Forged Trust

The definitive offensive reference for Active Directory Certificate Services. Active Directory Certificate Services is one of the most consistently overlooked attack surfaces in enterprise environments. Misconfigured certificate templates, overpermissioned CAs, and weak enrollment controls routinely enable privilege escalation, credential theft, and persistence that survives credential resets - yet most practitioners lack the foundational depth to exploit these paths reliably. Forged Trust documents the complete ADCS attack taxonomy from first principles: ESC1 through ESC18, THEFT1 through THEFT5, PERSIST1 through PERSIST3, and DPERSIST1 through DPERSIST3. Every technique is covered end to end - the misconfiguration root cause, prerequisites, exploitation, and detection artifacts - alongside the KB5014754 enforcement landscape, Shadow Credentials, PKINIT abuse, and certificate-based authentication internals.

What this book covers:

• Full ESC1-ESC18 misconfiguration taxonomy with exploitation walkthroughs
• Certificate theft via Windows Certificate Store, DPAPI, LSASS, and CA database
• PKINIT internals and NT hash extraction via User-to-User Kerberos
• Shadow Credentials and msDS-KeyCredentialLink abuse
• KB5014754 enforcement modes and attack viability matrix
• Certificate-based persistence via PERSIST and DPERSIST chains
• Detection opportunities and event IDs at every stage