I85PREP
⌘ K
OSCE3 study materials
OSCE3 study resources

ESC1 against a hardened certificate mapping baseline

OSCE3 · Put your knowledge to work in context.

All case studies

ESC1 against a hardened certificate mapping baseline

Contoso is a single forest with corp.local and an enterprise CA (CA01, Windows Server 2022, patched to the February 2025 baseline) on the same subnet as two domain controllers. From a workstation foothold you obtained credentials for CORP\helpdesk1, which is nested into a group holding Enroll rights on a published template named Workstation-Auth. That template has CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT set, no approval requirement, no manager signature, and EKUs for Client Authentication and Smart Card Logon. BloodHound data is 10 days old and a refresh shows no new edges. Every DC has StrongCertificateBindingEnforcement set to Full Enforcement, the CA carries the matching update, and the tier-0 account you want (CORP\da_admin) is in Protected Users and has no altSecurityIdentities value configured. EDR alerts on known credential-dumping tools, there is no internet egress, and only SMB, LDAP and RPC to the DCs and CA01 are reachable. The engagement ends in six hours.

1. Before spending the six hours, decide: will a certificate requested from Workstation-Auth with [email protected] give you domain admin? Justify it against the mapping the KDC actually performs.

Read the worked answer

No. This is the trap the scenario is built around, and six hours is not enough to discover it empirically.

  • ESC1 lets you choose the SAN, but the request is authenticated as helpdesk1. A patched CA stamps the SID security extension (1.3.6.1.4.1.311.25.2) with the requestor's SID, not the SID you claim in the SAN.
  • With StrongCertificateBindingEnforcement = 2, the KDC treats the SID extension as authoritative. A cert whose SID extension resolves to helpdesk1 and whose SAN says da_admin is a mismatch, and PKINIT fails with a certificate/name mismatch rather than issuing a TGT for da_admin.
  • da_admin having no altSecurityIdentities removes the weak-mapping escape hatch entirely; there is nothing on the account for an issuer/serial or SHA1-public-key mapping to match.
  • Protected Users does not block PKINIT, so it is not the thing stopping you - but it does remove NTLM and RC4, so any fallback that relies on the cert's NTLM mapping is also dead.
  • Operational cost: the CA logs requestor plus requested SAN on the failed request, which is a loud IOC on a monitored CA.

Conclusion: the certificate is a perfectly good authentication certificate for helpdesk1 and nothing more. Do not enrol against da_admin at all; treat the template as useful only if you can later control the mapping of the target account.

2. Accepting that, what do you actually do with the remaining hours? Give the chain in order, with the check that tells you to abandon each step.

Read the worked answer

Work outward from the one primitive you legitimately own: the ability to obtain a cert for helpdesk1.

  1. Refresh BloodHound with the new creds. Ten-day-old data on a live engagement is a liability; rerun collection against corp.local and specifically look at outbound ACLs from helpdesk1 and its groups.
  2. Hunt for altSecurityIdentities write rights (strong-mapping-aware ESC1). If helpdesk1 has GenericWrite/WriteProperty on that attribute for any account with real rights, set X509:<I>DC=corp,DC=local,CN=CA01-CA<S>serial from the cert you already hold, authenticate as that account, then remove the value. Abandon if the only writable accounts are unprivileged or in Protected Users.
  3. Check ESC9/ESC10 preconditions. If you hold write rights on userPrincipalName (or the userPrincipalName-adjacent attributes) of an account outside Protected Users with no altSecurityIdentities, rewrite its UPN to your SAN, PKINIT, then restore it. Abandon if the account is in Protected Users - those writes exist but the auth will fail.
  4. Walk the CA. Enumerate ACLs on CA01 itself and on the CA objects in AD; ManageCA / ManageCertificates (ESC7) lets you approve denied requests and publish templates, which reopens the SID-extension question on a template you control. Abandon if the CA host requires an interactive DC-local logon that EDR will flag.

Time budget: steps 1-2 in 90 minutes, 3 in the next 90, and if you are still holding only helpdesk1 certs at the three-hour mark, stop and pivot to the workstation path, because the mapping baseline is not going to bend.