Hills Information Security · published Oct 2, 2026 · 54:26
This webcast demonstrates the ESC17 ADCS privilege escalation technique, where a weakly configured certificate template lets any domain user impersonate a trusted server via TLS 0:04
Key Takeaways:
• ESC17 mirrors ESC1, but for server authentication instead of client authentication: template enabled, enrollee-supplied subject allowed, no manager approval or authorized signatures, and domain users have enrollment rights 8:16
• Attack chain: enumerate with certify find to find a vulnerable template, identify a server whose DNS attribute you can write (e.g., WSUS), request a certificate for that host with the DNS flag, then redirect its AD DNS record to your machine 12:25
• Standing up a malicious WSUS HTTPS service on port 8531 serves a "malicious update" that adds the attacker's account to connecting clients' local administrators group; any TLS-protected service can be impersonated, but DNS changes may break other hosted services 20:14
• Remediation: disable enrollee-supplied subject, apply least privilege to enrollment rights and DNS write permissions, require manager approval, and pin client trust to specific certificates 30:26
• Detection: enable CA auditing, then alert on requests where requester ≠ SAN, unexpected DNS attribute updates, WSUS connections to unexpected hosts, and local admin group modifications 34:03
ADCS misconfigurations remain one of the most common privilege escalation paths in penetration tests, so hardening templates and auditing certificate operations is essential. The presenters' lab and detection resources are publicly available.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
So, welcome everyone to this webcast where Caitlyn and I are going to talk about Active Directory certificate services. Um, specifically we're going to be talking about the latest privilege escalation technique um which is called ESC17. We're going to be showing how to exploit um another weak certificate template configuration. And if that sounds like gibberish to you, hopefully um you feel a little bit more informed within the next few slides because um we're going to give some background. But um as Katya said, Caitlyn and I are each pen testers on the continuous penetration testing team. Caitlyn and I also teach a class called assumed compromise where we cover um attacks just like attack paths just like this one and then we also walk through like how to detect and defend against these at…