🔍 [Day 2] ADCS Exploitation: ESC2

ESC2 involves misconfigured certificate templates permitting enrollment for any purpose, enabling unauthorized authentication or code signing.

📌 Key Points:

Risk: Templates with Any Purpose (OID 2.5.29.37.0) or SubCA (OID 2.5.29.19.20) allow misuse.

Exploitation: Attackers obtain certificates for unintended purposes (e.g., domain persistence).

Mitigation: Restrict templates to specific OIDs and enforce least-privilege enrollment.

📖 Reference: ESC2 Technical Breakdown

Next: ESC3 – Agent certificate abuse.

🔍 GMSA Password Attack: Exploiting Group Managed Service Accounts

Learn to extract & abuse GMSA passwords for AD privilege escalation:

✔ Retrieve hashes using PowerShell & Mimikatz

✔ Crack passwords & escalate privileges

✔ Bypass restrictions via gMSAPassword exploitation

🔧 Key Techniques:

• Get-ADServiceAccount hash extraction

• DSInternals hash conversion

• Kerberos ticket abuse

📖 Full Guide: Read Here