This repository demonstrates a tool that exploits two Windows AD CS defects to bypass the KB5014754 strong certificate binding patch and forge a certificate that allows a low-privileged user to obtain Domain Admin via PKINIT.
9
No data
1
0
No data
2026-07-27
It shows a concrete, working bypass of a documented security patch (KB5014754) using chained vulnerabilities in certsrv.exe and certpdef.dll, which can compromise a fully patched Active Directory environment.
I use the CMC id-cmc-addExtensions control to inject arbitrary X.509 extensions
into an AD CS certificate request. On an ESC1-shaped template, that lets a
low-privileged domain user forge a certificate whose Subject Alternative Name and
whose szOID_NTDS_CA_SECURITY_EXT SID both point at Administrator - and PKINIT to
Domain Admin on a fully patched CA and DC with
StrongCertificateBindingEnforcement = 2.
Full writeup, with the disassembly and the reasoning: https://0xmaz.me/posts/certsrv-id-cmc-addExtensions-KB5014754-bypass/
Reverse-engineering notes (functions, offsets, both binaries): REVERSING.md.
Two defects, chained.
certsrv.exe routes request extensions through a dispatcher that masks the caller
flag with & 0xf0000 and recognises only two allowlists (0x50000 and 0x90000).
The id-cmc-addExtensions handler calls it with 0x80002, and
0x80002 & 0xf0000 = 0x80000 - neither value - so no allowlist runs. Every
extension I put in the CMC control reaches SetCertificateExtension, including the
SAN and szOID_NTDS_CA_SECURITY_EXT. The signer only needs a certificate the CA
itself issued (CryptMsgGetAndVerifySigner with CMSG_SIGNER_ONLY_FLAG checks the
signature, not the chain), so --auto-signer enrolls a throwaway to sign with.
certpdef.dll is supposed to stamp the requester's real SID into that extension -
the KB5014754 defence. On the enrollee-supplies-subject path it doesn't generate
anything; it copies the SID out of the request. Since the first defect lets me put
any SID in the request, I supply the Administrator's SID next to the Administrator
UPN, and the KDC's strong binding check passes.
ENROLLEE_SUPPLIES_SUBJECT, a clientAuth EKU, enroll
rights for the low-privileged user, and no SUBJECT_ALT_REQUIRE_UPN. No
default-published template has this shape - the built-ins carry
REQUIRE_UPN/REQUIRE_DNS, which rebind the SAN and SID to the caller. The
point is that KB5014754 was documented as making a leftover ESC1 template
survivable; on this path it doesn't.python3 -m venv .venv && . .venv/bin/activate
pip install -r requirements.txt
# certipy-ad and impack
A low-priv domain user forges an Administrator certificate through the CMC `id-cmc-addExtensions` control and PKINITs to Domain Admin
Similar projects matched by category, topics, and programming language.
Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.
A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.
mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.