ADCS ESC11 → certificate via RPC (no web enrollment)

§ Context

Assumed environment: CA host has IF_NOREMOTEICERTREQUEST disabled and RPC interface accessible. Common when admins disable web enrollment thinking it patches ESC8.

§ Steps

1. 01
   Low-priv principal w/ network reachInitial Access

   T1078— Valid Accounts
2. 02
   DC cert issuedLateral Movement

   T1550.003— Pass the Ticket
3. 03
   Coerce DC$ via PetitPotam / DFSCoerceInitial Access

   AD-COERCE-DFSCOERCE— DFSCoerce (MS-DFSNM)
4. 04
   DCSyncCredential Access

   T1003.006— DCSync
5. 05
   ntlmrelayx --adcs to CA RPCCredential Access

   AD-ESC11— ADCS ESC11 — RPC over IF_NOREMOTEICERTREQUEST

   ntlmrelayx.py -t rpc://<ca> --adcs --template DomainController

6. 06
   PKINIT as DC$Credential Access

   AD-UNPAC— UnPAC-the-Hash

§ References

• T1078Valid Accounts
• T1550.003Pass the Ticket
• T1003.006DCSync

§ Frequently asked

What is the "ADCS ESC11 → certificate via RPC (no web enrollment)" attack path?

When the CA's ICertPassage RPC interface allows NTLM without signing, relay any coerced auth directly to RPC and obtain a cert — bypasses HTTP-only mitigations. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Low-priv principal w/ network reach (T1078) — a initial access primitive. Assumed environment: CA host has IF_NOREMOTEICERTREQUEST disabled and RPC interface accessible.

What is the final impact of this kill-chain?

The final step lands on PKINIT as DC$ (AD-UNPAC), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques3

  mitm6 IPv6 SLAAC → NTLM relay → DA

  Even when IPv4 is hardened, Windows clients prefer IPv6 with default DHCPv6. mitm6 makes the attacker the IPv6 DNS server, advertises wpad, and relays the captured NTLM to LDAPS for RBCD.

• Shared techniques3

  Shadow Credentials → PKINIT → NT hash

  Where GenericWrite is held over a target, write a fake KeyCredentialLink (whfb-like) and authenticate via PKINIT to recover the target's NT hash.

• Shared techniques3

  PetitPotam + ADCS ESC8 → Domain Controller takeover

  Coerce a DC's machine account to authenticate to the attacker, relay that NTLM to the ADCS HTTP web-enrollment endpoint, and obtain a DC certificate for full domain compromise.

• Shared techniques3

  ADCS ESC1 → Domain Admin

  A low-priv domain user discovers a certificate template that lets enrollees supply an arbitrary subjectAltName, enrolls a cert as Administrator, and authenticates via PKINIT.

• Shared techniques3

  Unconstrained delegation → Capture DC TGT → DCSync

  Compromise a host with TRUSTED_FOR_DELEGATION, coerce a DC to authenticate to it, harvest the DC's TGT from its LSASS, then DCSync.

• Shared techniques2

  Citrix Bleed → steal authenticated session → MFA bypass

  Send a long Host header to a vulnerable NetScaler — memory disclosure leaks an authenticated session token already past MFA. Replay the token to log into the corporate VPN.