Certi-Bhai AD CS Exploitation Toolkit

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/incredibleindishell/Certi-Bhai
• Blog Title: Certi-Bhai: AD CS Exploitation Toolkit
• Suggested Section: Windows Hardening > Active Directory Methodology > AD Certificates > AD CS Domain Escalation; optionally cross-reference Abusing Active Directory ACLs/ACEs > Shadow Credentials for msDS-KeyCredentialLink modification

🎯 Content Summary

Overview

Certi-Bhai is a collection of PowerShell proof-of-concept tools for testing exploitable Active Directory Certificate Services (AD CS) configurations. The repository covers ESC1, ESC2/ESC3, ESC15, manual certificate-signing-request generation and submission, and ASP.NET interfaces for certificate enrollment and LDAP modification from IIS. These attacks target dangerous AD CS and Active Directory configurations rat...

🔧 Technical Details

Arbitrary certificate-identity injection: When an AD CS template grants an attacker enrollment permission and accepts requester-controlled subject or SAN values, submit a PKCS#10 request containing the identity of a privileged user or computer. Export the issued certificate and private key as a PFX and use certificate-based authentication to obtain credentials for the injected identity.

Certificate Request Agent impersonation: If an attacker can obtain an Any Purpose or Certificate Request Agent certificate and the CA does not adequately constrain on-behalf-of enrollment, use that certificate to authorize a second request for an arbitrary principal. The certificate returned by the second request represents the victim and may be used for Kerberos authentication.

Certificate-to-Kerberos authentication: Load an issued PFX, convert the required certificate data into the input format accepted by the Kerberos tool, a...

🤖 Agent Actions

Updated:

src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md

Added:

• Certi-Bhai PowerShell usage for ESC1 and ESC2/ESC3.
• Technical explanation of its COM-based enrollment flow.
• Correct Base64 PFX handling for Rubeus, clarifying that RawData lacks the private key.
• Numbered Certi-Bhai reference and citations.

ESC15 and Shadow Credentials were not duplicated because existing pages already cover them comprehensively.

Validation: git diff --check passed. Full mdBook build was skipped because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/incredibleindishell/Certi-Bhai

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Active Directory Methodology > AD Certificates > AD CS Domain Escalation; optionally cross-reference Abusing Active Directory ACLs/ACEs > Shadow Credentials for msDS-KeyCredentialLink modification".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0