https://blog.iamwin.xyz/tags/rpc-relay/Recent content in RPC Relay on IamWin's BlogHugoen-usSun, 28 Jun 2026 21:30:00 -0500https://blog.iamwin.xyz/posts/esc11/Sun, 28 Jun 2026 21:30:00 -0500https://blog.iamwin.xyz/posts/esc11/<h2 id="introduction">Introduction</h2> <p><strong>ESC11</strong> is a vulnerability in <strong>Active Directory Certificate Services (ADCS)</strong> that occurs when the RPC interface of the Certificate Authority (CA) — specifically the <strong>ICertPassage (MS-ICPR)</strong> interface — does not enforce signing or encryption for certificate enrollment requests. This happens because the <code>IF_ENFORCEENCRYPTICERTREQUEST</code> flag is disabled on the CA.</p> <p>Since no packet signing or encryption is required on this RPC interface, it becomes vulnerable to <strong>NTLM Relay</strong> attacks. If an attacker manages to coerce the NTLM authentication of a privileged account (such as the machine account of a Domain Controller or a Domain Admin), they can relay that authentication to the CA&rsquo;s RPC port and request a valid certificate on behalf of the victim.</p>