> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/04.-esc13.md).

# 04. ESC13

## The Mechanism, Step by Step

{% stepper %}
{% step %}
A certificate template can carry one or more **Issuance Policies** (OIDs) — these normally just describe the "assurance level" of a certificate (e.g. "this cert proves smart-card-verified identity").
{% endstep %}

{% step %}
An Issuance Policy OID can separately be **linked to an AD security group** via the `msDS-OIDToGroupLink` attribute on the OID object.
{% endstep %}

{% step %}
**The consequence:** when a domain controller evaluates a Kerberos PKINIT logon using a certificate that carries that Issuance Policy, it adds the linked group to the resulting ticket's PAC (Privilege Attribute Certificate) — *as if the user were really a member*, even though Active Directory Users and Computers shows no such membership.
{% endstep %}
{% endstepper %}

## Why This Is Exploitable

If the template also allows enrollment by a low-privileged principal (commonly "Domain Users"), any authenticated user can get a certificate that silently grants them a privileged group's access rights — with zero visible trace in the group's actual membership list.

## Worked Example

Suppose `domain.htb` has a template called `TemporaryVPNAccess`:

* Client Authentication: enabled
* Enrollment rights: Domain Users
* Issuance Policy linked to: `CN=VPNAccess,CN=Users,DC=domain,DC=htb`

```bash
# Step 1: request a certificate from the vulnerable template
certipy-ad req -u jane.doe@domain.htb -k -no-pass -dc-ip 10.10.10.5 \
  -target dc1.domain.htb -ca domain-DC1-CA -template TemporaryVPNAccess

# Step 2: authenticate with it — the resulting ticket now includes
# VPNAccess group membership, and certipy also recovers the NT hash
# as a side effect (PKINIT / UnPAC-the-hash, see 12_Cert_Auth_NT_Hash.md)
certipy-ad auth -pfx jane.doe.pfx -dc-ip 10.10.10.5 -domain domain.htb
```

`jane.doe` never touched the `VPNAccess` group object, yet her new ticket carries its privileges — that's the entire attack.

## How To Spot It Defensively

Check every certificate template's linked Issuance Policies and cross-reference `msDS-OIDToGroupLink` against privileged groups — group membership lists alone won't reveal this.

## Compare to ESC1

ESC13 grants *extra group membership* on top of your real identity.\
ESC1 (`11_ESC1.md`) lets you become an **entirely different account** outright — generally the more severe of the two.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/04.-esc13.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.