Building a Vulnerable ADCS Lab for ESC1, ESC4, ESC8 and ESC11 Testing

Summary

The video demonstrates building a lab ADCS server with four certificate-service misconfigurations, inspecting the setup script, and checking vulnerable templates with Certify.

Key points

• The presenter builds a vulnerable Active Directory Certificate Services (ADCS) environment in a Windows Server virtual machine for security testing.
• The setup script is reviewed before execution; the presenter warns against running uninspected code.
• The tutorial configures ESC1 through certificate-template settings that allow requests impersonating other domain users without approval.
• It describes ESC4 as an access-control misconfiguration and ESC8 and ESC11 as relay attack paths involving HTTP and RPC, respectively.
• The presenter uses Certify from a client system to find and verify vulnerable certificate templates; exploitation is deferred to future videos.