Скачать или смотреть Part 3: ESC3 - ADCS privilege escalation when kerberos is not supported via certiifcates

This video continues my ADCS exploitation series with a deep dive into ESC3 — a privilege escalation method involving vulnerable Enrollment Agent templates.

I demonstrate how an attacker can request a certificate on behalf of another user, such as a Domain Admin, even if the domain controller does not support Kerberos authentication via certificates. Using Certipy, I enumerate and exploit a preconfigured vulnerable template called Vulnerable3, then escalate privileges through LDAP shell access.

Key points covered:

Requirements for ESC3 exploitation

How to identify vulnerable templates

Demonstration of issuing a certificate and escalating using LDAP

Real-world troubleshooting tips

Remediation strategies to harden ADCS against this abuse path

This is a practical, hands-on look at how template misconfigurations in ADCS can lead to full domain compromise.