> ## Documentation Index > Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # ADCSESC10a > This edge indicates that the principal has control over a victim principal with permission to enroll on one or more certificate templates, configured to enable certificate authentication and require the userPrincipalName (UPN) of the enrollee included in the Subject Alternative Name (SAN). export const continueStep_1 = "3" export const continueStep_0 = "4" Applies to BloodHound Enterprise and CE The victim also has enrollment permission for an enterprise CA with the necessary templates published. This enterprise CA is trusted for NT authentication in the forest, and chains up to a root CA for the forest. There is an affected Domain Controller (DC) configured to allow UPN certificate mapping. This setup lets the principal impersonate any AD forest computer, or any user where UPN does not match their `sAMAccountName`, without knowing their credentials. The attacker principal can abuse their control over the victim principal to modify the victim's UPN to match the `sAMAccountName` of a targeted principal followed by @CORP.LOCAL. Example: If the targeted principal is Administrator user of domain CORP.LOCAL, the victim's UPN will be populated with "[Administrator@CORP.LOCAL](mailto:Administrator@CORP.LOCAL)". The attacker principal will then abuse their control over the victim principal to obtain the credentials of the victim principal, or a session as the victim principal, and enroll a certificate as the victim in one of the affected certificate templates. The UPN of the victim ("[Administrator@CORP.LOCAL](mailto:Administrator@CORP.LOCAL)") will be included in the issued certificate under the SAN. Next, the attacker principal will again set the UPN of the victim, this time to an arbitrary string (e.g. the original value). The issued certificate can now be used for authentication against an affected DC. The UPN certificate mapping configuration on the DC makes the DC use the SAN value to map the certificate to a principal when performing Schannel authentication. The DC will attempt to find a principal with a UPN matching the SAN value ("[Administrator@CORP.LOCAL](mailto:Administrator@CORP.LOCAL)") but as the victim's UPN has been changed after the enrollment, there will be no principals with this UPN. The DC will then attempt to find a principal with a{' '} `sAMAccountName` matching the SAN value and find the targeted user. In case the target is a computer, the DC will find it, and the DC will attempt `sAMAccountName` matching with a \$ at the end of the SAN value as last resort. At last, the DC will authenticate the attacker as the targeted principal. ## Abuse Info ### Windows Step 1: Create .exe version of Certipy. Install PyInstaller on a host with python installed, clone down Certipy from GitHub, and run this cmdlet from the root of the GitHub repo to bundle the python project into an .exe binary which can be used on Windows computer where Python is not installed: ```bash theme={null} pyinstaller ./Certipy.spec ``` The Certipy.exe will be in the *dist* folder. Step 2: Set UPN of victim to targeted principal's `sAMAccountName` followed by @ and the domain name. Set the UPN of the victim principal using Certipy: ```bash theme={null} Certipy.exe account update -u ATTACKER@CORP.LOCAL -p PWD -user VICTIM -upn Target@CORP.LOCAL ``` Step 3: Check if the `mail` attribute of victim must be set and set it if required. If the certificate template is of schema version 2 or above, and its attribute `msPKI-Certificate-Name-Flag` contains the flag `SUBJECT_REQUIRE_EMAIL` and/or `SUBJECT_ALT_REQUIRE_EMAIL`, then the victim principal must have their `mail` attribute set for the certificate enrollment. The [CertTemplate](/resources/nodes/cert-template) BloodHound node will have "Subject Require Email" or "Subject Alternative Name Require Email" set to true if any of the flags are present. If the certificate template is of schema version 1 or does not have either email flag, then continue to Step {continueStep_0}. If either flag is present, you will need the victim's `mail` attribute to be set. The value of the attribute will be included in the issued certificate but it is not used to identify the target principal, so it can be set to any arbitrary string. Check if the victim has the `mail` attribute set using PowerView: ```PowerShell theme={null} Get-DomainObject -Identity VICTIM -Properties mail ``` If the victim has the `mail` attribute set, continue to Step 4. If the victim does not has the `mail` attribute set, set it to a dummy mail using PowerView: ```PowerShell theme={null} Set-DomainObject -Identity VICTIM -Set @{'mail'='dummy@mail.com'} ``` Step 4: Obtain a session as victim. There are several options for this step. If the victim is a computer, you can obtain the credentials of the computer account using the Shadow Credentials attack (see [AddKeyCredentialLink edge](/resources/edges/add-key-credential-link) documentation). Alternatively, you can obtain a session as SYSTEM on the host, which allows you to interact with AD as the computer account, by abusing control over the computer AD object (see [GenericAll edge](/resources/edges/generic-all) documentation). If the victim is a user, you have the following options for obtaining the credentials: * Shadow Credentials attack (see [AddKeyCredentialLink edge](/resources/edges/add-key-credential-link) documentation). * Password reset (see [ForceChangePassword edge](/resources/edges/force-change-password) documentation). * Targeted Kerberoasting (see [WriteSPN edge](/resources/edges/write-spn) documentation). Step 5: Enroll certificate as victim. Use