Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)

Tue, 30 Jun 2026 01:08:00 -0500

Summary

ESC8 is an AD CS vulnerability where the Certificate Enrollment Web Service is enabled over HTTP (without HTTPS). This allows intercepting a Domain Controller’s authentication and relaying it to the CA to request a certificate. With that certificate we can impersonate the DC, perform DCSync, and take full control of the domain.

Requirements

Valid domain user credentials (Rosie.Powell:Cicada123)
The CA has Web Enrollment over HTTP enabled
NTLM disabled in the domain (authentication must use Kerberos)
Machine Account Quota > 0 (allows adding DNS records, default is 10)

Step-by-step Walkthrough

1. Initial Setup

Ensure correct DNS resolution in /etc/hosts:

Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)

Tue, 09 Jun 2026 03:00:00 -0500

Introduction

ESC8 is a vulnerability in Active Directory Certificate Services (ADCS) that occurs when the Web Enrollment service is enabled over HTTP without encryption, or over HTTPS without Channel Binding (EPA) enabled.

The vulnerable endpoint is:

http://<CA>/certsrv/certfnsh.asp

This endpoint accepts NTLM authentication without signing or channel binding, making it susceptible to NTLM Relay attacks. In essence, an attacker can intercept the NTLM authentication of a privileged account (such as the Domain Controller’s machine account) and relay it to the ADCS service to obtain a valid certificate on behalf of that account.