Certify

Certify is the Windows/.NET GhostPack tool for enumerating and abusing AD CS from an existing foothold. Its request verb enrolls in a vulnerable template and, for ESC1, uses /altname to set an arbitrary Subject Alternative Name (e.g. Administrator) on the issued certificate. The output PEM is converted to .pfx with openssl and then passed to Rubeus asktgt /certificate for PKINIT. Use this when you already have a Windows beacon and want to stay on-host rather than pivoting to a Linux attacker box with Certipy. Command Reference: CA config: dc.test.local\test-CA Template: ESC1 Impersonated user: Administrator

Certify.exe request /ca:dc.test.local\test-CA /template:ESC1 /altname:administrator

Evidence

Upstream reference

Environment

Active Directory

Native

PrivEsc, Exploitation

Requires

Shell

Services

ADCS

Refs

github.com/GhostPack/Certify

posts.specterops.io/certified-pre-owned-d95910965cd2

book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation