> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# ESC8 - NTLM Relay to AD CS HTTP Endpoints

> Exploit insufficiently protected web enrollment services by relaying NTLM authentication to AD CS HTTP endpoints

ESC8 is a misconfiguration in Active Directory Certificate Services (AD CS), which stems from insufficiently protected web enrollment services. Specifically, if a web enrollment service is not hosted over HTTPS with Channel Binding enforced, NTLM authentication attempts in the domain network can be relayed to the web enrollment service to request certificates for other domain principals.

## Vulnerability Criteria

Either of the following criteria comprise an ESC8 vulnerability:

<Accordion title="ESC8 Vulnerable Services">
  * The `Certification Authority Web Enrollment` service is hosted over HTTP.
  * The `Certification Authority Web Enrollment` service is hosted over HTTPS without Channel Binding.
  * The `Certificate Enrollment Service` (CES) service is hosted over HTTPS without Channel Binding.
  * The `Certificate Enrollment Policy` (CEP) service is hosted over HTTPS without Channel Binding.
  * The `Network Device Enrollment Service` (NDES) server is hosted over HTTPS without Channel Binding.
</Accordion>

## Detection

While Certify does not facilitate abuse-functions for this vulnerability type, we can search for misconfigured `Certification Authority Web Enrollment` services using the `enum-cas --filter-vulnerable` command from Certify. For more information about the command and its parameters, please refer to the [Command Overview](./1-command-overview) page.

<CodeGroup>
  ```bash Command theme={null}
  Certify.exe enum-cas --filter-vulnerable --hide-admins
  ```

  ```diff Output theme={null}
     _____          _   _  __
    / ____|        | | (_)/ _|
   | |     ___ _ __| |_ _| |_ _   _
   | |    / _ \ '__| __| |  _| | | |
   | |___|  __/ |  | |_| | | | |_| |
    \_____\___|_|   \__|_|_|  \__, |
                               __/ |
                              |___./
    v2.0.0

  [*] Action: Find certificate authorities
  [*] Using the search base 'CN=Configuration,DC=corp,DC=local'
  [*] Classifying vulnerabilities in the context of built-in low-privileged domain groups.

  [*] Root CAs

      ...

  [*] NTAuthCertificates - Certificates that enable authentication:

      ...

  [*] Enterprise/enrollment certificate authorities:

      Enterprise CA Name            : CORP-CA01-CA
      DNS Hostname                  : ca01.corp.local
      FullName                      : ca01.corp.local\CORP-CA01-CA
      Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
      Cert SubjectName              : CN=CORP-CA01-CA, DC=corp, DC=local
      Cert Thumbprint               : CFBDC6826AC074EF86BE7774F959A2FF5F322DDC
      Cert Serial                   : 12D3E574A63DE7854A9E5A1F4CD56490
      Cert Start Date               : 21/05/2025 12.13.47
      Cert End Date                 : 21/05/2030 12.23.46
      Cert Chain                    : CN=CORP-CA01-CA,DC=corp,DC=local
      User Specifies SAN            : Disabled
      RPC Request Encryption        : Enabled
      Vulnerabilities
  +     ESC8                        : The CA supports HTTPS web enrollment without channel binding.
      CA Permissions
        Owner: BUILTIN\Administrators             S-1-5-32-544

        Access Rights                                     Principal
        Allow  Enroll                                     NT AUTHORITY\Authenticated Users   S-1-5-11
      Enrollment Agent Restrictions : None

  +   Legacy ASP Enrollment Website : https://ca01.corp.local/certsrv/

      Enrollment Web Service        : https://ca01.corp.local/CORP-CA01-CA_CES_Kerberos/service.svc

      Enabled Certificate Templates:
          ...

  Certify completed in 00:00:00.4966358
  ```
</CodeGroup>

## Exploitation

<Info>
  Once a vulnerable web enrollment service has been identified, the most common abuse scenario involves using `Coercer` or `PetitPotam` to coerce a domain controller to authenticate to an attacker-controlled host and then relay the authentication attempt to the AD CS web enrollment service using `ntlmrelayx` in order to request a certificate from the `Domain Controller` certificate template. The resulting certificate can be used to perform a replication attack (dcsync) against the domain.
</Info>