> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/active-directory/attacks/adcs.md).

# ADCS

{% embed url="<https://edermi.github.io/post/2024/mfa_bypass_mtls/>" %}
ESC vuln
{% endembed %}

{% embed url="<https://www.crowdstrike.com/wp-content/uploads/2023/12/investigating-active-directory-certificate-abuse.pdf>" %}

### Cheat Sheet:

<figure><img src="/files/l1U55mh1czJW7ScFFEYw" alt=""><figcaption></figcaption></figure>

### ESE Parser:

Use case:

* When the ese files are too large to parse with eseutil. Python handles parsing better.

```
#!/usr/bin/python3
from dissect.esedb import EseDB
import argparse
parser = argparse.ArgumentParser()
parser.add_argument("-db", "--databasefile", help="Database file to be parsed")
args = parser.parse_args()
edb = args.databasefile
with open(edb, "rb") as fh:
 db = EseDB(fh)
 for table in db.tables():
 for record in table.records():
 print(record)
```

{% embed url="<https://www.pkisolutions.com/understanding-active-directory-certificate-services-containers-in-active-directory/>" %}

{% embed url="<https://m365internals.com/2022/11/07/investigating-certificate-template-enrollment-attacks-adcs/>" %}

{% embed url="<https://m365internals.com/2022/11/07/investigating-certificate-template-enrollment-attacks-adcs/>" %}

{% embed url="<https://github.com/davidprowe/BadBlood>" %}

{% embed url="<https://github.com/arth0sz/Practice-AD-CS-Domain-Escalation?tab=readme-ov-file#misconfigured-certificate-templates---esc1>" %}

{% embed url="<https://www.sysadmins.lv/retired-msft-blogs/pki/default.aspx?page=8>" %}

{% embed url="<https://www.beyondtrust.com/blog/entry/esc1-attacks>" %}

{% embed url="<https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuse/esc1>" %}
