ADCS Abuse ESC7

🧠 What Is ESC7?

ESC7 happens when a low-privileged user has dangerous permissions over the Certification Authority (CA) itself.

Specifically:

If you have:

• Manage CA
• or Manage Certificates

You can escalate privileges.

⚠️ This is NOT template-based.

⚠️ This is NOT SAN-based.

⚠️ This is CA object permission abuse.

If a normal user has:

• 🟢 Manage CA
• 🟢 Manage Certificates

💥 That’s ESC7.

🚨 Why Is It Dangerous?

Because with Manage CA, you can:

1. Enable a disabled template
2. Add a vulnerable template
3. Modify CA settings
4. Approve pending certificate requests

This allows you to:

👉 Issue yourself a certificate for a Domain Admin

👉 Authenticate as that user

👉 Get DA access