Adcs

Diving Into AD CS: Exploring Some Common Error Messages

07 March 2025 ~18 min By Jacques Coertze
Active Directory Adcs Certificates Internals Windows Certificate
Abuse of Active Directory Certificate Services (AD CS) has become a staple of our internal network assessment methodology. In fact, I can’t recall an internal I’ve done in the past two or more years that didn’t feature ADCS abuse in some manner or another. We can all agree that when AD CS abuse works as intended, it is fantastic. As Tinus Green stated in his BSides talk, AD CS abuse is the teleport scroll to the top of the mountain. It allows us to rapidly gain high-privileged access to the domain and, from there, can target more lucrative objectives.

CertPotato – Using ADCS to privesc from virtual and network service accounts to local system

04 November 2022 ~10 min By Hocine Mahtout
Adcs Kerberos Rubeus Windows Certipy
The goal of this blog post is to present a privilege escalation I found while working on ADCS. We will see how it is possible to elevate our privileges to NT AUTHORITY\SYSTEM from virtual and network service accounts of a domain-joined machine (for example from a webshell on a Windows server) using ADCS. I want to call this attack chain “CertPotato” as homage to other *Potato tools and as a way to better remember it.