Red-Team Lab Demonstrates Active Directory Escalation Through AD CS ESC1
· 53:12 · Watch on YouTube ↗
Summary
A red-team tutorial demonstrates escalation from a low-privilege user to domain administrator in an intentionally vulnerable Active Directory lab, using AD CS ESC1 certificate abuse before extracting credentials with DCSync.
Key points
- The demonstration uses an intentionally vulnerable, AI-scripted Active Directory lab, not a reported compromise of a real organization.
- Initial reconnaissance identifies passwords in user description fields, excessive domain administrators and privileged sessions on other systems.
- The presenter demonstrates scanning bypasses for PowerShell and C# assemblies, noting that the initial PowerShell-focused bypass did not cover assembly execution.
- Password spraying discovers an admin account using the password admin; the lab has no account lockout, enforced password history or password complexity requirement.
- Certify identifies certificate-template weaknesses described as ESC1 and ESC4; the demonstrated escalation uses ESC1 to obtain a certificate impersonating a domain administrator.
- The presenter imports a certificate-derived Kerberos ticket, demonstrates write access to the domain controller's administrative share and successfully performs DCSync.
Article Details
- Topics
- [00:12] Endpoint protection and initial user-privilege assessment
- [02:15] Scanning bypass and Active Directory reconnaissance
- [06:43] BloodHound collection and privilege-path analysis
- [21:39] C2 agent setup, assembly-scanning bypass and Kerberoasting
- [32:48] Password-policy review and password spraying
- [41:11] AD CS template assessment and ESC1 certificate impersonation
- [47:12] Certificate authentication, administrative access validation and DCSync
MITRE ATT&CK
T1003.006 · DCSyncAfter certificate-based escalation, the presenter successfully performs DCSync for selected domain accounts.T1059.001 · PowerShellPowerShell is used to load reconnaissance scripts and execute the presenter's agent in the lab.T1087.002 · Domain AccountDirectory reconnaissance enumerates domain users and inspects account descriptions.T1110.003 · Password SprayingPassword spraying successfully identifies an admin account with the password admin in the lab.T1201 · Password Policy DiscoveryThe presenter examines domain password length, complexity, history and lockout settings before spraying.T1518.001 · Security Software DiscoveryThe lab presenter checks Defender settings and processes to identify endpoint security software before reconnaissance.T1550.003 · Pass the TicketThe presenter imports the certificate-derived Kerberos ticket into the current session for privileged access.T1552.006 · Group Policy PreferencesPasswords are discovered in Active Directory user description fields in the intentionally vulnerable lab.T1558.003 · KerberoastingThe presenter obtains Kerberoastable hashes but explicitly does not proceed with cracking them.T1562.001 · Disable or Modify ToolsThe presenter demonstrates bypassing scanning for PowerShell and subsequently patching scanning coverage for C# assemblies.T1649 · Steal or Forge Authentication CertificatesESC1 certificate-template abuse obtains a certificate impersonating a domain administrator, which is then used for authentication.