Certipy ESC11 (RPC Relay to ICPR)

ESC11: ICertPassage RPC interface accepts NTLM without IF_ENFORCEENCRYPTICERTREQUEST. Relay coerced authentication to the CA's RPC endpoint and enroll certificates as the relayed identity.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

certipy

Category

Credential Attacks / ADCS (Certificate Abuse)

Platform

linux

Requires

no credentials

Protocols

RPC

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

certipy relay -target 'rpc://<ca-host>' -template '<template>'

Examples

certipy relay -target 'rpc://ca.corp.local' -template DomainController

Tags

certipy adcs esc11 relay icpr

References

• ESC11 writeup

Related commands

• bloodyAD Shadow Credentials Add a Key Credential (msDS-KeyCredentialLink) to a target object you have GenericWrite…
• Certipy Account Operations Create, update, read, or delete user / computer accounts directly through Certipy.…
• Certipy Authenticate with Certificate Authenticate using a PFX certificate to obtain a TGT and NT hash
• Certipy CA Management Enumerate and manipulate the certificate authority itself: list officers (ESC7), backup…
• Certipy ESC1 (Subject in Request) Exploit ESC1: a template that allows the requester to specify a Subject Alternative Name…
• Certipy ESC13 (OID Group Link) ESC13: a template's issuance policy is linked to a privileged group via…
• Certipy ESC14 (altSecurityIdentities Mapping) ESC14: weak explicit certificate mapping via altSecurityIdentities. With write access…
• Certipy ESC15 (Schema V1 EKUwu) ESC15 / EKUwu: schema v1 templates honor Application Policies from the CSR, letting an…