NTLM Relay to AD CS: The ESC8 Attack Explained
ESC8 explained: relaying coerced NTLM authentication into the AD CS web enrollment endpoint, and why the issued certificate outlives the relay.
NTLM Relay becomes much more serious when the destination can turn a few seconds of authentication into a certificate that remains valid afterward.
That is the center of ESC8.
AD CS can expose enrollment through IIS using Web Enrollment, commonly /certsrv/, or Certificate Enrollment Web Service.
If the endpoint accepts NTLM without the right protections, captured or coerced authentication may be forwarded to that service.
The result can be a certificate issued as the identity that just authenticated.
The examples below assume a lab or an authorized penetration test.
The chain combines two systems
NTLM Relay solves one part.
The attacker receives valid authentication without knowing the password.
AD CS solves another.
The enrollment endpoint uses that identity to decide whether a certificate can be issued.
Combine them:
1
2
3
4
5
6
7
8
9
10
11
machine or user
|
| NTLM
v
relay
|
v
AD CS Web Enrollment
|
v
certificate for that identity
The relay session ends.
The certificate remains a credential.
That changes the impact significantly.
The endpoint needs to accept relayed authentication
Microsoft describes ESC8 on IIS enrollment endpoints that allow NTLM without the appropriate protections.
Current Defender for Identity guidance highlights HTTPS and Extended Protection for Authentication, EPA.
Configuration details matter.
HTTPS protects the transport channel.
EPA helps bind authentication to the expected channel and service, reducing relay viability.
A /certsrv/ endpoint with NTLM and insufficient protection deserves validation.
Find the endpoint first
Common paths include:
1
2
http://ca.lab.local/certsrv/
https://ca.lab.local/certsrv/
CES may use other paths depending on installation.
Certipy helps enumerate AD CS.
I also inspect IIS, DNS, SPNs, and CA registration.
During an internal pentest, I confirm whether Windows Authentication is enabled and which provider is active.
The relayed identity determines enrollment
Relay of USER1 creates the context of USER1.
Relay of SERVER01$ creates the context of the machine account.
That changes which templates can be requested.
A machine account often has access to computer templates.
If a Domain Controller authenticates and enrollment allows an appropriate template, impact can become severe.
The attack does not magically turn every machine into Domain Admin.
It requests a certificate within the rights already held by the relayed identity.
The security problem is that the certificate can later become another way to authenticate.
Coerced authentication provides the source
ESC8 often appears together with authentication coercion.
PetitPotam.
PrinterBug.
DFSCoerce.
Other interfaces that make a Windows host authenticate to an attacker-controlled destination.
Those techniques answer:
1
How do I make an interesting identity authenticate to my listener?
ESC8 answers:
1
Where do I forward that authentication so it becomes a certificate?
Keeping the two parts separate makes troubleshooting easier.
If no authentication arrives, inspect the source.
If it arrives and enrollment fails, inspect endpoint protections, templates, and permissions.
A Certipy lab example
Certipy supports relay against AD CS.
Example:
1
2
3
certipy relay \
-target 'http://ca.lab.local/certsrv/certfnsh.asp' \
-template 'Machine'
The listener waits for authentication.
When an NTLM identity arrives, the tool attempts to relay it to the enrollment endpoint and request a compatible certificate.
The correct template depends on the identity and environment.
After issuance, certificate validation still needs to account for certificate mapping and modern Windows hardening.
Issuance and use remain separate stages
Receiving a .pfx proves that the CA issued a credential.
You still need to determine what authentication that certificate enables.
With PKINIT available and mapping accepted, Certipy can attempt authentication.
Modern environments apply strong certificate mapping, which affects several historical paths.
I therefore document:
1
2
3
4
5
Relayed NTLM identity
Template requested
Certificate issued
UPN, SID, and relevant extensions
Result of later authentication
That keeps the finding reproducible and avoids assumptions based on older tooling behavior.
Why a Domain Controller is such a valuable source
A DC computer account represents the Domain Controller itself.
It holds privileges that a normal workstation does not.
If a certificate for DC01$ is obtained and accepted for authentication, the attacker may gain a very strong credential.
The exact path depends on protocol, template, mapping, and Windows version.
That is why DC coercion into AD CS appears frequently in ESC8 research.
The source identity changes the impact.
EPA closes an important relay path
Extended Protection for Authentication uses channel and service information to reduce relayed authentication.
On IIS, it needs correct configuration for the enrollment endpoint.
The presence of TLS alone should not be treated as proof that relay is impossible.
Microsoft recommends fixing enrollment endpoints that accept NTLM without appropriate protection.
During a pentest, test the effective configuration.
HTTPS matters too
HTTP enrollment introduces more than relay exposure.
Transport protection is missing as well.
Certificate enrollment handles sensitive authentication material.
Microsoft Defender for Identity treats insecure IIS enrollment endpoints as an ESC8 posture issue.
Remediation should move enrollment to HTTPS and enable EPA where supported by the architecture.
Certificates change persistence
An NTLM relay event normally exists for a short window.
Authentication arrives.
The attacker uses the session.
The session ends.
With AD CS, that relay may issue a certificate valid for months or years depending on template settings.
That credential may outlive the password involved in the original authentication.
Password rotation does not automatically revoke every previously issued certificate.
Revocation and CRL publication become part of incident response.
That is one reason ESC8 is so significant.
Cleanup during a pentest
I record the certificate serial number.
Template.
CA.
Identity.
Expiration.
Then I agree with the client whether the issued certificate should be revoked.
Leaving an offensive certificate valid after the test creates unnecessary persistence.
I also remove temporary coercion configuration when the lab is not disposable.
Remediation
Disable HTTP enrollment.
Use HTTPS.
Configure EPA on compatible IIS endpoints.
Reduce NTLM where possible.
Review which templates each principal type may request.
Fix coercible authentication sources.
Monitor unusual certificate requests.
Revoke certificates issued during an incident.
The useful takeaway
ESC8 takes authentication that may exist for only a few seconds and tries to turn it into a reusable credential.
The critical weakness sits in the combination of NTLM, IIS, and AD CS issuance trust.
References
Microsoft Defender for Identity, Certificates security posture assessment.
SpecterOps, Certified Pre-Owned.
Certipy, Project documentation.