Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
ESC1 — SAN in Template
Template allows enrollee to specify Subject Alternative Name (SAN). Request cert as any user.Conditions
ENROLLEE_SUPPLIES_SUBJECTflag set- Client Authentication EKU
- Low-privilege user can enroll
Certify
Certipy
ESC2 — Any Purpose / No EKU
Template hasAny Purpose EKU or no EKU at all → can be used for client auth.
Exploit
Same as ESC1 if ENROLLEE_SUPPLIES_SUBJECT also set. Otherwise combine with ESC3 (enrollment agent).ESC3 — Enrollment Agent
Two-step: enroll as enrollment agent, then request cert on behalf of another user.Step 1 — Get Enrollment Agent Cert
Step 2 — Request on Behalf Of
ESC4 — Template ACL
Write access to certificate template → modify template to be vulnerable (ESC1).Certipy
ESC5 — PKI Object ACL
Write access to CA server AD object, CA config, or PKI-related objects. Broad scope — depends on specific misconfiguration.ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2
CA flagEDITF_ATTRIBUTESUBJECTALTNAME2 allows SAN in any certificate request, regardless of template config.
Check
Exploit
Same as ESC1 — specify SAN in any template:ESC7 — CA ACL (ManageCA)
User hasManageCA or ManageCertificates on CA → enable ESC6 flag or approve pending requests.
Enable EDITF_ATTRIBUTESUBJECTALTNAME2
Approve Pending Requests
ESC8 — NTLM Relay to Web Enrollment
CA has HTTP enrollment endpoint → relay NTLM authentication to get certificate as victim.Setup Relay
Coerce Authentication
Use Certificate
Quick Reference
| ESC | Key Condition | Exploit |
|---|---|---|
| ESC1 | SAN + low-priv enroll | Request cert with -upn admin |
| ESC2 | Any Purpose EKU | Similar to ESC1 |
| ESC3 | Enrollment Agent | Two-step: agent cert → on-behalf-of |
| ESC4 | Write template ACL | Modify template → ESC1 |
| ESC6 | EDITF flag | SAN in any template |
| ESC7 | ManageCA perm | Enable ESC6 or approve requests |
| ESC8 | HTTP enrollment | NTLM relay to CA |