Certipy as the victim principal to request enrollment in the affected template, specifying the affected [EnterpriseCA](/resources/nodes/enterprise-ca): ```bash theme={null} Certipy.exe req -u VICTIM@CORP.LOCAL -p PWD -ca CA-NAME -target CA-SERVER -template TEMPLATE ``` The issued certificate will be saved to disk with the name of the targeted user. Step 6: Set UPN of victim to an arbitrary value. Set the UPN of the victim principal using Certipy: ```bash theme={null} Certipy.exe account update -u ATTACKER@CORP.LOCAL -p PWD -user VICTIM -upn victim@corp.local ``` Step 7: Perform Schannel authentication as targeted principal against affected DC using certificate. Open an LDAP shell as the victim using Certipy by specifying the certificate created in Step 5 and the IP of an affected DC: ```bash theme={null} Certipy.exe auth -pfx TARGET.pfx -dc-ip IP -ldap-shell ``` ### Linux Step 1: Set UPN of victim to targeted principal's `sAMAccountName` followed by @ and the domain name. Set the UPN of the victim principal using Certipy: ```bash theme={null} certipy account update -u ATTACKER@CORP.LOCAL -p PWD -user VICTIM -upn Target@CORP.LOCAL ``` Step 2: Check if the `mail` attribute of victim must be set and set it if required. If the certificate template is of schema version 2 or above, and its attribute `msPKI-Certificate-Name-Flag` contains the flag `SUBJECT_REQUIRE_EMAIL` and/or `SUBJECT_ALT_REQUIRE_EMAIL`, then the victim principal must have their `mail` attribute set for the certificate enrollment. The [CertTemplate](/resources/nodes/cert-template) BloodHound node will have "Subject Require Email" or "Subject Alternative Name Require Email" set to true if any of the flags are present. If the certificate template is of schema version 1 or does not have either email flag, then continue to Step {continueStep_1}. If either flag is present, you will need the victim's `mail` attribute to be set. The value of the attribute will be included in the issued certificate but it is not used to identify the target principal, so it can be set to any arbitrary string. Check if the victim has the `mail` attribute set using ldapsearch: ```bash theme={null} ldapsearch -x -D "ATTACKER-DN" -w 'PWD' -h DOMAIN-DNS-NAME -b "VICTIM-DN" mail ``` If the victim has the `mail` attribute set, continue to Step 3. If the victim does not has the `mail` attribute set, set it to a dummy mail using ldapmodify: ```bash theme={null} echo -e "dn: VICTIM-DN\nchangetype: modify\nreplace: mail\nmail: test@mail.com" | ldapmodify -x -D "ATTACKER-DN" -w 'PWD' -h DOMAIN-DNS-NAME ``` Step 3: Obtain the credentials of victim. There are several options for this step. If the victim is a computer, you can obtain the credentials of the computer account using the Shadow Credentials attack (see [AddKeyCredentialLink edge](/resources/edges/add-key-credential-link) documentation). Alternatively, you can obtain a session as SYSTEM on the host, which allows you to interact with AD as the computer account, by abusing control over the computer AD object (see [GenericAll edge](/resources/edges/generic-all) documentation). If the victim is a user, you have the following options for obtaining the credentials: * Shadow Credentials attack (see [AddKeyCredentialLink edge](/resources/edges/add-key-credential-link) documentation). * Password reset (see [ForceChangePassword edge](/resources/edges/force-change-password) documentation). * Targeted Kerberoasting (see [WriteSPN edge](/resources/edges/write-spn) documentation). Step 4: Enroll certificate as victim. Use Certipy as the victim principal to request enrollment in the affected template, specifying the affected [EnterpriseCA](/resources/nodes/enterprise-ca): ```bash theme={null} certipy req -u VICTIM@CORP.LOCAL -p PWD -ca CA-NAME -target CA-SERVER -template TEMPLATE ``` The issued certificate will be saved to disk with the name of the targeted user. Step 5: Set UPN of victim to an arbitrary value. Set the UPN of the victim principal using Certipy: ```bash theme={null} certipy account update -u ATTACKER@CORP.LOCAL -p PWD -user VICTIM -upn victim@corp.local ``` Step 6: Perform Schannel authentication as targeted principal against affected DC using certificate. Open an LDAP shell as the victim using Certipy by specifying the certificate created in Step 5 and the IP of an affected DC: ```bash theme={null} certipy auth -pfx TARGET.pfx -dc-ip IP -ldap-shell ``` Opsec Considerations When the affected certificate authority issues the certificate to the attacker, it will retain a local copy of that certificate in its issued certificates store. Defenders may analyze those issued certificates to identify illegitimately issued certificates and identify the principal that requested the certificate, as well as the target identity the attacker is attempting to impersonate. ## Edge Schema Source: [User](/resources/nodes/user), [Group](/resources/nodes/group), [Computer](/resources/nodes/computer)\ Destination: [Domain](/resources/nodes/domain)\ Traversable: ✅ ## References This edge is related to the following MITRE ATT\&CK tactic and techniques: * [https://attack.mitre.org/techniques/T1649/](https://attack.mitre.org/techniques/T1649/) ### Abuse and Opsec references * [Certipy](https://github.com/ly4k/Certipy) * [Certipy 4.0](https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7) * [Set-DomainObject](https://powersploit.readthedocs.io/en/latest/Recon/Set-DomainObject/) * [LDAPSearch](https://linux.die.net/man/1/ldapsearch) * [LDAPModify](https://linux.die.net/man/1/ldapmodify) * [ADCS Attack Paths in BloodHound—Part 3](https://specterops.io/blog/2024/09/11/adcs-attack-paths-in-bloodhound-part-3/)