Conversation

and I give you "Certificates and Pwnage and Patches, Oh My!" posts.specterops.io/certificates-a . We clarify some misconceptions we had about AD CS, explain the KB5014754 patch and its implications, and detail some of the awesome AD CS work from people like

@ly4k_

. Enjoy!

posts.specterops.io

Certificates and Pwnage and Patches, Oh My!

This post was written by Will Schroeder and Lee Christensen.

5:10 PM · Nov 9, 2022

Replying to

and

Very great blog post, and thank you for the mentions! For ESC7, an easier technique that I’ve used and described in one of my earlier blog posts is to abuse the privileges of issuing failed enrollment attempts for the SubCA template

Replying to

and

Thank god for the sidextension patch! We ran into a customer in Full Enforcement mode a few weeks ago but manage to solve it using lolbins (certreq.exe). I were planning to add it to Certify but you guys took care of it 🏆🙂

Replying to

and

Great update on your initial work.

Replying to

and

Thanks both, this is great stuff 👍

Replying to

and

Incredible work with ADCS, thank you for sharing 🔥

Replying to

and

In my testing, relaying to CES Kerberos endpoint only worked when AD CS was on the DC. Did you get this working when it was on separate servers as well?