This post explains how to execute an ESC1 attack using AS2Go v2.9.

In three out of four Active Directory Security Assessments (ADSA), my colleagues and I identified vulnerabilities in Active Directory Certificate Services (ADCS). Most issues stem from certificate templates that, by default, are secure but become vulnerable due to human misconfigurations.

This discovery prompted me to enhance my script, “Attack Scenario To Go” (AS2Go), by adding a new privilege escalation method and creating this corresponding blog post.