# ADCS攻击
English: ADCS Attacks
- Entry Count: 5
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## ADCS ESC2攻击
- ID: adcs-esc2
- Difficulty: advanced
- Subcategory: ESC2
- Tags: adcs, esc2, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc2.md
Description:
利用ESC2模板配置错误
Prerequisites:
- 域环境
- ADCS服务
- 存在ESC2模板
Execution Outline:
1. 探测ESC2模板
2. 请求证书
3. 使用证书认证
## ADCS ESC3攻击
- ID: adcs-esc3
- Difficulty: advanced
- Subcategory: ESC3
- Tags: adcs, esc3, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc3.md
Description:
利用ESC3注册代理配置错误
Prerequisites:
- 域环境
- ADCS服务
- 存在ESC3配置
Execution Outline:
1. 探测ESC3
2. 获取注册代理证书
3. 代表其他用户请求证书
## ADCS ESC4攻击
- ID: adcs-esc4
- Difficulty: advanced
- Subcategory: ESC4
- Tags: adcs, esc4, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc4.md
Description:
利用ESC4模板权限配置错误
Prerequisites:
- 域环境
- ADCS服务
- 对模板有写权限
Execution Outline:
1. 探测ESC4
2. 修改模板配置
3. 请求证书
4. 恢复模板配置
## ADCS ESC6攻击
- ID: adcs-esc6
- Difficulty: advanced
- Subcategory: ESC6
- Tags: adcs, esc6, certificate
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc6.md
Description:
利用ESC6编辑标志配置错误
Prerequisites:
- 域环境
- ADCS服务
- CA启用EDITF_ATTRIBUTESUBJECTALTNAME2
Execution Outline:
1. 探测ESC6
2. 请求证书
3. 使用证书认证
## ADCS ESC8攻击
- ID: adcs-esc8
- Difficulty: advanced
- Subcategory: ESC8
- Tags: adcs, esc8, ntlm-relay
- Original Extracted Source: original extracted intranet-security-wiki source/adcs-esc8.md
Description:
利用ESC8 HTTP端点进行NTLM中继
Prerequisites:
- 域环境
- ADCS HTTP端点
- 可触发NTLM认证
Execution Outline:
1. 探测ESC8
2. 设置NTLM中继
3. 触发认证

