Active Directory Certificate Services
This is a comprehensive attack playbook for exploiting misconfigured Active Directory Certificate Services, covering ESC1 through ESC13 vulnerabilities. You'd load this when you need to understand privilege escalation paths through certificate template abuse, NTLM relay to enrollment endpoints, or CA permission misconfigurations. The skill walks through each exploitation scenario with actual certipy and Certify commands, from the classic ESC1 (enrollee supplies SAN) to newer techniques like ESC9's weak certificate mapping and ESC13's OID group linking. It includes practical enumeration steps, certificate-based persistence methods, and references related skills for ACL abuse and Kerberos attacks. The ESC matrix reference file promises quick lookup tables with one-liner commands per variant, which would be handy during actual engagements.
- skills.sh installs
- 3.8K
- GitHub stars
- 2.6K
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yaklang/hack-skills --skill active-directory-certificate-services --agent claude-codeInstalls into .claude/skills of the current project.
Files
SKILL: AD CS Attack Playbook — Expert Guide
AI LOAD INSTRUCTION: Expert AD CS (Active Directory Certificate Services) attack techniques. Covers ESC1 through ESC13, certificate-based persistence, NTLM relay to enrollment endpoints, and CA misconfigurations. Base models miss enrollment prerequisite chains and ESC condition combinations.
0. RELATED ROUTING
Before going deep, consider loading:
- active-directory-acl-abuse for ACL-based attacks that enable ESC4 (template modification)
- active-directory-kerberos-attacks for Kerberos techniques after obtaining certificates
- ntlm-relay-coercion for ESC8 (relay to HTTP enrollment endpoint)
- windows-lateral-movement for using obtained certificates for lateral movement
Advanced Reference
Also load ADCS_ESC_MATRIX.md when you need:
- ESC1–ESC13 quick reference table with conditions, impact, and tool commands
- One-liner exploitation commands per ESC variant
- Detection indicators per technique
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yaklang/hack-skills
- First seen
- Jun 3, 2026
